From fc6e6f03d5c82d32e013247c0906605ce42cbd83 Mon Sep 17 00:00:00 2001
From: neon <18559658+neonsolstice@users.noreply.github.com>
Date: Mon, 31 Aug 2026 16:33:40 +0000
Subject: [PATCH] feat(book-requests): add automated request fulfillment

Let users request books, route approvals, search configured sources, and import fulfilled releases through the Book Dock. Include scoped permissions, automation, download-client integrations, plugin support, requester visibility, and one consolidated schema migration.

Closes #248
Ref #1115
---
 .github/workflows/ci.yml                      |     2 +-
 README.md                                     |     2 +
 client/src/assets/main.css                    |    30 +
 client/src/assets/theme/bridge.css            |     2 +
 client/src/assets/theme/tokens.css            |    93 +
 client/src/components/AppLayout.vue           |     8 +
 client/src/components/AppSidebar.vue          |    30 +-
 .../src/components/sidebar/SidebarBadge.vue   |    20 +-
 .../sidebar/SidebarSectionHeader.vue          |     5 +-
 .../sidebar/SidebarSectionPopover.vue         |     2 +-
 .../sidebar/__tests__/SidebarBadge.spec.ts    |    12 +
 client/src/components/ui/ChipInput.vue        |    84 +-
 client/src/components/ui/TokenSelect.vue      |   206 +
 .../components/ui/__tests__/ChipInput.spec.ts |    84 +
 .../ui/__tests__/TokenSelect.spec.ts          |   117 +
 .../composables/__tests__/useRouteTab.spec.ts |   105 +
 .../__tests__/useSidebarNav.spec.ts           |    97 +-
 .../settings => }/composables/useRouteTab.ts  |     5 +-
 client/src/composables/useSidebarNav.ts       |    56 +-
 client/src/features/admin/UserFormDrawer.vue  |   981 +-
 client/src/features/admin/UsersPage.vue       |    16 +-
 .../admin/__tests__/UserFormDrawer.spec.ts    |   301 +
 .../admin/__tests__/UsersPage.spec.ts         |    14 +-
 .../components/UserPermissionsSection.vue     |   239 +
 .../components/UserRestrictionsSection.vue    |   150 +
 .../features/admin/composables/useUserForm.ts |   370 +
 .../features/admin/composables/useUsers.ts    |     2 +-
 .../lib/__tests__/permission-presets.spec.ts  |    65 +-
 .../features/admin/lib/permission-presets.ts  |   110 +-
 client/src/features/audit/audit-resources.ts  |     3 +
 .../src/features/auth/composables/useAuth.ts  |     2 +
 .../book-dock/components/BookDockFileRow.vue  |    48 +-
 .../__tests__/BookDockFileRow.spec.ts         |   108 +-
 .../__tests__/BookDockFileSheet.spec.ts       |     1 +
 .../book-requests/BookRequestsPage.vue        |   798 +
 .../ReleaseFileInspectionPanel.spec.ts        |   227 +
 .../__tests__/ReleasePickerPanel.spec.ts      |   764 +
 .../__tests__/ReleaseUnitChooser.spec.ts      |    74 +
 .../__tests__/RequestAttemptsPanel.spec.ts    |   107 +
 .../__tests__/RequestCover.spec.ts            |    91 +
 .../__tests__/RequestDownloadProgress.spec.ts |   178 +
 .../RequestPipeline.component.spec.ts         |    62 +
 .../__tests__/RequestReviewPanel.spec.ts      |   120 +
 .../__tests__/RequestSearchPanel.spec.ts      |   778 +
 .../__tests__/RequestSeedPanel.spec.ts        |   205 +
 .../__tests__/releaseFacets.spec.ts           |    96 +
 .../__tests__/requestActions.spec.ts          |   121 +
 .../__tests__/requestOutcome.spec.ts          |    96 +
 .../__tests__/requestPipelineState.spec.ts    |    99 +
 .../__tests__/sourceColors.spec.ts            |    36 +
 .../__tests__/useBookRequestDetail.spec.ts    |   106 +
 .../__tests__/useBookRequestProgress.spec.ts  |   212 +
 .../__tests__/useBookRequestSummary.spec.ts   |    65 +
 .../__tests__/useBookRequests.spec.ts         |   232 +
 .../__tests__/useCandidateGroups.spec.ts      |   259 +
 .../__tests__/useCoalescedRefresh.spec.ts     |    87 +
 .../__tests__/useFulfilmentPicker.spec.ts     |    98 +
 .../__tests__/useReleaseFilters.spec.ts       |   145 +
 .../__tests__/useReleaseGrab.spec.ts          |   157 +
 .../__tests__/useReleasePicker.spec.ts        |   359 +
 .../useRequestDestinationDefault.spec.ts      |   229 +
 .../__tests__/useRequestSubmission.spec.ts    |   191 +
 .../components/GrabReleaseDialog.vue          |   171 +
 .../components/NoRequestSourcesNotice.vue     |    50 +
 .../components/ReleaseFileInspectionPanel.vue |   166 +
 .../components/ReleasePickerPanel.vue         |  1284 ++
 .../components/ReleaseUnitChooser.vue         |    68 +
 .../components/RequestAttemptsPanel.vue       |   105 +
 .../book-requests/components/RequestCover.vue |    74 +
 .../components/RequestDetailPanel.vue         |   976 +
 .../components/RequestDownloadProgress.vue    |   121 +
 .../components/RequestDrawer.vue              |    66 +
 .../components/RequestDrawerToolbar.vue       |    90 +
 .../components/RequestEmptyState.vue          |    24 +
 .../components/RequestListSkeleton.vue        |    31 +
 .../components/RequestListTable.vue           |   575 +
 .../components/RequestPipeline.vue            |   106 +
 .../components/RequestReviewPanel.vue         |   145 +
 .../components/RequestRowActions.vue          |   109 +
 .../components/RequestSearchPanel.vue         |  1037 +
 .../components/RequestSeedPanel.vue           |   201 +
 .../components/RequestStatusBadge.vue         |    53 +
 .../composables/useBookRequestDetail.ts       |    66 +
 .../composables/useBookRequestProgress.ts     |   158 +
 .../composables/useBookRequestSummary.ts      |    60 +
 .../composables/useBookRequests.ts            |   368 +
 .../composables/useCandidateGroups.ts         |   200 +
 .../composables/useCoalescedRefresh.ts        |    32 +
 .../composables/useDownloadClients.ts         |   237 +
 .../composables/useFulfilmentPicker.ts        |   142 +
 .../book-requests/composables/useIndexers.ts  |   203 +
 .../composables/useReleaseFacetGroups.ts      |   160 +
 .../composables/useReleaseFilters.ts          |   298 +
 .../composables/useReleaseGrab.ts             |   150 +
 .../composables/useReleasePicker.ts           |   234 +
 .../composables/useReleaseSearchEditor.ts     |   248 +
 .../composables/useRequestAttempts.ts         |    54 +
 .../composables/useRequestAutomation.ts       |    64 +
 .../useRequestDestinationDefault.ts           |   205 +
 .../composables/useRequestListDensity.ts      |    38 +
 .../composables/useRequestQueue.ts            |    27 +
 .../composables/useRequestReview.ts           |    55 +
 .../composables/useRequestSeedStatus.ts       |    49 +
 .../composables/useRequestSourceStatus.ts     |    48 +
 .../composables/useRequestSubmission.ts       |   379 +
 .../features/book-requests/fulfilmentBase.ts  |    21 +
 .../features/book-requests/releaseFacets.ts   |    50 +
 .../requestActionFailure.test.ts              |    30 +
 .../book-requests/requestActionFailure.ts     |    24 +
 .../features/book-requests/requestActions.ts  |    63 +
 .../book-requests/requestDrawerContext.ts     |    19 +
 .../features/book-requests/requestOutcome.ts  |    77 +
 .../features/book-requests/requestPipeline.ts |   128 +
 .../features/book-requests/sourceColors.ts    |    61 +
 .../__tests__/useMetadataSearch.spec.ts       |    28 +-
 .../book/composables/useMetadataSearch.ts     |    21 +
 .../email/components/EmailSettings.vue        |     2 +-
 .../components/NotificationItem.spec.ts       |   105 +-
 .../components/NotificationItem.vue           |    94 +-
 .../lib/notification-category-groups.ts       |     5 +-
 .../features/settings/ConnectionHealth.vue    |    56 +
 .../settings/DownloadClientsPanel.vue         |   854 +
 .../settings/RequestAutomationPanel.vue       |   548 +
 .../settings/RequestIndexersPanel.vue         |   927 +
 .../features/settings/RequestsSettings.vue    |    77 +
 client/src/features/settings/SearchHealth.vue |    54 +
 .../__tests__/ConnectionHealth.spec.ts        |    47 +
 .../__tests__/DownloadClientsPanel.spec.ts    |   282 +
 .../__tests__/RequestAutomationPanel.spec.ts  |   452 +
 .../__tests__/RequestIndexersPanel.spec.ts    |  1098 +
 .../__tests__/RequestsSettings.spec.ts        |    75 +
 .../settings/__tests__/SearchHealth.spec.ts   |    40 +
 .../__tests__/SettingsEditorSheet.spec.ts     |   159 +
 .../settings/__tests__/SettingsNav.spec.ts    |   158 +-
 .../__tests__/SettingsSidebar.spec.ts         |     3 +-
 .../settings/__tests__/settings-nav.spec.ts   |    22 +-
 .../settings/__tests__/system-tabs.spec.ts    |    46 +-
 .../__tests__/useSettingsDraft.spec.ts        |    72 +
 .../settings/components/AdapterTypePicker.vue |    56 +
 .../settings/components/FieldHint.vue         |    15 +
 .../components/PluginDirectoryLink.vue        |    27 +
 .../components/PluginVersionBadge.vue         |    20 +
 .../components/ReleaseProfileEditor.vue       |   410 +
 .../components/RequestDestinationRow.vue      |   105 +
 .../settings/components/RequestSourceRow.vue  |   204 +
 .../components/RequestSourcesEmpty.vue        |    79 +
 .../components/SettingsEditorSheet.vue        |   229 +
 .../components/SettingsEmptyPanel.vue         |    50 +
 .../settings/components/SettingsField.vue     |    50 +
 .../settings/components/SettingsNav.vue       |    83 +-
 .../settings/components/SettingsRow.vue       |    21 +
 .../settings/components/SettingsSection.vue   |    16 +
 .../settings/components/SettingsSlider.vue    |    33 +
 .../components/SettingsToggleField.vue        |    39 +
 .../settings/components/SourceColorPicker.vue |    68 +
 .../__tests__/useSettingsNavStatus.spec.ts    |   125 +
 .../settings/composables/useIndexerDraft.ts   |   451 +
 .../settings/composables/useIndexerPlugins.ts |   328 +
 .../settings/composables/useSettingsDraft.ts  |    59 +
 .../composables/useSettingsNavStatus.ts       |    29 +
 .../features/settings/lib/editor-actions.ts   |    17 +
 .../src/features/settings/lib/settings-nav.ts |   253 +-
 .../src/features/settings/lib/system-tabs.ts  |    23 +-
 client/src/locales/en.json                    |  1278 +-
 client/src/router/index.ts                    |    30 +
 docs/AUDIOBOOKSHELF_MIGRATION.md              |   218 -
 docs/BOOK_REQUESTS.md                         |   169 +
 docs/CALIBRE_WEB_AUTOMATED_MIGRATION.md       |   290 -
 packages/plugin-api/package.json              |    14 +
 packages/plugin-api/src/index.ts              |   224 +
 packages/plugin-api/tsconfig.json             |    15 +
 packages/types/src/audit.ts                   |    24 +
 packages/types/src/book-dock.ts               |    25 +-
 packages/types/src/book-request-automation.ts |   192 +
 .../types/src/book-request-destination.ts     |    47 +
 .../types/src/book-request-preferences.ts     |    32 +
 packages/types/src/book-request-profile.ts    |   198 +
 packages/types/src/book-request-review.ts     |    61 +
 packages/types/src/book-request.ts            |   573 +
 packages/types/src/book.ts                    |    16 +-
 packages/types/src/content-filter.ts          |     8 +
 packages/types/src/download-client.ts         |   370 +
 packages/types/src/index.ts                   |    11 +
 packages/types/src/indexer.ts                 |   599 +
 packages/types/src/language.ts                |   123 +
 packages/types/src/metadata-fetch.ts          |     2 +
 packages/types/src/network-profile.ts         |    26 +
 packages/types/src/notification.ts            |    15 +
 packages/types/src/permissions.ts             |    39 +
 packages/types/src/request-credential.ts      |     8 +
 pnpm-lock.yaml                                |    12 +
 scripts/e2e/suite-registry.mjs                |    25 +
 server/.env.example                           |    19 +
 server/package.json                           |    12 +-
 server/src/app.module.ts                      |    16 +-
 .../archive/release-archive-sevenzip.test.ts  |    59 +
 .../common/archive/release-archive.test.ts    |   433 +
 server/src/common/archive/release-archive.ts  |   393 +
 .../decorators/common-decorators.test.ts      |     8 +
 .../require-any-permission.decorator.ts       |    11 +
 .../filters/http-exception.filter.test.ts     |    41 +
 .../common/filters/http-exception.filter.ts   |    17 +
 .../common/guards/permission.guard.test.ts    |    54 +
 server/src/common/guards/permission.guard.ts  |     7 +
 server/src/common/sevenzip.ts                 |    20 +-
 .../src/common/text-match/isbn-normalize.ts   |    13 +
 .../text-match}/title-match.test.ts           |     0
 .../text-match}/title-match.ts                |    38 +
 .../src/common/utils/bounded-response.test.ts |   105 +
 server/src/common/utils/bounded-response.ts   |    89 +
 .../utils/content-filter-sql.utils.test.ts    |    11 +
 .../common/utils/content-filter-sql.utils.ts  |    48 +-
 .../src/common/utils/db-error.utils.test.ts   |    27 +
 server/src/common/utils/db-error.utils.ts     |    20 +
 server/src/common/utils/safe-fetch.test.ts    |   159 +
 server/src/common/utils/safe-fetch.ts         |   138 +
 server/src/common/utils/ssrf.utils.ts         |     3 +-
 .../common/utils/with-deadline.utils.test.ts  |    44 +
 .../src/common/utils/with-deadline.utils.ts   |    33 +
 server/src/common/utils/ws-cors.utils.test.ts |    37 +
 server/src/common/utils/ws-cors.utils.ts      |    23 +
 server/src/config/config.ts                   |     9 +
 server/src/config/env.validation.ts           |     1 +
 .../db/migrations/0083_add_book_requests.sql  |   214 +
 .../src/db/migrations/meta/0083_snapshot.json | 18335 ++++++++++++++++
 server/src/db/migrations/meta/_journal.json   |     7 +
 server/src/db/schema/auth.ts                  |     6 +
 server/src/db/schema/book-dock.ts             |    52 +-
 .../db/schema/book-requests.schema.test.ts    |    55 +
 server/src/db/schema/book-requests.ts         |   217 +
 .../db/schema/download-clients.schema.test.ts |    52 +
 server/src/db/schema/download-clients.ts      |   182 +
 server/src/db/schema/index.ts                 |     3 +
 .../db/schema/request-indexers.schema.test.ts |    46 +
 server/src/db/schema/request-indexers.ts      |    97 +
 .../app-settings/app-settings.service.ts      |    24 +
 server/src/modules/auth/auth.service.test.ts  |    54 +
 server/src/modules/auth/auth.service.ts       |    30 +-
 .../book-dock-finalize.service.test.ts        |   491 +-
 .../book-dock/book-dock-finalize.service.ts   |   365 +-
 .../book-dock-ingest.service.test.ts          |    80 +
 .../book-dock/book-dock-ingest.service.ts     |    74 +-
 .../book-dock-unit-files.sql.test.ts          |    28 +
 .../book-dock-watcher.service.test.ts         |    77 +-
 .../book-dock/book-dock-watcher.service.ts    |    85 +-
 .../modules/book-dock/book-dock.gateway.ts    |     3 +-
 .../src/modules/book-dock/book-dock.module.ts |     2 +-
 .../modules/book-dock/book-dock.repository.ts |    71 +-
 .../book-dock/book-dock.service.test.ts       |     3 +
 .../modules/book-dock/book-dock.service.ts    |    29 +-
 .../book-metadata-fetch.gateway.ts            |     3 +-
 .../book-request-admin.controller.ts          |   303 +
 .../book-request-attribution.service.test.ts  |   130 +
 .../book-request-attribution.service.ts       |    82 +
 .../book-request-automation.controller.ts     |    36 +
 .../book-request-dedupe.service.test.ts       |   452 +
 .../book-request-dedupe.service.ts            |   179 +
 .../book-request-events.service.ts            |    15 +
 .../book-request-notifier.service.test.ts     |   129 +
 .../book-request-notifier.service.ts          |    98 +
 .../book-request-self-fulfil.controller.ts    |   166 +
 .../book-request/book-request.controller.ts   |   150 +
 .../book-request/book-request.gateway.test.ts |    79 +
 .../book-request/book-request.gateway.ts      |    93 +
 .../book-request/book-request.mapper.ts       |   103 +
 .../book-request/book-request.module.ts       |   148 +
 .../book-request.repository.test.ts           |   391 +
 .../book-request/book-request.repository.ts   |   823 +
 .../book-request/book-request.service.test.ts |  2096 ++
 .../book-request/book-request.service.ts      |  1141 +
 .../adapters/client-http.utils.test.ts        |   167 +
 .../adapters/client-http.utils.ts             |    90 +
 .../adapters/deluge.adapter.test.ts           |   469 +
 .../adapters/deluge.adapter.ts                |   443 +
 .../adapters/qbittorrent.adapter.test.ts      |   401 +
 .../adapters/qbittorrent.adapter.ts           |   341 +
 .../adapters/transmission.adapter.test.ts     |   403 +
 .../adapters/transmission.adapter.ts          |   348 +
 .../download-client-adapter.ts                |   108 +
 .../download-client-config.service.test.ts    |   361 +
 .../download-client-config.service.ts         |   341 +
 ...load-client-reconciliation.service.test.ts |   164 +
 .../download-client-reconciliation.service.ts |   175 +
 .../download-client-registry.ts               |    24 +
 .../download-client.controller.ts             |   111 +
 .../download-client.repository.test.ts        |   118 +
 .../download-client.repository.ts             |   141 +
 .../dto/download-client.dto.test.ts           |    25 +
 .../dto/download-client.dto.ts                |   172 +
 .../dto/reconcile-download-client.dto.ts      |    13 +
 .../path-mapping.service.test.ts              |   177 +
 .../download-clients/path-mapping.service.ts  |   209 +
 .../dto/automation-settings.dto.ts            |   244 +
 .../dto/bulk-book-requests.dto.ts             |    28 +
 .../dto/check-availability.dto.ts             |    42 +
 .../dto/create-book-request.dto.test.ts       |    27 +
 .../dto/create-book-request.dto.ts            |   159 +
 .../dto/decide-book-request.dto.ts            |    21 +
 .../dto/fulfill-book-request.dto.ts           |    22 +
 .../book-request/dto/grab-book-request.dto.ts |    49 +
 .../dto/inspect-book-request-release.dto.ts   |    14 +
 .../dto/list-book-requests.dto.test.ts        |    49 +
 .../dto/list-book-requests.dto.ts             |    71 +
 .../dto/list-requester-options.dto.ts         |    14 +
 .../book-request/dto/release-guid.dto.test.ts |    17 +
 .../book-request/dto/remove-download.dto.ts   |    11 +
 .../dto/search-book-request-releases.dto.ts   |    33 +
 .../dto/select-release-unit.dto.ts            |    10 +
 .../dto/update-book-request-language.dto.ts   |    15 +
 .../book-request-download.repository.test.ts  |    47 +
 .../book-request-download.repository.ts       |   409 +
 .../direct-download.service.test.ts           |   649 +
 .../fulfillment/direct-download.service.ts    |   611 +
 .../download-monitor.service.test.ts          |   546 +
 .../fulfillment/download-monitor.service.ts   |   350 +
 .../download-removal.service.test.ts          |   142 +
 .../fulfillment/download-removal.service.ts   |   152 +
 ...st-automation-search-delay.service.test.ts |    28 +
 ...request-automation-search-delay.service.ts |    12 +
 ...equest-automation-settings.service.test.ts |   287 +
 .../request-automation-settings.service.ts    |   278 +
 .../request-automation.service.test.ts        |   893 +
 .../fulfillment/request-automation.service.ts |   643 +
 .../request-fulfillment.service.test.ts       |   903 +
 .../request-fulfillment.service.ts            |  1034 +
 .../fulfillment/request-import-queue.test.ts  |   103 +
 .../fulfillment/request-import-queue.ts       |    94 +
 .../request-import.service.test.ts            |   840 +
 .../fulfillment/request-import.service.ts     |   721 +
 .../fulfillment/request-seed.service.test.ts  |   191 +
 .../fulfillment/request-seed.service.ts       |    87 +
 .../request-user-cleanup.service.test.ts      |    67 +
 .../request-user-cleanup.service.ts           |    67 +
 .../request-verification.service.test.ts      |   562 +
 .../request-verification.service.ts           |   542 +
 .../request-watchdog.service.test.ts          |   238 +
 .../fulfillment/request-watchdog.service.ts   |   246 +
 .../fulfillment/torrent.utils.test.ts         |   184 +
 .../book-request/fulfillment/torrent.utils.ts |   261 +
 .../indexers/adapters/torznab.adapter.test.ts |   471 +
 .../indexers/adapters/torznab.adapter.ts      |   363 +
 .../book-request/indexers/dto/indexer.dto.ts  |   220 +
 .../book-request/indexers/indexer-adapter.ts  |   191 +
 .../indexers/indexer-config.service.test.ts   |   373 +
 .../indexers/indexer-config.service.ts        |   396 +
 .../indexers/indexer-credential-store.test.ts |   130 +
 .../indexers/indexer-credential-store.ts      |    81 +
 .../indexer-keepalive.service.test.ts         |   105 +
 .../indexers/indexer-keepalive.service.ts     |    94 +
 .../indexers/indexer-operation-lock.ts        |    22 +
 .../indexers/indexer-registry.test.ts         |    30 +
 .../book-request/indexers/indexer-registry.ts |   164 +
 .../indexers/indexer-search.service.test.ts   |   698 +
 .../indexers/indexer-search.service.ts        |   423 +
 .../indexers/indexer.controller.test.ts       |   140 +
 .../indexers/indexer.controller.ts            |   178 +
 .../indexers/indexer.repository.test.ts       |    87 +
 .../indexers/indexer.repository.ts            |   138 +
 .../indexers/plugins/plugin-host.test.ts      |   537 +
 .../indexers/plugins/plugin-host.ts           |   397 +
 .../plugins/plugin-install.service.test.ts    |   375 +
 .../plugins/plugin-install.service.ts         |   292 +
 .../plugins/plugin-loader.service.test.ts     |   227 +
 .../indexers/plugins/plugin-loader.service.ts |   184 +
 .../indexers/plugins/plugin-shape.ts          |   144 +
 .../indexers/release-profile.test.ts          |   194 +
 .../indexers/release-scoring.test.ts          |   346 +
 .../book-request/indexers/release-scoring.ts  |   408 +
 .../book-request/indexers/search-text.test.ts |    30 +
 .../book-request/indexers/search-text.ts      |    26 +
 .../request-credential.service.test.ts        |    53 +
 .../request-credential.service.ts             |    83 +
 .../formats/cbx/cb7-format-writer.test.ts     |     1 +
 .../src/modules/library/library.repository.ts |    20 +-
 server/src/modules/library/library.service.ts |    11 +
 .../metadata-fetch/candidate-agreement.ts     |     2 +-
 .../candidate-relevance.test.ts               |     8 +
 .../metadata-fetch/candidate-relevance.ts     |     8 +-
 .../dto/metadata-search.dto.test.ts           |    14 +-
 .../metadata-fetch/dto/metadata-search.dto.ts |    16 +-
 .../src/modules/metadata-fetch/isbn-match.ts  |     6 +-
 .../metadata-fetch.controller.test.ts         |    86 +-
 .../metadata-fetch.controller.ts              |    40 +-
 .../metadata-fetch.service.test.ts            |    33 +
 .../metadata-fetch/metadata-fetch.service.ts  |     8 +-
 .../metadata-fetch/provider-registry.test.ts  |    39 +-
 .../metadata-fetch/provider-registry.ts       |    13 +-
 .../provider-throttle.error.test.ts           |    13 +
 .../metadata-fetch/provider-throttle.error.ts |    12 +-
 .../providers/amazon/amazon.provider.ts       |    16 +-
 .../providers/audible/audible.provider.ts     |     1 +
 .../providers/audnexus/audnexus.provider.ts   |     1 +
 .../providers/comicvine/comicvine.provider.ts |     1 +
 .../goodreads/goodreads.provider.test.ts      |    54 +
 .../providers/goodreads/goodreads.provider.ts |    30 +-
 .../google/google-cover-validator.test.ts     |    85 +
 .../google/google-cover-validator.ts          |   129 +
 .../providers/google/google.provider.test.ts  |    56 +
 .../providers/google/google.provider.ts       |     9 +-
 .../providers/kobo/kobo.provider.ts           |    20 +-
 .../providers/librofm/librofm.provider.ts     |    15 +-
 .../lubimyczytac/lubimyczytac.provider.ts     |    18 +-
 .../providers/metadata-provider.ts            |     7 +-
 .../providers/metadata-search-params.ts       |     3 +
 .../providers/provider-utils.test.ts          |    64 +-
 .../providers/provider-utils.ts               |    15 +
 .../providers/ranobedb/ranobedb.provider.ts   |    15 +-
 .../modules/metadata/lib/cover-cb7.test.ts    |     2 +-
 .../src/modules/metadata/lib/isbn-detect.ts   |     6 +-
 .../modules/metadata/lib/opf-parser.test.ts   |    21 +
 server/src/modules/metadata/lib/opf-parser.ts |    23 +
 .../src/modules/metadata/lib/sevenzip-vfs.ts  |     7 +-
 .../modules/reader/cbz/cbz.service.test.ts    |     2 +-
 .../modules/scanner/lib/release-plan.test.ts  |   334 +
 .../src/modules/scanner/lib/release-plan.ts   |   410 +
 server/src/modules/scanner/lib/stability.ts   |    83 +-
 server/src/modules/scanner/lib/walk.ts        |     4 +-
 .../upload/upload-processor.service.test.ts   |    77 +
 .../upload/upload-processor.service.ts        |   214 +-
 .../user-preferences.controller.test.ts       |    18 +
 .../user-preferences.controller.ts            |    12 +
 .../user-preferences.service.test.ts          |    77 +-
 .../user-preferences.service.ts               |    55 +
 .../user/content-filter.repository.test.ts    |    10 +
 .../modules/user/content-filter.repository.ts |    21 +-
 .../user/dto/set-content-filters.dto.ts       |     7 +-
 .../src/modules/user/user-events.service.ts   |    25 +
 server/src/modules/user/user.module.test.ts   |     3 +
 server/src/modules/user/user.module.ts        |    21 +-
 .../src/modules/user/user.repository.test.ts  |    93 +
 server/src/modules/user/user.repository.ts    |    21 +-
 server/src/modules/user/user.service.test.ts  |    62 +-
 server/src/modules/user/user.service.ts       |    38 +-
 server/src/scripts/migrate.ts                 |     5 +-
 .../migration-ledger-compatibility.test.ts    |    64 +
 .../scripts/migration-ledger-compatibility.ts |    69 +
 server/test/authorization-matrix.e2e-spec.ts  |    77 +-
 server/test/book-requests.e2e-spec.ts         |   679 +
 .../route-inventory/manifest.json             |    23 +-
 .../route-inventory/routes-05.json            |     2 +-
 .../route-inventory/routes-06.json            |    24 +
 .../route-inventory/routes-08.json            |   865 +
 .../route-inventory/uncovered-routes.json     |   300 +
 443 files changed, 87915 insertions(+), 1730 deletions(-)
 create mode 100644 client/src/components/ui/TokenSelect.vue
 create mode 100644 client/src/components/ui/__tests__/ChipInput.spec.ts
 create mode 100644 client/src/components/ui/__tests__/TokenSelect.spec.ts
 create mode 100644 client/src/composables/__tests__/useRouteTab.spec.ts
 rename client/src/{features/settings => }/composables/useRouteTab.ts (90%)
 create mode 100644 client/src/features/admin/__tests__/UserFormDrawer.spec.ts
 create mode 100644 client/src/features/admin/components/UserPermissionsSection.vue
 create mode 100644 client/src/features/admin/components/UserRestrictionsSection.vue
 create mode 100644 client/src/features/admin/composables/useUserForm.ts
 create mode 100644 client/src/features/book-requests/BookRequestsPage.vue
 create mode 100644 client/src/features/book-requests/__tests__/ReleaseFileInspectionPanel.spec.ts
 create mode 100644 client/src/features/book-requests/__tests__/ReleasePickerPanel.spec.ts
 create mode 100644 client/src/features/book-requests/__tests__/ReleaseUnitChooser.spec.ts
 create mode 100644 client/src/features/book-requests/__tests__/RequestAttemptsPanel.spec.ts
 create mode 100644 client/src/features/book-requests/__tests__/RequestCover.spec.ts
 create mode 100644 client/src/features/book-requests/__tests__/RequestDownloadProgress.spec.ts
 create mode 100644 client/src/features/book-requests/__tests__/RequestPipeline.component.spec.ts
 create mode 100644 client/src/features/book-requests/__tests__/RequestReviewPanel.spec.ts
 create mode 100644 client/src/features/book-requests/__tests__/RequestSearchPanel.spec.ts
 create mode 100644 client/src/features/book-requests/__tests__/RequestSeedPanel.spec.ts
 create mode 100644 client/src/features/book-requests/__tests__/releaseFacets.spec.ts
 create mode 100644 client/src/features/book-requests/__tests__/requestActions.spec.ts
 create mode 100644 client/src/features/book-requests/__tests__/requestOutcome.spec.ts
 create mode 100644 client/src/features/book-requests/__tests__/requestPipelineState.spec.ts
 create mode 100644 client/src/features/book-requests/__tests__/sourceColors.spec.ts
 create mode 100644 client/src/features/book-requests/__tests__/useBookRequestDetail.spec.ts
 create mode 100644 client/src/features/book-requests/__tests__/useBookRequestProgress.spec.ts
 create mode 100644 client/src/features/book-requests/__tests__/useBookRequestSummary.spec.ts
 create mode 100644 client/src/features/book-requests/__tests__/useBookRequests.spec.ts
 create mode 100644 client/src/features/book-requests/__tests__/useCandidateGroups.spec.ts
 create mode 100644 client/src/features/book-requests/__tests__/useCoalescedRefresh.spec.ts
 create mode 100644 client/src/features/book-requests/__tests__/useFulfilmentPicker.spec.ts
 create mode 100644 client/src/features/book-requests/__tests__/useReleaseFilters.spec.ts
 create mode 100644 client/src/features/book-requests/__tests__/useReleaseGrab.spec.ts
 create mode 100644 client/src/features/book-requests/__tests__/useReleasePicker.spec.ts
 create mode 100644 client/src/features/book-requests/__tests__/useRequestDestinationDefault.spec.ts
 create mode 100644 client/src/features/book-requests/__tests__/useRequestSubmission.spec.ts
 create mode 100644 client/src/features/book-requests/components/GrabReleaseDialog.vue
 create mode 100644 client/src/features/book-requests/components/NoRequestSourcesNotice.vue
 create mode 100644 client/src/features/book-requests/components/ReleaseFileInspectionPanel.vue
 create mode 100644 client/src/features/book-requests/components/ReleasePickerPanel.vue
 create mode 100644 client/src/features/book-requests/components/ReleaseUnitChooser.vue
 create mode 100644 client/src/features/book-requests/components/RequestAttemptsPanel.vue
 create mode 100644 client/src/features/book-requests/components/RequestCover.vue
 create mode 100644 client/src/features/book-requests/components/RequestDetailPanel.vue
 create mode 100644 client/src/features/book-requests/components/RequestDownloadProgress.vue
 create mode 100644 client/src/features/book-requests/components/RequestDrawer.vue
 create mode 100644 client/src/features/book-requests/components/RequestDrawerToolbar.vue
 create mode 100644 client/src/features/book-requests/components/RequestEmptyState.vue
 create mode 100644 client/src/features/book-requests/components/RequestListSkeleton.vue
 create mode 100644 client/src/features/book-requests/components/RequestListTable.vue
 create mode 100644 client/src/features/book-requests/components/RequestPipeline.vue
 create mode 100644 client/src/features/book-requests/components/RequestReviewPanel.vue
 create mode 100644 client/src/features/book-requests/components/RequestRowActions.vue
 create mode 100644 client/src/features/book-requests/components/RequestSearchPanel.vue
 create mode 100644 client/src/features/book-requests/components/RequestSeedPanel.vue
 create mode 100644 client/src/features/book-requests/components/RequestStatusBadge.vue
 create mode 100644 client/src/features/book-requests/composables/useBookRequestDetail.ts
 create mode 100644 client/src/features/book-requests/composables/useBookRequestProgress.ts
 create mode 100644 client/src/features/book-requests/composables/useBookRequestSummary.ts
 create mode 100644 client/src/features/book-requests/composables/useBookRequests.ts
 create mode 100644 client/src/features/book-requests/composables/useCandidateGroups.ts
 create mode 100644 client/src/features/book-requests/composables/useCoalescedRefresh.ts
 create mode 100644 client/src/features/book-requests/composables/useDownloadClients.ts
 create mode 100644 client/src/features/book-requests/composables/useFulfilmentPicker.ts
 create mode 100644 client/src/features/book-requests/composables/useIndexers.ts
 create mode 100644 client/src/features/book-requests/composables/useReleaseFacetGroups.ts
 create mode 100644 client/src/features/book-requests/composables/useReleaseFilters.ts
 create mode 100644 client/src/features/book-requests/composables/useReleaseGrab.ts
 create mode 100644 client/src/features/book-requests/composables/useReleasePicker.ts
 create mode 100644 client/src/features/book-requests/composables/useReleaseSearchEditor.ts
 create mode 100644 client/src/features/book-requests/composables/useRequestAttempts.ts
 create mode 100644 client/src/features/book-requests/composables/useRequestAutomation.ts
 create mode 100644 client/src/features/book-requests/composables/useRequestDestinationDefault.ts
 create mode 100644 client/src/features/book-requests/composables/useRequestListDensity.ts
 create mode 100644 client/src/features/book-requests/composables/useRequestQueue.ts
 create mode 100644 client/src/features/book-requests/composables/useRequestReview.ts
 create mode 100644 client/src/features/book-requests/composables/useRequestSeedStatus.ts
 create mode 100644 client/src/features/book-requests/composables/useRequestSourceStatus.ts
 create mode 100644 client/src/features/book-requests/composables/useRequestSubmission.ts
 create mode 100644 client/src/features/book-requests/fulfilmentBase.ts
 create mode 100644 client/src/features/book-requests/releaseFacets.ts
 create mode 100644 client/src/features/book-requests/requestActionFailure.test.ts
 create mode 100644 client/src/features/book-requests/requestActionFailure.ts
 create mode 100644 client/src/features/book-requests/requestActions.ts
 create mode 100644 client/src/features/book-requests/requestDrawerContext.ts
 create mode 100644 client/src/features/book-requests/requestOutcome.ts
 create mode 100644 client/src/features/book-requests/requestPipeline.ts
 create mode 100644 client/src/features/book-requests/sourceColors.ts
 create mode 100644 client/src/features/settings/ConnectionHealth.vue
 create mode 100644 client/src/features/settings/DownloadClientsPanel.vue
 create mode 100644 client/src/features/settings/RequestAutomationPanel.vue
 create mode 100644 client/src/features/settings/RequestIndexersPanel.vue
 create mode 100644 client/src/features/settings/RequestsSettings.vue
 create mode 100644 client/src/features/settings/SearchHealth.vue
 create mode 100644 client/src/features/settings/__tests__/ConnectionHealth.spec.ts
 create mode 100644 client/src/features/settings/__tests__/DownloadClientsPanel.spec.ts
 create mode 100644 client/src/features/settings/__tests__/RequestAutomationPanel.spec.ts
 create mode 100644 client/src/features/settings/__tests__/RequestIndexersPanel.spec.ts
 create mode 100644 client/src/features/settings/__tests__/RequestsSettings.spec.ts
 create mode 100644 client/src/features/settings/__tests__/SearchHealth.spec.ts
 create mode 100644 client/src/features/settings/__tests__/SettingsEditorSheet.spec.ts
 create mode 100644 client/src/features/settings/__tests__/useSettingsDraft.spec.ts
 create mode 100644 client/src/features/settings/components/AdapterTypePicker.vue
 create mode 100644 client/src/features/settings/components/FieldHint.vue
 create mode 100644 client/src/features/settings/components/PluginDirectoryLink.vue
 create mode 100644 client/src/features/settings/components/PluginVersionBadge.vue
 create mode 100644 client/src/features/settings/components/ReleaseProfileEditor.vue
 create mode 100644 client/src/features/settings/components/RequestDestinationRow.vue
 create mode 100644 client/src/features/settings/components/RequestSourceRow.vue
 create mode 100644 client/src/features/settings/components/RequestSourcesEmpty.vue
 create mode 100644 client/src/features/settings/components/SettingsEditorSheet.vue
 create mode 100644 client/src/features/settings/components/SettingsEmptyPanel.vue
 create mode 100644 client/src/features/settings/components/SettingsField.vue
 create mode 100644 client/src/features/settings/components/SettingsRow.vue
 create mode 100644 client/src/features/settings/components/SettingsSection.vue
 create mode 100644 client/src/features/settings/components/SettingsSlider.vue
 create mode 100644 client/src/features/settings/components/SettingsToggleField.vue
 create mode 100644 client/src/features/settings/components/SourceColorPicker.vue
 create mode 100644 client/src/features/settings/composables/__tests__/useSettingsNavStatus.spec.ts
 create mode 100644 client/src/features/settings/composables/useIndexerDraft.ts
 create mode 100644 client/src/features/settings/composables/useIndexerPlugins.ts
 create mode 100644 client/src/features/settings/composables/useSettingsDraft.ts
 create mode 100644 client/src/features/settings/composables/useSettingsNavStatus.ts
 create mode 100644 client/src/features/settings/lib/editor-actions.ts
 delete mode 100644 docs/AUDIOBOOKSHELF_MIGRATION.md
 create mode 100644 docs/BOOK_REQUESTS.md
 delete mode 100644 docs/CALIBRE_WEB_AUTOMATED_MIGRATION.md
 create mode 100644 packages/plugin-api/package.json
 create mode 100644 packages/plugin-api/src/index.ts
 create mode 100644 packages/plugin-api/tsconfig.json
 create mode 100644 packages/types/src/book-request-automation.ts
 create mode 100644 packages/types/src/book-request-destination.ts
 create mode 100644 packages/types/src/book-request-preferences.ts
 create mode 100644 packages/types/src/book-request-profile.ts
 create mode 100644 packages/types/src/book-request-review.ts
 create mode 100644 packages/types/src/book-request.ts
 create mode 100644 packages/types/src/download-client.ts
 create mode 100644 packages/types/src/indexer.ts
 create mode 100644 packages/types/src/language.ts
 create mode 100644 packages/types/src/network-profile.ts
 create mode 100644 packages/types/src/request-credential.ts
 create mode 100644 server/src/common/archive/release-archive-sevenzip.test.ts
 create mode 100644 server/src/common/archive/release-archive.test.ts
 create mode 100644 server/src/common/archive/release-archive.ts
 create mode 100644 server/src/common/decorators/require-any-permission.decorator.ts
 create mode 100644 server/src/common/text-match/isbn-normalize.ts
 rename server/src/{modules/metadata-fetch => common/text-match}/title-match.test.ts (100%)
 rename server/src/{modules/metadata-fetch => common/text-match}/title-match.ts (75%)
 create mode 100644 server/src/common/utils/bounded-response.test.ts
 create mode 100644 server/src/common/utils/bounded-response.ts
 create mode 100644 server/src/common/utils/db-error.utils.test.ts
 create mode 100644 server/src/common/utils/db-error.utils.ts
 create mode 100644 server/src/common/utils/safe-fetch.test.ts
 create mode 100644 server/src/common/utils/safe-fetch.ts
 create mode 100644 server/src/common/utils/with-deadline.utils.test.ts
 create mode 100644 server/src/common/utils/with-deadline.utils.ts
 create mode 100644 server/src/common/utils/ws-cors.utils.test.ts
 create mode 100644 server/src/common/utils/ws-cors.utils.ts
 create mode 100644 server/src/db/migrations/0083_add_book_requests.sql
 create mode 100644 server/src/db/migrations/meta/0083_snapshot.json
 create mode 100644 server/src/db/schema/book-requests.schema.test.ts
 create mode 100644 server/src/db/schema/book-requests.ts
 create mode 100644 server/src/db/schema/download-clients.schema.test.ts
 create mode 100644 server/src/db/schema/download-clients.ts
 create mode 100644 server/src/db/schema/request-indexers.schema.test.ts
 create mode 100644 server/src/db/schema/request-indexers.ts
 create mode 100644 server/src/modules/book-dock/book-dock-unit-files.sql.test.ts
 create mode 100644 server/src/modules/book-request/book-request-admin.controller.ts
 create mode 100644 server/src/modules/book-request/book-request-attribution.service.test.ts
 create mode 100644 server/src/modules/book-request/book-request-attribution.service.ts
 create mode 100644 server/src/modules/book-request/book-request-automation.controller.ts
 create mode 100644 server/src/modules/book-request/book-request-dedupe.service.test.ts
 create mode 100644 server/src/modules/book-request/book-request-dedupe.service.ts
 create mode 100644 server/src/modules/book-request/book-request-events.service.ts
 create mode 100644 server/src/modules/book-request/book-request-notifier.service.test.ts
 create mode 100644 server/src/modules/book-request/book-request-notifier.service.ts
 create mode 100644 server/src/modules/book-request/book-request-self-fulfil.controller.ts
 create mode 100644 server/src/modules/book-request/book-request.controller.ts
 create mode 100644 server/src/modules/book-request/book-request.gateway.test.ts
 create mode 100644 server/src/modules/book-request/book-request.gateway.ts
 create mode 100644 server/src/modules/book-request/book-request.mapper.ts
 create mode 100644 server/src/modules/book-request/book-request.module.ts
 create mode 100644 server/src/modules/book-request/book-request.repository.test.ts
 create mode 100644 server/src/modules/book-request/book-request.repository.ts
 create mode 100644 server/src/modules/book-request/book-request.service.test.ts
 create mode 100644 server/src/modules/book-request/book-request.service.ts
 create mode 100644 server/src/modules/book-request/download-clients/adapters/client-http.utils.test.ts
 create mode 100644 server/src/modules/book-request/download-clients/adapters/client-http.utils.ts
 create mode 100644 server/src/modules/book-request/download-clients/adapters/deluge.adapter.test.ts
 create mode 100644 server/src/modules/book-request/download-clients/adapters/deluge.adapter.ts
 create mode 100644 server/src/modules/book-request/download-clients/adapters/qbittorrent.adapter.test.ts
 create mode 100644 server/src/modules/book-request/download-clients/adapters/qbittorrent.adapter.ts
 create mode 100644 server/src/modules/book-request/download-clients/adapters/transmission.adapter.test.ts
 create mode 100644 server/src/modules/book-request/download-clients/adapters/transmission.adapter.ts
 create mode 100644 server/src/modules/book-request/download-clients/download-client-adapter.ts
 create mode 100644 server/src/modules/book-request/download-clients/download-client-config.service.test.ts
 create mode 100644 server/src/modules/book-request/download-clients/download-client-config.service.ts
 create mode 100644 server/src/modules/book-request/download-clients/download-client-reconciliation.service.test.ts
 create mode 100644 server/src/modules/book-request/download-clients/download-client-reconciliation.service.ts
 create mode 100644 server/src/modules/book-request/download-clients/download-client-registry.ts
 create mode 100644 server/src/modules/book-request/download-clients/download-client.controller.ts
 create mode 100644 server/src/modules/book-request/download-clients/download-client.repository.test.ts
 create mode 100644 server/src/modules/book-request/download-clients/download-client.repository.ts
 create mode 100644 server/src/modules/book-request/download-clients/dto/download-client.dto.test.ts
 create mode 100644 server/src/modules/book-request/download-clients/dto/download-client.dto.ts
 create mode 100644 server/src/modules/book-request/download-clients/dto/reconcile-download-client.dto.ts
 create mode 100644 server/src/modules/book-request/download-clients/path-mapping.service.test.ts
 create mode 100644 server/src/modules/book-request/download-clients/path-mapping.service.ts
 create mode 100644 server/src/modules/book-request/dto/automation-settings.dto.ts
 create mode 100644 server/src/modules/book-request/dto/bulk-book-requests.dto.ts
 create mode 100644 server/src/modules/book-request/dto/check-availability.dto.ts
 create mode 100644 server/src/modules/book-request/dto/create-book-request.dto.test.ts
 create mode 100644 server/src/modules/book-request/dto/create-book-request.dto.ts
 create mode 100644 server/src/modules/book-request/dto/decide-book-request.dto.ts
 create mode 100644 server/src/modules/book-request/dto/fulfill-book-request.dto.ts
 create mode 100644 server/src/modules/book-request/dto/grab-book-request.dto.ts
 create mode 100644 server/src/modules/book-request/dto/inspect-book-request-release.dto.ts
 create mode 100644 server/src/modules/book-request/dto/list-book-requests.dto.test.ts
 create mode 100644 server/src/modules/book-request/dto/list-book-requests.dto.ts
 create mode 100644 server/src/modules/book-request/dto/list-requester-options.dto.ts
 create mode 100644 server/src/modules/book-request/dto/release-guid.dto.test.ts
 create mode 100644 server/src/modules/book-request/dto/remove-download.dto.ts
 create mode 100644 server/src/modules/book-request/dto/search-book-request-releases.dto.ts
 create mode 100644 server/src/modules/book-request/dto/select-release-unit.dto.ts
 create mode 100644 server/src/modules/book-request/dto/update-book-request-language.dto.ts
 create mode 100644 server/src/modules/book-request/fulfillment/book-request-download.repository.test.ts
 create mode 100644 server/src/modules/book-request/fulfillment/book-request-download.repository.ts
 create mode 100644 server/src/modules/book-request/fulfillment/direct-download.service.test.ts
 create mode 100644 server/src/modules/book-request/fulfillment/direct-download.service.ts
 create mode 100644 server/src/modules/book-request/fulfillment/download-monitor.service.test.ts
 create mode 100644 server/src/modules/book-request/fulfillment/download-monitor.service.ts
 create mode 100644 server/src/modules/book-request/fulfillment/download-removal.service.test.ts
 create mode 100644 server/src/modules/book-request/fulfillment/download-removal.service.ts
 create mode 100644 server/src/modules/book-request/fulfillment/request-automation-search-delay.service.test.ts
 create mode 100644 server/src/modules/book-request/fulfillment/request-automation-search-delay.service.ts
 create mode 100644 server/src/modules/book-request/fulfillment/request-automation-settings.service.test.ts
 create mode 100644 server/src/modules/book-request/fulfillment/request-automation-settings.service.ts
 create mode 100644 server/src/modules/book-request/fulfillment/request-automation.service.test.ts
 create mode 100644 server/src/modules/book-request/fulfillment/request-automation.service.ts
 create mode 100644 server/src/modules/book-request/fulfillment/request-fulfillment.service.test.ts
 create mode 100644 server/src/modules/book-request/fulfillment/request-fulfillment.service.ts
 create mode 100644 server/src/modules/book-request/fulfillment/request-import-queue.test.ts
 create mode 100644 server/src/modules/book-request/fulfillment/request-import-queue.ts
 create mode 100644 server/src/modules/book-request/fulfillment/request-import.service.test.ts
 create mode 100644 server/src/modules/book-request/fulfillment/request-import.service.ts
 create mode 100644 server/src/modules/book-request/fulfillment/request-seed.service.test.ts
 create mode 100644 server/src/modules/book-request/fulfillment/request-seed.service.ts
 create mode 100644 server/src/modules/book-request/fulfillment/request-user-cleanup.service.test.ts
 create mode 100644 server/src/modules/book-request/fulfillment/request-user-cleanup.service.ts
 create mode 100644 server/src/modules/book-request/fulfillment/request-verification.service.test.ts
 create mode 100644 server/src/modules/book-request/fulfillment/request-verification.service.ts
 create mode 100644 server/src/modules/book-request/fulfillment/request-watchdog.service.test.ts
 create mode 100644 server/src/modules/book-request/fulfillment/request-watchdog.service.ts
 create mode 100644 server/src/modules/book-request/fulfillment/torrent.utils.test.ts
 create mode 100644 server/src/modules/book-request/fulfillment/torrent.utils.ts
 create mode 100644 server/src/modules/book-request/indexers/adapters/torznab.adapter.test.ts
 create mode 100644 server/src/modules/book-request/indexers/adapters/torznab.adapter.ts
 create mode 100644 server/src/modules/book-request/indexers/dto/indexer.dto.ts
 create mode 100644 server/src/modules/book-request/indexers/indexer-adapter.ts
 create mode 100644 server/src/modules/book-request/indexers/indexer-config.service.test.ts
 create mode 100644 server/src/modules/book-request/indexers/indexer-config.service.ts
 create mode 100644 server/src/modules/book-request/indexers/indexer-credential-store.test.ts
 create mode 100644 server/src/modules/book-request/indexers/indexer-credential-store.ts
 create mode 100644 server/src/modules/book-request/indexers/indexer-keepalive.service.test.ts
 create mode 100644 server/src/modules/book-request/indexers/indexer-keepalive.service.ts
 create mode 100644 server/src/modules/book-request/indexers/indexer-operation-lock.ts
 create mode 100644 server/src/modules/book-request/indexers/indexer-registry.test.ts
 create mode 100644 server/src/modules/book-request/indexers/indexer-registry.ts
 create mode 100644 server/src/modules/book-request/indexers/indexer-search.service.test.ts
 create mode 100644 server/src/modules/book-request/indexers/indexer-search.service.ts
 create mode 100644 server/src/modules/book-request/indexers/indexer.controller.test.ts
 create mode 100644 server/src/modules/book-request/indexers/indexer.controller.ts
 create mode 100644 server/src/modules/book-request/indexers/indexer.repository.test.ts
 create mode 100644 server/src/modules/book-request/indexers/indexer.repository.ts
 create mode 100644 server/src/modules/book-request/indexers/plugins/plugin-host.test.ts
 create mode 100644 server/src/modules/book-request/indexers/plugins/plugin-host.ts
 create mode 100644 server/src/modules/book-request/indexers/plugins/plugin-install.service.test.ts
 create mode 100644 server/src/modules/book-request/indexers/plugins/plugin-install.service.ts
 create mode 100644 server/src/modules/book-request/indexers/plugins/plugin-loader.service.test.ts
 create mode 100644 server/src/modules/book-request/indexers/plugins/plugin-loader.service.ts
 create mode 100644 server/src/modules/book-request/indexers/plugins/plugin-shape.ts
 create mode 100644 server/src/modules/book-request/indexers/release-profile.test.ts
 create mode 100644 server/src/modules/book-request/indexers/release-scoring.test.ts
 create mode 100644 server/src/modules/book-request/indexers/release-scoring.ts
 create mode 100644 server/src/modules/book-request/indexers/search-text.test.ts
 create mode 100644 server/src/modules/book-request/indexers/search-text.ts
 create mode 100644 server/src/modules/book-request/request-credential.service.test.ts
 create mode 100644 server/src/modules/book-request/request-credential.service.ts
 create mode 100644 server/src/modules/metadata-fetch/providers/google/google-cover-validator.test.ts
 create mode 100644 server/src/modules/metadata-fetch/providers/google/google-cover-validator.ts
 create mode 100644 server/src/modules/scanner/lib/release-plan.test.ts
 create mode 100644 server/src/modules/scanner/lib/release-plan.ts
 create mode 100644 server/src/modules/user/user-events.service.ts
 create mode 100644 server/src/scripts/migration-ledger-compatibility.test.ts
 create mode 100644 server/src/scripts/migration-ledger-compatibility.ts
 create mode 100644 server/test/book-requests.e2e-spec.ts
 create mode 100644 server/test/e2e/authorization-matrix/route-inventory/uncovered-routes.json

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6308d5317..0af74de2c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -732,7 +732,7 @@ jobs:
           file: ./Dockerfile
           push: true
           tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.pr-meta.outputs.publish_tag }}
-          platforms: linux/amd64
+          platforms: linux/amd64,linux/arm64
           cache-from: type=gha,scope=ci-yml-pr-image
           cache-to: type=gha,mode=max,scope=ci-yml-pr-image
 
diff --git a/README.md b/README.md
index c84a3feaf..b823fed1a 100644
--- a/README.md
+++ b/README.md
@@ -115,6 +115,8 @@ The download is pre-configured with your server URL and credentials, so there is
 
 Full documentation is at **[bookorbit.app](https://bookorbit.app/what-is-bookorbit)**, covering libraries, metadata, readers, Kobo sync, OPDS, users and permissions, OIDC setup, and more.
 
+For setting up book requests, see the [book requests guide](docs/BOOK_REQUESTS.md): indexers,
+download clients, path mappings, automation, and the encryption key they all need.
 For a one-time import from Audiobookshelf, see the [Audiobookshelf migration guide](docs/AUDIOBOOKSHELF_MIGRATION.md).
 For a stopped-snapshot import from Calibre-Web Automated, see the
 [Calibre-Web Automated migration guide](docs/CALIBRE_WEB_AUTOMATED_MIGRATION.md).
diff --git a/client/src/assets/main.css b/client/src/assets/main.css
index 8df227e6b..e8538a074 100644
--- a/client/src/assets/main.css
+++ b/client/src/assets/main.css
@@ -404,12 +404,42 @@
     outline-offset: -1px;
   }
 
+  .settings-input {
+    @apply mt-1 h-9 w-full rounded-md border border-input bg-background px-3 text-sm text-foreground focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 focus-visible:outline-none disabled:opacity-50;
+  }
+  /* `.settings-input` with its own top margin dropped, for a field whose wrapper already owns the
+     spacing between label, control and hint. */
+  .settings-control {
+    @apply h-9 w-full rounded-md border border-input bg-background px-3 text-sm text-foreground focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 focus-visible:outline-none disabled:opacity-50;
+  }
+  .settings-control[aria-invalid='true'] {
+    @apply border-destructive focus-visible:border-destructive focus-visible:ring-destructive/40;
+  }
   .settings-card {
     @apply overflow-hidden rounded-lg border border-border bg-card divide-y divide-border shadow-xs;
   }
   .settings-row {
     @apply flex flex-col gap-3 bg-card px-4 py-3.5 md:flex-row md:items-center md:justify-between md:px-5 md:py-4;
   }
+  .settings-card-header {
+    @apply flex items-center justify-between gap-4 bg-card px-4 py-2.5 md:px-5;
+  }
+  .settings-card-title {
+    @apply text-xs font-semibold uppercase tracking-wider text-foreground;
+  }
+  .settings-state-pill {
+    @apply shrink-0 rounded-full bg-primary/15 px-2 py-0.5 text-xs font-medium text-primary;
+  }
+  /* Hints and summaries are 12px. Past roughly 62 characters a line that small stops being
+     scannable, and a settings card is read in glances rather than in paragraphs. */
+  .settings-prose {
+    @apply max-w-[62ch];
+  }
+  /* Settings that only exist while their parent switch is on. The rail says so at a glance,
+     which a `v-if` block alone never does. */
+  .settings-subgroup {
+    @apply divide-y divide-border border-l-2 border-primary/30 bg-card;
+  }
   .settings-loading-state {
     @apply flex items-center justify-center rounded-lg border border-border bg-card px-5 py-8 text-center text-sm text-muted-foreground shadow-xs;
   }
diff --git a/client/src/assets/theme/bridge.css b/client/src/assets/theme/bridge.css
index 43e3523f4..be1aa60b9 100644
--- a/client/src/assets/theme/bridge.css
+++ b/client/src/assets/theme/bridge.css
@@ -33,6 +33,7 @@
   --color-success-foreground: var(--success-foreground);
   --color-warning: var(--warning);
   --color-warning-foreground: var(--warning-foreground);
+  --color-info: var(--info);
   --color-star-highlight: var(--star-highlight);
   --color-volume-read: var(--volume-read);
   --color-volume-reading: var(--volume-reading);
@@ -43,6 +44,7 @@
   --color-ring: var(--ring);
   --color-sidebar: var(--sidebar);
   --color-sidebar-foreground: var(--sidebar-foreground);
+  --color-sidebar-count-foreground: var(--sidebar-count-foreground);
   --color-sidebar-primary: var(--sidebar-primary);
   --color-sidebar-primary-foreground: var(--sidebar-primary-foreground);
   --color-sidebar-accent: var(--sidebar-accent);
diff --git a/client/src/assets/theme/tokens.css b/client/src/assets/theme/tokens.css
index de7b3ea47..d8ded0820 100644
--- a/client/src/assets/theme/tokens.css
+++ b/client/src/assets/theme/tokens.css
@@ -48,6 +48,9 @@
   --warning: oklch(0.52 0.13 68);
   --warning-foreground: oklch(0.985 0 0);
 
+  /* In flight: neither finished nor broken. Tuned per theme for the same reason. */
+  --info: oklch(0.55 0.12 255);
+
   --star-highlight: oklch(0.76 0.18 90);
 
   /* Series volume track. Kept apart from --success / --warning / --destructive because those are
@@ -74,6 +77,9 @@
 
   --sidebar: oklch(0.965 var(--tint-c-surface) var(--tint-h));
   --sidebar-foreground: oklch(0.145 var(--tint-c-surface) var(--tint-h));
+  /* Count chips sit one step above --muted-foreground: they are secondary, but they carry a
+     number the eye scans, so they are tuned per theme rather than faded from the row label. */
+  --sidebar-count-foreground: oklch(0.42 0.001 var(--tint-h));
   --sidebar-primary: oklch(0.21 var(--tint-c-surface) var(--tint-h));
   --sidebar-primary-foreground: oklch(0.985 0.004 var(--tint-h));
   --sidebar-accent: oklch(0.955 var(--tint-c-surface) var(--tint-h));
@@ -156,6 +162,52 @@
   --pattern-modifier: oklch(0.47 0.17 305);
   --pattern-optional: oklch(0.46 0.1 195);
   --pattern-fallback: oklch(0.48 0.13 68);
+  /* Release chips. Protocol is a fact about the release and keeps two fixed hues; the source hues
+     below are the operator's to assign. */
+  --pill-torrent: oklch(0.52 0.2 295);
+  --pill-direct: oklch(0.5 0.11 195);
+
+  --pill-source-blue: oklch(0.55 0.16 245);
+  --pill-source-indigo: oklch(0.55 0.18 275);
+  --pill-source-purple: oklch(0.55 0.19 330);
+  --pill-source-pink: oklch(0.55 0.17 355);
+  --pill-source-red: oklch(0.55 0.17 25);
+  --pill-source-orange: oklch(0.58 0.15 60);
+  --pill-source-yellow: oklch(0.6 0.13 95);
+  --pill-source-lime: oklch(0.56 0.15 135);
+  --pill-source-green: oklch(0.55 0.14 160);
+  --pill-source-teal: oklch(0.53 0.11 180);
+
+  /* Medium, read as an icon alone in the request list. Three hues far enough apart to separate at
+     16px, and the icon shape still carries the meaning where colour does not land. */
+  --pill-media-ebook: oklch(0.55 0.16 245);
+  --pill-media-audiobook: oklch(0.55 0.2 300);
+  --pill-media-comic: oklch(0.55 0.18 25);
+
+  /* File format, worn as a chip whose own text carries the colour. Tuned per theme for the same
+     reason every other text colour is: the raw palette these replaced was one set of hex values
+     for both themes, and the brightest of them (yellow on white, around 1.9:1) was unreadable in
+     light mode while the darkest disappeared in dark. Lightness matches the source pills above. */
+  --pill-format-default: oklch(0.55 0.02 260);
+  --pill-format-epub: oklch(0.55 0.14 150);
+  --pill-format-kepub: oklch(0.55 0.12 178);
+  --pill-format-mobi: oklch(0.55 0.18 275);
+  --pill-format-azw3: oklch(0.53 0.11 185);
+  --pill-format-azw: oklch(0.55 0.14 235);
+  --pill-format-fb2: oklch(0.55 0.17 355);
+  --pill-format-djvu: oklch(0.55 0.04 255);
+  --pill-format-txt: oklch(0.55 0.03 60);
+  --pill-format-pdf: oklch(0.55 0.17 25);
+  --pill-format-cbz: oklch(0.55 0.16 260);
+  --pill-format-cbr: oklch(0.58 0.15 55);
+  --pill-format-cb7: oklch(0.55 0.19 300);
+  --pill-format-cbx: oklch(0.55 0.17 325);
+  --pill-format-m4b: oklch(0.58 0.13 75);
+  --pill-format-m4a: oklch(0.58 0.13 95);
+  --pill-format-mp3: oklch(0.56 0.15 145);
+  --pill-format-opus: oklch(0.55 0.11 205);
+  --pill-format-ogg: oklch(0.56 0.15 130);
+  --pill-format-flac: oklch(0.55 0.13 165);
 
   /* Rename diff. A bulk rename is a small edit inside a long path, so the ink that marks
      removed and added characters carries the whole feature. Tuned per theme like every other
@@ -251,6 +303,8 @@
   --warning: oklch(0.8 0.13 75);
   --warning-foreground: oklch(0.145 0 0);
 
+  --info: oklch(0.72 0.12 255);
+
   --star-highlight: oklch(0.84 0.17 95);
 
   --volume-read: oklch(0.7 0.16 148);
@@ -271,6 +325,7 @@
 
   --sidebar: oklch(calc(0.18 + var(--bg-lift)) var(--tint-c-surface) var(--tint-h));
   --sidebar-foreground: oklch(0.985 0.001 var(--tint-h));
+  --sidebar-count-foreground: oklch(0.8 0.001 var(--tint-h));
   --sidebar-primary: oklch(0.91 var(--tint-c-surface) var(--tint-h));
   --sidebar-primary-foreground: oklch(0.18 var(--tint-c-surface) var(--tint-h));
   --sidebar-accent: oklch(calc(0.245 + var(--bg-lift)) var(--tint-c-surface) var(--tint-h));
@@ -326,6 +381,44 @@
   --pattern-modifier: oklch(0.8 0.11 305);
   --pattern-optional: oklch(0.82 0.09 195);
   --pattern-fallback: oklch(0.82 0.12 75);
+  --pill-torrent: oklch(0.74 0.17 295);
+  --pill-direct: oklch(0.78 0.11 195);
+
+  --pill-source-blue: oklch(0.72 0.14 245);
+  --pill-source-indigo: oklch(0.72 0.16 275);
+  --pill-source-purple: oklch(0.72 0.17 330);
+  --pill-source-pink: oklch(0.73 0.15 355);
+  --pill-source-red: oklch(0.72 0.15 25);
+  --pill-source-orange: oklch(0.76 0.13 60);
+  --pill-source-yellow: oklch(0.8 0.13 95);
+  --pill-source-lime: oklch(0.78 0.15 135);
+  --pill-source-green: oklch(0.75 0.13 160);
+  --pill-source-teal: oklch(0.76 0.11 180);
+
+  --pill-media-ebook: oklch(0.72 0.14 245);
+  --pill-media-audiobook: oklch(0.72 0.17 300);
+  --pill-media-comic: oklch(0.72 0.16 25);
+
+  --pill-format-default: oklch(0.75 0.02 260);
+  --pill-format-epub: oklch(0.75 0.13 150);
+  --pill-format-kepub: oklch(0.75 0.11 178);
+  --pill-format-mobi: oklch(0.72 0.16 275);
+  --pill-format-azw3: oklch(0.76 0.11 185);
+  --pill-format-azw: oklch(0.72 0.13 235);
+  --pill-format-fb2: oklch(0.73 0.15 355);
+  --pill-format-djvu: oklch(0.75 0.04 255);
+  --pill-format-txt: oklch(0.76 0.03 60);
+  --pill-format-pdf: oklch(0.72 0.15 25);
+  --pill-format-cbz: oklch(0.72 0.14 260);
+  --pill-format-cbr: oklch(0.76 0.13 55);
+  --pill-format-cb7: oklch(0.72 0.17 300);
+  --pill-format-cbx: oklch(0.73 0.15 325);
+  --pill-format-m4b: oklch(0.79 0.13 75);
+  --pill-format-m4a: oklch(0.8 0.13 95);
+  --pill-format-mp3: oklch(0.78 0.15 145);
+  --pill-format-opus: oklch(0.76 0.11 205);
+  --pill-format-ogg: oklch(0.78 0.15 130);
+  --pill-format-flac: oklch(0.75 0.13 165);
 
   --diff-del: oklch(0.79 0.16 25);
   --diff-del-bg: oklch(0.79 0.16 25 / 0.16);
diff --git a/client/src/components/AppLayout.vue b/client/src/components/AppLayout.vue
index 48924207d..1ecc49ca2 100644
--- a/client/src/components/AppLayout.vue
+++ b/client/src/components/AppLayout.vue
@@ -14,6 +14,13 @@ const backgroundClass = computed(() => BACKGROUND_OPTIONS.find((b) => b.id === t
 
 const BOOK_ROUTE_NAMES = new Set(['book-detail'])
 
+/**
+ * The request drawer is a child route of the list, so the list has to stay mounted while the URL
+ * moves under it. Keying on the path would remount it, re-fetch the rows and run the page
+ * transition every time a drawer opened.
+ */
+const REQUEST_ROUTE_NAMES = new Set(['book-requests', 'book-request-detail', 'book-request-releases'])
+
 // Grid views are kept alive so scroll position and virtual list state survive
 // round-trips to the book detail / metadata editor page.
 const GRID_VIEW_NAMES = [
@@ -32,6 +39,7 @@ const GRID_VIEW_NAMES = [
 const viewKey = computed(() => {
   const name = String(route.name)
   if (BOOK_ROUTE_NAMES.has(name)) return name
+  if (REQUEST_ROUTE_NAMES.has(name)) return 'requests'
   if (name.startsWith('settings-')) return 'settings'
   if (name.startsWith('tools-')) return 'tools'
   return route.path
diff --git a/client/src/components/AppSidebar.vue b/client/src/components/AppSidebar.vue
index 0be5f8376..75a832b94 100644
--- a/client/src/components/AppSidebar.vue
+++ b/client/src/components/AppSidebar.vue
@@ -1,8 +1,9 @@
 <script setup lang="ts">
-import { computed, onMounted, onUnmounted, ref } from 'vue'
+import { computed, onMounted, onUnmounted, ref, watch } from 'vue'
 import { useI18n } from 'vue-i18n'
 import { useRoute } from 'vue-router'
 import { Aperture, BookCopy, CircleArrowUp, FolderOpen, Heart, Orbit } from '@lucide/vue'
+import { Permission, type Library } from '@bookorbit/types'
 import { formatCompactNumber, formatNumber } from '@/i18n/formatters'
 import { Sidebar, SidebarContent, SidebarFooter, SidebarHeader, SidebarRail, SidebarSeparator, useSidebar } from '@/components/ui/sidebar'
 import SidebarZone from '@/components/sidebar/SidebarZone.vue'
@@ -24,7 +25,6 @@ import { usePermissions } from '@/features/auth/composables/usePermissions'
 import { useScanProgress, getSocket } from '@/features/scanner/composables/useScanProgress'
 import { useLibraryUploadEvents } from '@/features/library/composables/useLibraryUploadEvents'
 import { useBookDockSummary } from '@/features/book-dock/composables/useBookDockSummary'
-import type { Library } from '@bookorbit/types'
 import CreateSmartScopeDialog from '@/features/smart-scope/components/CreateSmartScopeDialog.vue'
 import CreateCollectionDialog from '@/features/collection/components/CreateCollectionDialog.vue'
 import LibraryCreatorModal from '@/features/library/components/LibraryCreatorModal.vue'
@@ -32,11 +32,12 @@ import { useLibraryCreationRedirect } from '@/features/library/composables/useLi
 import { useAppInfo } from '@/features/settings/composables/useAppInfo'
 import SettingsSidebar from '@/features/settings/components/SettingsSidebar.vue'
 import { useWhatsNew } from '@/features/whats-new/composables/useWhatsNew'
+import { useBookRequestSummary } from '@/features/book-requests/composables/useBookRequestSummary'
+import { useBookRequestProgress } from '@/features/book-requests/composables/useBookRequestProgress'
 
 const { t } = useI18n()
 const route = useRoute()
 const { state, isMobile, setOpenMobile } = useSidebar()
-const { zones } = useSidebarNav()
 const { libraries, fetchLibraries, refreshLibraries, reorderLibraries } = useLibraries()
 const { smartScopes, fetchSmartScopes, reorderSmartScopes } = useSmartScopes()
 const { collections, fetchCollections, reorderCollections } = useCollections()
@@ -47,6 +48,12 @@ const { version, updateAvailable, latestVersion, loadAppInfo } = useAppInfo()
 const { hasUnseen: hasUnseenWhatsNew } = useWhatsNew()
 const { fetchSummary: fetchBookDockSummary, subscribe: subscribeBookDockSummary } = useBookDockSummary()
 const { fetchCounts: fetchBrowseCounts, refreshCounts: refreshBrowseCounts } = useBrowseCounts()
+const { summary: bookRequestSummary, fetchSummary: fetchBookRequestSummary, refreshSummary: refreshBookRequestSummary } = useBookRequestSummary()
+const outstandingRequestTotal = computed(() =>
+  hasPermission(Permission.ManageBookRequests) ? (bookRequestSummary.value?.active ?? 0) : (bookRequestSummary.value?.mine ?? 0),
+)
+const { zones } = useSidebarNav(() => outstandingRequestTotal.value)
+const requestProgress = hasPermission(Permission.BookRequestAccess) ? useBookRequestProgress() : null
 useLibraryScanRefresh()
 
 const SUPPORT_URL = 'https://ko-fi.com/neonbookorbit'
@@ -152,6 +159,7 @@ onMounted(async () => {
   void fetchSmartScopes()
   void fetchCollections()
   void fetchBrowseCounts()
+  if (hasPermission(Permission.BookRequestAccess)) void fetchBookRequestSummary()
   void loadAppInfo()
   if (hasPermission('book_dock_access')) {
     void fetchBookDockSummary()
@@ -159,6 +167,16 @@ onMounted(async () => {
   }
 })
 
+requestProgress?.onRequestsChanged(() => {
+  void refreshBookRequestSummary()
+})
+
+if (requestProgress) {
+  watch(requestProgress.connected, (connected) => {
+    if (connected) void refreshBookRequestSummary()
+  })
+}
+
 const { onLibraryUploadCompleted } = useLibraryUploadEvents()
 const stopLibraryUploadListener = onLibraryUploadCompleted((event) => {
   if (event.uploadedCount === 0) return
@@ -213,7 +231,7 @@ onUnmounted(() => stopLibraryUploadListener())
             v-for="entry in zone.entries"
             :key="entry.id"
             :is-active="entry.isActive"
-            :tooltip="entry.label"
+            :tooltip="entry.badge?.label ?? entry.label"
             :to="entry.to"
             :icon="entry.icon"
             :label="entry.label"
@@ -221,7 +239,9 @@ onUnmounted(() => stopLibraryUploadListener())
             @navigate="handleNavigate"
           >
             <template #badge>
-              <SidebarBadge v-if="entry.badge !== null">{{ formatCompactNumber(entry.badge) }}</SidebarBadge>
+              <SidebarBadge v-if="entry.badge !== null" :tone="entry.badge.tone" :label="entry.badge.label">{{
+                formatCompactNumber(entry.badge.value)
+              }}</SidebarBadge>
             </template>
           </SidebarNavItem>
         </SidebarZone>
diff --git a/client/src/components/sidebar/SidebarBadge.vue b/client/src/components/sidebar/SidebarBadge.vue
index 20ace49f7..04602268f 100644
--- a/client/src/components/sidebar/SidebarBadge.vue
+++ b/client/src/components/sidebar/SidebarBadge.vue
@@ -1,11 +1,21 @@
 <script setup lang="ts">
-withDefaults(
+import { computed } from 'vue'
+
+const props = withDefaults(
   defineProps<{
     variant?: 'count' | 'progress' | 'dot'
+    /** `accent` marks a count that stands for outstanding work, not just a total. */
+    tone?: 'default' | 'accent'
     label?: string
   }>(),
-  { variant: 'count' },
+  { variant: 'count', tone: 'default', label: undefined },
 )
+
+const inkClass = computed(() => {
+  if (props.tone === 'accent') return 'font-bold text-primary'
+  if (props.variant === 'progress') return 'font-semibold text-primary'
+  return 'font-semibold text-sidebar-count-foreground group-data-[active=true]/item:text-primary'
+})
 </script>
 
 <template>
@@ -18,8 +28,10 @@ withDefaults(
   />
   <span
     v-else
-    class="ml-auto shrink-0 rounded-md bg-(--shell-accent-tint) px-1.5 py-0.5 text-[11px] font-semibold tabular-nums transition-colors duration-150 group-data-[collapsible=icon]:hidden"
-    :class="variant === 'progress' ? 'text-primary' : 'text-muted-foreground group-data-[active=true]/item:text-primary'"
+    class="ml-auto shrink-0 rounded-md bg-(--shell-accent-tint) px-1.5 py-0.5 text-[11px] tabular-nums transition-colors duration-150 group-data-[collapsible=icon]:hidden"
+    :class="inkClass"
+    :aria-label="label"
+    :title="label"
   >
     <slot />
   </span>
diff --git a/client/src/components/sidebar/SidebarSectionHeader.vue b/client/src/components/sidebar/SidebarSectionHeader.vue
index 6dbcadc2b..e1b2eebf4 100644
--- a/client/src/components/sidebar/SidebarSectionHeader.vue
+++ b/client/src/components/sidebar/SidebarSectionHeader.vue
@@ -74,7 +74,10 @@ const showCount = computed(() => !props.isOpen && typeof props.count === 'number
       @click="handleToggle"
     >
       <span class="min-w-0 truncate text-[11px] font-medium uppercase tracking-[0.14em] text-muted-foreground">{{ label }}</span>
-      <span v-if="showCount" class="shrink-0 rounded-md bg-(--shell-accent-tint) px-1.5 text-[11px] font-semibold tabular-nums text-muted-foreground">
+      <span
+        v-if="showCount"
+        class="shrink-0 rounded-md bg-(--shell-accent-tint) px-1.5 text-[11px] font-semibold tabular-nums text-sidebar-count-foreground"
+      >
         {{ formatCompactNumber(count ?? 0) }}
       </span>
       <ChevronDown
diff --git a/client/src/components/sidebar/SidebarSectionPopover.vue b/client/src/components/sidebar/SidebarSectionPopover.vue
index c52c15527..bb3488137 100644
--- a/client/src/components/sidebar/SidebarSectionPopover.vue
+++ b/client/src/components/sidebar/SidebarSectionPopover.vue
@@ -21,7 +21,7 @@ defineProps<{
       <span
         v-if="count > 0"
         aria-hidden="true"
-        class="absolute -bottom-0.5 -right-0.5 rounded-md bg-(--shell-accent-tint) px-1 text-[11px] font-semibold leading-tight tabular-nums text-muted-foreground"
+        class="absolute -bottom-0.5 -right-0.5 rounded-md bg-(--shell-accent-tint) px-1 text-[11px] font-semibold leading-tight tabular-nums text-sidebar-count-foreground"
       >
         {{ formatCompactNumber(count) }}
       </span>
diff --git a/client/src/components/sidebar/__tests__/SidebarBadge.spec.ts b/client/src/components/sidebar/__tests__/SidebarBadge.spec.ts
index e9c286e88..3d4609508 100644
--- a/client/src/components/sidebar/__tests__/SidebarBadge.spec.ts
+++ b/client/src/components/sidebar/__tests__/SidebarBadge.spec.ts
@@ -11,4 +11,16 @@ describe('SidebarBadge', () => {
 
     expect(wrapper.get('span').classes()).toContain('group-data-[collapsible=icon]:hidden')
   })
+
+  it('exposes the meaning of a count as an accessible label and hover title', () => {
+    const wrapper = mount(SidebarBadge, {
+      props: { label: '2 active requests across all users' },
+      slots: { default: '2' },
+    })
+
+    expect(wrapper.get('span').attributes()).toMatchObject({
+      'aria-label': '2 active requests across all users',
+      title: '2 active requests across all users',
+    })
+  })
 })
diff --git a/client/src/components/ui/ChipInput.vue b/client/src/components/ui/ChipInput.vue
index d3d23da97..5690ac8f2 100644
--- a/client/src/components/ui/ChipInput.vue
+++ b/client/src/components/ui/ChipInput.vue
@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { onUnmounted, ref } from 'vue'
+import { computed, onUnmounted, ref } from 'vue'
 import { useI18n } from 'vue-i18n'
 import { X } from '@lucide/vue'
 
@@ -8,9 +8,17 @@ const { t } = useI18n()
 const props = defineProps<{
   modelValue: string[]
   placeholder?: string
-  searchFn: (q: string) => Promise<string[]>
+  /** Omit for a free-text list: chips are whatever is typed, with no suggestion dropdown. */
+  searchFn?: (q: string) => Promise<string[]>
+  /** Returns null to reject an entry, so a list with a format can enforce it as it is typed. */
+  normalize?: (raw: string) => string | null
   disabled?: boolean
   controlClass?: string
+  inputId?: string
+  inputMode?: 'numeric' | 'text'
+  describedBy?: string
+  invalid?: boolean
+  removeLabel?: string
 }>()
 
 const emit = defineEmits<{ 'update:modelValue': [string[]] }>()
@@ -20,27 +28,67 @@ const results = ref<string[]>([])
 const showDropdown = ref(false)
 let debounceTimer: ReturnType<typeof setTimeout>
 
+const inputPlaceholder = computed(() => {
+  if (props.modelValue.length === 0) return props.placeholder ?? t('components.ui.chipInput.typeAndEnter')
+  return props.placeholder === undefined ? t('components.ui.chipInput.pressEnter') : ''
+})
+
+/** Operators paste whole comma-separated lists, which is how these values are written down. */
+const SEPARATORS = /[,\n\t;]/
+
 async function onInput() {
   if (props.disabled) return
   clearTimeout(debounceTimer)
-  if (!query.value.trim()) {
+
+  if (SEPARATORS.test(query.value)) {
+    commitSeparated()
+    return
+  }
+
+  if (!props.searchFn || !query.value.trim()) {
     results.value = []
     showDropdown.value = false
     return
   }
+  const searchFn = props.searchFn
   debounceTimer = setTimeout(async () => {
-    const res = await props.searchFn(query.value)
+    const res = await searchFn(query.value)
     results.value = res.filter((r) => !props.modelValue.includes(r))
     showDropdown.value = results.value.length > 0
   }, 200)
 }
 
+/**
+ * Everything before the final separator is complete; whatever follows it is still being typed and
+ * stays in the box, so pasting a list and continuing to type both behave.
+ */
+function commitSeparated() {
+  const parts = query.value.split(SEPARATORS)
+  const trailing = parts.pop() ?? ''
+  const next = [...props.modelValue]
+  for (const part of parts) {
+    const value = accept(part, next)
+    if (value !== null) next.push(value)
+  }
+  if (next.length !== props.modelValue.length) emit('update:modelValue', next)
+  query.value = trailing
+  results.value = []
+  showDropdown.value = false
+}
+
+/** Null for anything the field will not take: blank, a duplicate, or rejected by `normalize`. */
+function accept(raw: string, existing: readonly string[]): string | null {
+  const trimmed = raw.trim()
+  if (!trimmed) return null
+  const value = props.normalize ? props.normalize(trimmed) : trimmed
+  if (value === null || value === '' || existing.includes(value)) return null
+  return value
+}
+
 function addItem(item: string) {
   if (props.disabled) return
-  const trimmed = item.trim()
-  if (trimmed && !props.modelValue.includes(trimmed)) {
-    emit('update:modelValue', [...props.modelValue, trimmed])
-  }
+  const value = accept(item, props.modelValue)
+  if (value !== null) emit('update:modelValue', [...props.modelValue, value])
   query.value = ''
   results.value = []
   showDropdown.value = false
@@ -56,6 +104,11 @@ function onKeydown(e: KeyboardEvent) {
   }
 }
 
+/** A half-typed entry is meant, so committing it on the way out beats silently discarding it. */
+function commitPending() {
+  if (query.value.trim()) addItem(query.value)
+}
+
 function removeItem(item: string) {
   if (props.disabled) return
   emit(
@@ -70,14 +123,16 @@ function onBlur() {
   }, 150)
 }
 
+defineExpose({ commitPending })
+
 onUnmounted(() => clearTimeout(debounceTimer))
 </script>
 
 <template>
   <div class="relative">
     <div
-      class="min-h-10 flex flex-wrap gap-1.5 rounded-md border border-input bg-background px-3 py-2 text-sm focus-within:ring-1 focus-within:ring-ring transition-shadow"
-      :class="[props.disabled ? 'cursor-not-allowed opacity-60' : '', props.controlClass]"
+      class="min-h-10 flex flex-wrap gap-1.5 rounded-md border bg-background px-3 py-2 text-sm focus-within:ring-1 focus-within:ring-ring transition-shadow"
+      :class="[props.disabled ? 'cursor-not-allowed opacity-60' : '', props.invalid ? 'border-destructive' : 'border-input', props.controlClass]"
     >
       <span v-for="item in modelValue" :key="item" class="flex items-center gap-1 bg-muted px-2 py-0.5 rounded-full text-xs">
         {{ item }}
@@ -87,15 +142,20 @@ onUnmounted(() => clearTimeout(debounceTimer))
           :disabled="props.disabled"
           @click="removeItem(item)"
         >
-          <X class="size-3" />
+          <X class="size-3" aria-hidden="true" />
+          <span class="sr-only">{{ removeLabel ?? t('components.ui.chipInput.remove', { value: item }) }}</span>
         </button>
       </span>
       <input
+        :id="inputId"
         v-model="query"
         enterkeyhint="enter"
         class="flex-1 min-w-24 bg-transparent outline-none placeholder:text-muted-foreground disabled:cursor-not-allowed"
-        :placeholder="placeholder ?? (modelValue.length === 0 ? t('components.ui.chipInput.typeAndEnter') : t('components.ui.chipInput.pressEnter'))"
+        :placeholder="inputPlaceholder"
         :disabled="props.disabled"
+        :inputmode="inputMode"
+        :aria-describedby="describedBy"
+        :aria-invalid="invalid || undefined"
         @input="onInput"
         @keydown="onKeydown"
         @blur="onBlur"
diff --git a/client/src/components/ui/TokenSelect.vue b/client/src/components/ui/TokenSelect.vue
new file mode 100644
index 000000000..c569bc6b4
--- /dev/null
+++ b/client/src/components/ui/TokenSelect.vue
@@ -0,0 +1,206 @@
+<script setup lang="ts">
+import { computed, ref } from 'vue'
+import { useI18n } from 'vue-i18n'
+import { ChevronsUpDown, X } from '@lucide/vue'
+
+/**
+ * A closed-set multi-select: type to narrow a long list, add several, see what is chosen, drop one
+ * by name.
+ *
+ * It replaces a native `<select multiple>`, which asked an operator to know that cmd-click toggles
+ * and a plain click discards everything else, and showed four rows of a list ninety entries long.
+ * A bound array could not drive one either: Vue stringifies `:value`, so two selections resolved to
+ * "en,de", no option carried that, and the browser silently cleared the whole box.
+ */
+const props = defineProps<{
+  options: readonly { value: string; label: string }[]
+  modelValue: readonly string[]
+  /** Ties the field to the caller's visible label, and namespaces the listbox and option ids. */
+  inputId: string
+  /** Shown while nothing is chosen, which is where "any" is worth saying out loud. */
+  placeholder?: string
+  disabled?: boolean
+  describedBy?: string
+}>()
+
+const emit = defineEmits<{ 'update:modelValue': [string[]] }>()
+
+const { t } = useI18n()
+
+const inputRef = ref<HTMLInputElement | null>(null)
+const query = ref('')
+const open = ref(false)
+const activeIndex = ref(-1)
+
+const listboxId = computed(() => `${props.inputId}-listbox`)
+const activeOptionId = computed(() => (activeIndex.value >= 0 ? `${props.inputId}-option-${activeIndex.value}` : undefined))
+
+/** Ordered by the option list rather than by when each was picked, so the chips stay alphabetical. */
+const chips = computed(() => props.options.filter((option) => props.modelValue.includes(option.value)))
+
+/** A code matches as well as a name, so someone who thinks in "de" is not made to spell German. */
+const matches = computed(() => {
+  const needle = query.value.trim().toLowerCase()
+  return props.options.filter((option) => {
+    if (props.modelValue.includes(option.value)) return false
+    if (!needle) return true
+    return option.label.toLowerCase().includes(needle) || option.value.toLowerCase().includes(needle)
+  })
+})
+
+function openList() {
+  if (props.disabled) return
+  open.value = true
+  activeIndex.value = -1
+}
+
+function toggleList() {
+  if (props.disabled) return
+  if (open.value) {
+    open.value = false
+    return
+  }
+  open.value = true
+  activeIndex.value = -1
+  inputRef.value?.focus()
+}
+
+function onInput(event: Event) {
+  query.value = (event.target as HTMLInputElement).value
+  open.value = true
+  activeIndex.value = -1
+}
+
+function add(value: string) {
+  if (props.disabled || props.modelValue.includes(value)) return
+  emit('update:modelValue', [...props.modelValue, value])
+  query.value = ''
+  activeIndex.value = -1
+  inputRef.value?.focus()
+}
+
+function remove(value: string) {
+  if (props.disabled) return
+  emit(
+    'update:modelValue',
+    props.modelValue.filter((entry) => entry !== value),
+  )
+}
+
+function onKeydown(event: KeyboardEvent) {
+  if (props.disabled) return
+
+  if (event.key === 'ArrowDown') {
+    event.preventDefault()
+    open.value = true
+    activeIndex.value = Math.min(activeIndex.value + 1, matches.value.length - 1)
+    return
+  }
+  if (event.key === 'ArrowUp') {
+    event.preventDefault()
+    activeIndex.value = Math.max(activeIndex.value - 1, -1)
+    return
+  }
+  if (event.key === 'Enter') {
+    // A query narrowed to one is unambiguous, so Enter takes it without an arrow key first.
+    const option = activeIndex.value >= 0 ? matches.value[activeIndex.value] : matches.value.length === 1 ? matches.value[0] : undefined
+    if (!option) return
+    event.preventDefault()
+    add(option.value)
+    return
+  }
+  if (event.key === 'Escape') {
+    open.value = false
+    query.value = ''
+    return
+  }
+  if (event.key === 'Backspace' && query.value === '' && chips.value.length > 0) {
+    const last = chips.value[chips.value.length - 1]
+    if (last) remove(last.value)
+  }
+}
+
+function onBlur() {
+  setTimeout(() => {
+    open.value = false
+    query.value = ''
+  }, 150)
+}
+</script>
+
+<template>
+  <div class="relative">
+    <div
+      class="flex min-h-8 flex-wrap items-center gap-1 rounded-md border border-input bg-background px-1.5 py-1 transition-shadow focus-within:ring-2 focus-within:ring-ring"
+      :class="disabled ? 'cursor-not-allowed opacity-50' : ''"
+    >
+      <span v-for="chip in chips" :key="chip.value" class="flex items-center gap-1 rounded-full bg-muted px-2 py-0.5 text-xs text-foreground">
+        {{ chip.label }}
+        <button
+          type="button"
+          class="text-muted-foreground transition-colors hover:text-foreground focus-visible:ring-2 focus-visible:ring-ring focus-visible:outline-none disabled:pointer-events-none motion-reduce:transition-none"
+          :disabled="disabled"
+          @click="remove(chip.value)"
+        >
+          <X :size="11" aria-hidden="true" />
+          <span class="sr-only">{{ t('components.ui.tokenSelect.remove', { value: chip.label }) }}</span>
+        </button>
+      </span>
+
+      <input
+        :id="inputId"
+        ref="inputRef"
+        :value="query"
+        type="text"
+        role="combobox"
+        autocomplete="off"
+        aria-autocomplete="list"
+        :aria-expanded="open"
+        :aria-controls="listboxId"
+        :aria-activedescendant="activeOptionId"
+        :aria-describedby="describedBy"
+        :disabled="disabled"
+        :placeholder="chips.length === 0 ? placeholder : ''"
+        class="min-w-20 flex-1 bg-transparent px-1 py-0.5 text-xs text-foreground outline-none placeholder:text-muted-foreground disabled:cursor-not-allowed"
+        @focus="openList"
+        @input="onInput"
+        @keydown="onKeydown"
+        @blur="onBlur"
+      />
+
+      <button
+        type="button"
+        class="shrink-0 rounded p-0.5 text-muted-foreground transition-colors hover:text-foreground focus-visible:ring-2 focus-visible:ring-ring focus-visible:outline-none disabled:pointer-events-none motion-reduce:transition-none"
+        :disabled="disabled"
+        :aria-label="t('components.ui.tokenSelect.showOptions')"
+        @mousedown.prevent="toggleList"
+      >
+        <ChevronsUpDown :size="12" aria-hidden="true" />
+      </button>
+    </div>
+
+    <ul
+      v-show="open"
+      :id="listboxId"
+      role="listbox"
+      :aria-multiselectable="true"
+      class="absolute z-50 mt-1 max-h-56 w-full min-w-44 overflow-y-auto rounded-md border border-border bg-popover py-1 shadow-md"
+    >
+      <li v-if="matches.length === 0" class="px-2.5 py-1.5 text-xs text-muted-foreground">
+        {{ t('components.ui.tokenSelect.noMatches') }}
+      </li>
+      <li
+        v-for="(option, index) in matches"
+        :id="`${inputId}-option-${index}`"
+        :key="option.value"
+        role="option"
+        :aria-selected="false"
+        class="cursor-pointer px-2.5 py-1.5 text-xs text-foreground"
+        :class="index === activeIndex ? 'bg-accent' : 'hover:bg-accent'"
+        @mousedown.prevent="add(option.value)"
+      >
+        {{ option.label }}
+      </li>
+    </ul>
+  </div>
+</template>
diff --git a/client/src/components/ui/__tests__/ChipInput.spec.ts b/client/src/components/ui/__tests__/ChipInput.spec.ts
new file mode 100644
index 000000000..103b226a9
--- /dev/null
+++ b/client/src/components/ui/__tests__/ChipInput.spec.ts
@@ -0,0 +1,84 @@
+import { mount } from '@vue/test-utils'
+import { describe, expect, it, vi } from 'vitest'
+import ChipInput from '../ChipInput.vue'
+
+function mountInput(props: Partial<InstanceType<typeof ChipInput>['$props']> = {}) {
+  return mount(ChipInput, { props: { modelValue: [], ...props } })
+}
+
+function typeInto(wrapper: ReturnType<typeof mountInput>, value: string) {
+  const input = wrapper.find('input')
+  ;(input.element as HTMLInputElement).value = value
+  return input.trigger('input')
+}
+
+describe('ChipInput', () => {
+  it('hides a custom example placeholder after a chip has been added', async () => {
+    const wrapper = mountInput({ placeholder: '7020' })
+
+    expect(wrapper.find('input').attributes('placeholder')).toBe('7020')
+
+    await wrapper.setProps({ modelValue: ['333'] })
+
+    expect(wrapper.find('input').attributes('placeholder')).toBe('')
+  })
+
+  /** Without a search function the field is a plain list, which is what a settings form needs. */
+  it('adds what was typed on Enter when no suggestions are configured', async () => {
+    const wrapper = mountInput()
+
+    await typeInto(wrapper, 'epub')
+    await wrapper.find('input').trigger('keydown', { key: 'Enter' })
+
+    expect(wrapper.emitted('update:modelValue')?.at(-1)).toEqual([['epub']])
+  })
+
+  /** These values are written down comma-separated, so that is how they get pasted in. */
+  it('splits a pasted comma-separated list, keeping whatever is still being typed', async () => {
+    const wrapper = mountInput()
+
+    await typeInto(wrapper, 'epub, mobi, azw')
+
+    expect(wrapper.emitted('update:modelValue')?.at(-1)).toEqual([['epub', 'mobi']])
+    expect((wrapper.find('input').element as HTMLInputElement).value).toBe(' azw')
+  })
+
+  it('refuses an entry the field says is not valid', async () => {
+    const normalize = vi.fn<(raw: string) => string | null>((raw) => (/^\d+$/.test(raw) ? raw : null))
+    const wrapper = mountInput({ normalize })
+
+    await typeInto(wrapper, '7020,notanumber,')
+
+    expect(wrapper.emitted('update:modelValue')?.at(-1)).toEqual([['7020']])
+  })
+
+  it('does not add the same entry twice', async () => {
+    const wrapper = mountInput({ modelValue: ['epub'] })
+
+    await typeInto(wrapper, 'epub')
+    await wrapper.find('input').trigger('keydown', { key: 'Enter' })
+
+    expect(wrapper.emitted('update:modelValue')).toBeUndefined()
+  })
+
+  it('drops the last entry on Backspace in an empty box', async () => {
+    const wrapper = mountInput({ modelValue: ['epub', 'mobi'] })
+
+    await wrapper.find('input').trigger('keydown', { key: 'Backspace' })
+
+    expect(wrapper.emitted('update:modelValue')?.at(-1)).toEqual([['epub']])
+  })
+
+  /** A suggestion-backed field must keep working exactly as it did before free text was allowed. */
+  it('still queries the search function when one is given', async () => {
+    vi.useFakeTimers()
+    const searchFn = vi.fn<(q: string) => Promise<string[]>>().mockResolvedValue(['fiction'])
+    const wrapper = mountInput({ searchFn })
+
+    await typeInto(wrapper, 'fic')
+    await vi.advanceTimersByTimeAsync(250)
+
+    expect(searchFn).toHaveBeenCalledWith('fic')
+    vi.useRealTimers()
+  })
+})
diff --git a/client/src/components/ui/__tests__/TokenSelect.spec.ts b/client/src/components/ui/__tests__/TokenSelect.spec.ts
new file mode 100644
index 000000000..a1541855c
--- /dev/null
+++ b/client/src/components/ui/__tests__/TokenSelect.spec.ts
@@ -0,0 +1,117 @@
+import { mount } from '@vue/test-utils'
+import { describe, expect, it } from 'vitest'
+import TokenSelect from '../TokenSelect.vue'
+
+const OPTIONS = [
+  { value: 'de', label: 'German' },
+  { value: 'en', label: 'English' },
+  { value: 'fr', label: 'French' },
+]
+
+function mountSelect(props: Partial<InstanceType<typeof TokenSelect>['$props']> = {}) {
+  return mount(TokenSelect, { props: { options: OPTIONS, modelValue: [], inputId: 'tier-languages', ...props } })
+}
+
+function optionText(wrapper: ReturnType<typeof mountSelect>) {
+  return wrapper.findAll('[role="option"]').map((option) => option.text())
+}
+
+async function typeInto(wrapper: ReturnType<typeof mountSelect>, value: string) {
+  const input = wrapper.find('input')
+  ;(input.element as HTMLInputElement).value = value
+  await input.trigger('input')
+}
+
+describe('TokenSelect', () => {
+  /**
+   * The whole reason this replaced `<select multiple>`: Vue stringifies a bound array onto the
+   * select, "en,de" matches no option, and the browser clears every selection. Anything past one
+   * value has to survive here.
+   */
+  it('keeps accumulating values past the first', async () => {
+    const wrapper = mountSelect()
+
+    await wrapper.find('input').trigger('focus')
+    await wrapper.findAll('[role="option"]')[1]?.trigger('mousedown')
+    expect(wrapper.emitted('update:modelValue')?.at(-1)).toEqual([['en']])
+
+    await wrapper.setProps({ modelValue: ['en'] })
+    await wrapper.find('input').trigger('focus')
+    await wrapper.findAll('[role="option"]')[0]?.trigger('mousedown')
+
+    expect(wrapper.emitted('update:modelValue')?.at(-1)).toEqual([['en', 'de']])
+  })
+
+  it('shows what is chosen as removable chips, ordered by the option list', async () => {
+    const wrapper = mountSelect({ modelValue: ['fr', 'de'] })
+
+    expect(wrapper.text()).toContain('German')
+    expect(wrapper.text()).toContain('French')
+
+    await wrapper.get('button[type="button"]').trigger('click')
+
+    expect(wrapper.emitted('update:modelValue')?.at(-1)).toEqual([['fr']])
+  })
+
+  it('filters on the label and on the code, and hides what is already chosen', async () => {
+    const wrapper = mountSelect({ modelValue: ['de'] })
+
+    await wrapper.find('input').trigger('focus')
+    expect(optionText(wrapper)).toEqual(['English', 'French'])
+
+    await typeInto(wrapper, 'fr')
+    expect(optionText(wrapper)).toEqual(['French'])
+
+    await typeInto(wrapper, 'eng')
+    expect(optionText(wrapper)).toEqual(['English'])
+  })
+
+  /** A query narrowed to one is unambiguous, so Enter takes it without arrowing to it first. */
+  it('adds the only match on Enter', async () => {
+    const wrapper = mountSelect()
+
+    await typeInto(wrapper, 'french')
+    await wrapper.find('input').trigger('keydown', { key: 'Enter' })
+
+    expect(wrapper.emitted('update:modelValue')?.at(-1)).toEqual([['fr']])
+  })
+
+  it('walks the list with the arrow keys and reports the active option to assistive technology', async () => {
+    const wrapper = mountSelect()
+
+    const input = wrapper.find('input')
+    await input.trigger('keydown', { key: 'ArrowDown' })
+    await input.trigger('keydown', { key: 'ArrowDown' })
+
+    expect(input.attributes('aria-activedescendant')).toBe('tier-languages-option-1')
+
+    await input.trigger('keydown', { key: 'Enter' })
+
+    expect(wrapper.emitted('update:modelValue')?.at(-1)).toEqual([['en']])
+  })
+
+  it('drops the last chip on Backspace from an empty query', async () => {
+    const wrapper = mountSelect({ modelValue: ['de', 'en'] })
+
+    await wrapper.find('input').trigger('keydown', { key: 'Backspace' })
+
+    expect(wrapper.emitted('update:modelValue')?.at(-1)).toEqual([['de']])
+  })
+
+  it('says so when nothing matches instead of showing an empty list', async () => {
+    const wrapper = mountSelect()
+
+    await typeInto(wrapper, 'klingon')
+
+    expect(wrapper.findAll('[role="option"]')).toHaveLength(0)
+    expect(wrapper.text()).toContain('No matches')
+  })
+
+  it('emits nothing at all while disabled', async () => {
+    const wrapper = mountSelect({ modelValue: ['de'], disabled: true })
+
+    await wrapper.find('input').trigger('keydown', { key: 'Backspace' })
+
+    expect(wrapper.emitted('update:modelValue')).toBeUndefined()
+  })
+})
diff --git a/client/src/composables/__tests__/useRouteTab.spec.ts b/client/src/composables/__tests__/useRouteTab.spec.ts
new file mode 100644
index 000000000..d0f781e80
--- /dev/null
+++ b/client/src/composables/__tests__/useRouteTab.spec.ts
@@ -0,0 +1,105 @@
+import { describe, expect, it } from 'vitest'
+import { flushPromises, mount } from '@vue/test-utils'
+import { defineComponent, nextTick, ref, type Ref } from 'vue'
+import { createMemoryHistory, createRouter } from 'vue-router'
+
+import { useRouteTab } from '../useRouteTab'
+
+type Tab = 'search' | 'mine' | 'all'
+
+const ALL_TABS: readonly Tab[] = ['search', 'mine', 'all']
+
+function normalize(value: unknown): Tab {
+  return typeof value === 'string' && (ALL_TABS as readonly string[]).includes(value) ? (value as Tab) : 'search'
+}
+
+async function mountTab(options: { routeName?: string; available?: Ref<readonly Tab[]>; start?: string } = {}) {
+  const router = createRouter({
+    history: createMemoryHistory(),
+    routes: [
+      {
+        path: '/requests',
+        name: 'requests',
+        component: { template: '<div><router-view /></div>' },
+        children: [{ path: ':id', name: 'request-detail', component: { template: '<div />' } }],
+      },
+    ],
+  })
+  await router.push(options.start ?? '/requests')
+  await router.isReady()
+
+  const availableTabs = options.available ?? ref(ALL_TABS)
+  let api!: ReturnType<typeof useRouteTab<Tab>>
+
+  const wrapper = mount(
+    defineComponent({
+      setup() {
+        api = useRouteTab<Tab>({ routeName: options.routeName, normalize, availableTabs, fallback: 'search' })
+        return () => null
+      },
+    }),
+    { global: { plugins: [router] } },
+  )
+
+  await nextTick()
+  return { router, wrapper, availableTabs, api: api as ReturnType<typeof useRouteTab<Tab>> }
+}
+
+async function settle() {
+  await flushPromises()
+  await nextTick()
+  await flushPromises()
+}
+
+describe('useRouteTab', () => {
+  it('adopts the tab from later navigation', async () => {
+    const { router, api } = await mountTab()
+    expect(api.activeTab.value).toBe('search')
+
+    await router.push('/requests?tab=all')
+    await settle()
+
+    expect(api.activeTab.value).toBe('all')
+  })
+
+  it('falls back when the named tab is unavailable', async () => {
+    const available = ref<readonly Tab[]>(['search', 'mine'])
+    const { router, api } = await mountTab({ available })
+
+    await router.push('/requests?tab=all')
+    await settle()
+
+    expect(api.activeTab.value).toBe('search')
+  })
+
+  it('re-resolves when a tab stops being available', async () => {
+    const available = ref<readonly Tab[]>(ALL_TABS)
+    const { api } = await mountTab({ available, start: '/requests?tab=all' })
+    expect(api.activeTab.value).toBe('all')
+
+    available.value = ['search', 'mine']
+    await settle()
+
+    expect(api.activeTab.value).toBe('search')
+  })
+
+  it('keeps the current child route when no route name is given', async () => {
+    const { router, api } = await mountTab({ start: '/requests/34' })
+
+    api.selectTab('mine')
+    await settle()
+
+    expect(router.currentRoute.value.name).toBe('request-detail')
+    expect(router.currentRoute.value.params.id).toBe('34')
+    expect(router.currentRoute.value.query.tab).toBe('mine')
+  })
+
+  it('returns to the named route when one is given', async () => {
+    const { router, api } = await mountTab({ routeName: 'requests', start: '/requests/34' })
+
+    api.selectTab('mine')
+    await settle()
+
+    expect(router.currentRoute.value.name).toBe('requests')
+  })
+})
diff --git a/client/src/composables/__tests__/useSidebarNav.spec.ts b/client/src/composables/__tests__/useSidebarNav.spec.ts
index 399cb5fa5..355c7aca0 100644
--- a/client/src/composables/__tests__/useSidebarNav.spec.ts
+++ b/client/src/composables/__tests__/useSidebarNav.spec.ts
@@ -1,13 +1,48 @@
-import { describe, expect, it } from 'vitest'
-import type { BrowseCounts } from '@bookorbit/types'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { Permission, type BrowseCounts } from '@bookorbit/types'
 import type { RouteLocationNormalizedLoaded } from 'vue-router'
-import { SIDEBAR_NAV_REGISTRY, isNavEntryAllowed, resolveNavEntry } from '../useSidebarNav'
+import { SIDEBAR_NAV_REGISTRY, isNavEntryAllowed, resolveNavEntry, useSidebarNav } from '../useSidebarNav'
 
-function makeContext(overrides: Partial<{ permissions: string[]; bookDockTotal: number; browseCounts: BrowseCounts | null }> = {}) {
+const mocks = vi.hoisted(() => ({ permissions: new Set<string>() }))
+
+vi.mock('vue-i18n', () => ({
+  useI18n: () => ({
+    t: (key: string, params?: { count?: number }) => {
+      const count = params?.count ?? 0
+      if (key === 'components.sidebar.requestBadge.allActive') return `${count} active requests across all users`
+      if (key === 'components.sidebar.requestBadge.mineActive') return `${count} active requests of yours`
+      return key
+    },
+  }),
+}))
+
+vi.mock('vue-router', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('vue-router')>()
+  return {
+    ...actual,
+    useRoute: () => ({ name: 'dashboard', params: {}, query: {} }),
+  }
+})
+
+vi.mock('@/features/auth/composables/usePermissions', () => ({
+  usePermissions: () => ({ hasPermission: (name: string) => mocks.permissions.has(name) }),
+}))
+
+function makeContext(
+  overrides: Partial<{
+    permissions: string[]
+    bookDockTotal: number
+    outstandingRequestTotal: number
+    outstandingRequestLabel: string
+    browseCounts: BrowseCounts | null
+  }> = {},
+) {
   const permissions = overrides.permissions ?? []
   return {
     hasPermission: (name: string) => permissions.includes(name),
     bookDockTotal: overrides.bookDockTotal ?? 0,
+    outstandingRequestTotal: overrides.outstandingRequestTotal ?? 0,
+    outstandingRequestLabel: overrides.outstandingRequestLabel ?? '',
     browseCounts: overrides.browseCounts ?? null,
   }
 }
@@ -27,14 +62,18 @@ function allowedIds(context: ReturnType<typeof makeContext>) {
 }
 
 describe('sidebar nav registry', () => {
+  beforeEach(() => {
+    mocks.permissions.clear()
+  })
+
   it('shows only ungated destinations to a user with no permissions', () => {
     expect(allowedIds(makeContext())).toEqual(['dashboard', 'authors', 'series', 'annotations'])
   })
 
-  it('places Dashboard, Book Dock and Tools in the primary zone, above the entity sections', () => {
+  it('places Dashboard, Book Dock, Requests and Tools in the primary zone, above the entity sections', () => {
     const primary = SIDEBAR_NAV_REGISTRY.filter((candidate) => candidate.zone === 'primary').map((candidate) => candidate.id)
 
-    expect(primary).toEqual(['dashboard', 'book-dock', 'tools'])
+    expect(primary).toEqual(['dashboard', 'book-dock', 'book-requests', 'tools'])
   })
 
   it('leaves Statistics and Achievements to the header', () => {
@@ -48,6 +87,20 @@ describe('sidebar nav registry', () => {
     expect(allowedIds(makeContext({ permissions: ['book_dock_access'] }))).toContain('book-dock')
   })
 
+  it('shows Requests once the user holds book_request_access', () => {
+    expect(allowedIds(makeContext({ permissions: ['book_request_access'] }))).toContain('book-requests')
+  })
+
+  it('hides Requests from a user without book_request_access', () => {
+    expect(allowedIds(makeContext())).not.toContain('book-requests')
+  })
+
+  it.each(['book-requests', 'book-request-detail', 'book-request-releases'])('keeps Requests active on %s', (routeName) => {
+    const resolved = resolveNavEntry(entry('book-requests'), makeContext({ permissions: ['book_request_access'] }), makeRoute(routeName), 'Requests')
+
+    expect(resolved.isActive).toBe(true)
+  })
+
   it.each(['manage_libraries', 'library_delete_books'])('shows Tools for the any-of permission %s', (permission) => {
     expect(allowedIds(makeContext({ permissions: [permission] }))).toContain('tools')
   })
@@ -80,10 +133,38 @@ describe('sidebar nav registry', () => {
   it('exposes the Book Dock badge only when items are queued', () => {
     const context = makeContext({ permissions: ['book_dock_access'], bookDockTotal: 3 })
 
-    expect(resolveNavEntry(entry('book-dock'), context, makeRoute('dashboard'), 'Book Dock').badge).toBe(3)
+    expect(resolveNavEntry(entry('book-dock'), context, makeRoute('dashboard'), 'Book Dock').badge).toEqual({ value: 3, tone: 'accent' })
     expect(resolveNavEntry(entry('book-dock'), makeContext(), makeRoute('dashboard'), 'Book Dock').badge).toBeNull()
   })
 
+  it('exposes the Requests badge only when requests are outstanding', () => {
+    const context = makeContext({
+      permissions: ['book_request_access'],
+      outstandingRequestTotal: 6,
+      outstandingRequestLabel: '6 active requests of yours',
+    })
+
+    expect(resolveNavEntry(entry('book-requests'), context, makeRoute('dashboard'), 'Requests').badge).toEqual({
+      value: 6,
+      label: '6 active requests of yours',
+      tone: 'accent',
+    })
+    expect(resolveNavEntry(entry('book-requests'), makeContext(), makeRoute('dashboard'), 'Requests').badge).toBeNull()
+  })
+
+  it.each([
+    ['a requester', [], '2 active requests of yours'],
+    ['a request manager', [Permission.ManageBookRequests], '2 active requests across all users'],
+  ])('describes the Requests badge scope for %s', (_role, permissions, expectedLabel) => {
+    mocks.permissions.add(Permission.BookRequestAccess)
+    for (const permission of permissions) mocks.permissions.add(permission)
+
+    const { zones } = useSidebarNav(() => 2)
+    const requests = zones.value.flatMap((zone) => zone.entries).find((candidate) => candidate.id === 'book-requests')
+
+    expect(requests?.badge).toEqual({ value: 2, label: expectedLabel, tone: 'accent' })
+  })
+
   it.each([
     ['authors', 1234],
     ['series', 312],
@@ -91,7 +172,7 @@ describe('sidebar nav registry', () => {
   ])('badges %s with its browse count', (id, expected) => {
     const context = makeContext({ browseCounts: { authors: 1234, series: 312, annotations: 18000 } })
 
-    expect(resolveNavEntry(entry(id), context, makeRoute('dashboard'), id).badge).toBe(expected)
+    expect(resolveNavEntry(entry(id), context, makeRoute('dashboard'), id).badge).toEqual({ value: expected })
   })
 
   it('leaves the browse rows unbadged before the counts load and while they are zero', () => {
diff --git a/client/src/features/settings/composables/useRouteTab.ts b/client/src/composables/useRouteTab.ts
similarity index 90%
rename from client/src/features/settings/composables/useRouteTab.ts
rename to client/src/composables/useRouteTab.ts
index 28b504953..46227e058 100644
--- a/client/src/features/settings/composables/useRouteTab.ts
+++ b/client/src/composables/useRouteTab.ts
@@ -2,7 +2,7 @@ import { ref, toValue, watch, type MaybeRefOrGetter, type Ref } from 'vue'
 import { useRoute, useRouter } from 'vue-router'
 
 interface UseRouteTabOptions<T extends string> {
-  routeName: string
+  routeName?: string
   normalize: (value: unknown) => T
   availableTabs: MaybeRefOrGetter<readonly T[]>
   fallback: T
@@ -28,7 +28,8 @@ export function useRouteTab<T extends string>(options: UseRouteTabOptions<T>): U
 
   function replaceQuery(tab: T): void {
     if (route.query.tab === tab) return
-    void router.replace({ name: options.routeName, query: { ...route.query, tab } })
+    const query = { ...route.query, tab }
+    void router.replace(options.routeName ? { name: options.routeName, query } : { query })
   }
 
   function syncTab(value: unknown): void {
diff --git a/client/src/composables/useSidebarNav.ts b/client/src/composables/useSidebarNav.ts
index 245b99952..2959da398 100644
--- a/client/src/composables/useSidebarNav.ts
+++ b/client/src/composables/useSidebarNav.ts
@@ -1,8 +1,8 @@
 import { computed, type Component } from 'vue'
 import { useI18n } from 'vue-i18n'
 import { useRoute, type RouteLocationNormalizedLoaded, type RouteLocationRaw } from 'vue-router'
-import { Highlighter, LayoutDashboard, Library, PackageOpen, Users, Wrench } from '@lucide/vue'
-import type { BrowseCounts, SidebarSectionId } from '@bookorbit/types'
+import { BookPlus, Highlighter, LayoutDashboard, Library, PackageOpen, Users, Wrench } from '@lucide/vue'
+import { Permission, type BrowseCounts, type SidebarSectionId } from '@bookorbit/types'
 import { usePermissions } from '@/features/auth/composables/usePermissions'
 import { useBookDockSummary } from '@/features/book-dock/composables/useBookDockSummary'
 import { useBrowseCounts } from '@/composables/useBrowseCounts'
@@ -13,9 +13,18 @@ export type SidebarZoneId = (typeof SIDEBAR_ZONE_IDS)[number]
 interface NavContext {
   hasPermission: (name: string) => boolean
   bookDockTotal: number
+  outstandingRequestTotal: number
+  outstandingRequestLabel: string
   browseCounts: BrowseCounts | null
 }
 
+export interface SidebarNavBadge {
+  value: number
+  label?: string
+  /** `accent` colours the chip: the number is work waiting on the user, not a library total. */
+  tone?: 'default' | 'accent'
+}
+
 export interface SidebarNavEntry {
   id: string
   labelKey: string
@@ -26,7 +35,7 @@ export interface SidebarNavEntry {
   /** Any-of: the entry is shown when the user holds at least one of these permissions. */
   permission?: string | string[]
   visible?: (context: NavContext) => boolean
-  badge?: (context: NavContext) => number | null
+  badge?: (context: NavContext) => SidebarNavBadge | null
   tourId?: string
 }
 
@@ -36,7 +45,7 @@ export interface ResolvedSidebarNavEntry {
   icon: Component
   to: RouteLocationRaw
   isActive: boolean
-  badge: number | null
+  badge: SidebarNavBadge | null
   tourId?: string
 }
 
@@ -63,10 +72,10 @@ function routeNameStartsWith(route: RouteLocationNormalizedLoaded, prefix: strin
 }
 
 /** Browse badges stay out of the row until the counts have loaded and there is something to count. */
-function browseBadge(key: keyof BrowseCounts): (context: NavContext) => number | null {
+function browseBadge(key: keyof BrowseCounts): (context: NavContext) => SidebarNavBadge | null {
   return (context) => {
     const total = context.browseCounts?.[key] ?? 0
-    return total > 0 ? total : null
+    return total > 0 ? { value: total } : null
   }
 }
 
@@ -87,9 +96,21 @@ export const SIDEBAR_NAV_REGISTRY: readonly SidebarNavEntry[] = [
     to: { name: 'book-dock' },
     isActive: (route) => route.name === 'book-dock',
     permission: 'book_dock_access',
-    badge: (context) => (context.bookDockTotal > 0 ? context.bookDockTotal : null),
+    badge: (context) => (context.bookDockTotal > 0 ? { value: context.bookDockTotal, tone: 'accent' } : null),
     tourId: 'book-dock-btn',
   },
+  {
+    id: 'book-requests',
+    labelKey: 'bookRequests.title',
+    icon: BookPlus,
+    zone: 'primary',
+    to: { name: 'book-requests' },
+    // The drawer routes are children of this one, so the row has to stay lit while one is open.
+    isActive: (route) => routeNameStartsWith(route, 'book-request'),
+    permission: 'book_request_access',
+    badge: (context) =>
+      context.outstandingRequestTotal > 0 ? { value: context.outstandingRequestTotal, label: context.outstandingRequestLabel, tone: 'accent' } : null,
+  },
   {
     id: 'tools',
     labelKey: 'components.sidebar.tools',
@@ -148,18 +169,27 @@ export function resolveNavEntry(entry: SidebarNavEntry, context: NavContext, rou
   } satisfies ResolvedSidebarNavEntry
 }
 
-export function useSidebarNav() {
+export function useSidebarNav(getOutstandingRequestTotal: () => number = () => 0) {
   const { t } = useI18n()
   const route = useRoute()
   const { hasPermission } = usePermissions()
   const { summary: bookDockSummary } = useBookDockSummary()
   const { counts: browseCounts } = useBrowseCounts()
 
-  const context = computed<NavContext>(() => ({
-    hasPermission,
-    bookDockTotal: bookDockSummary.value.total,
-    browseCounts: browseCounts.value,
-  }))
+  const context = computed<NavContext>(() => {
+    const outstandingRequestTotal = getOutstandingRequestTotal()
+    const outstandingRequestLabelKey = hasPermission(Permission.ManageBookRequests)
+      ? 'components.sidebar.requestBadge.allActive'
+      : 'components.sidebar.requestBadge.mineActive'
+
+    return {
+      hasPermission,
+      bookDockTotal: bookDockSummary.value.total,
+      outstandingRequestTotal,
+      outstandingRequestLabel: t(outstandingRequestLabelKey, { count: outstandingRequestTotal }),
+      browseCounts: browseCounts.value,
+    }
+  })
 
   const zones = computed<SidebarNavZone[]>(() =>
     SIDEBAR_ZONE_IDS.map((zoneId) => ({
diff --git a/client/src/features/admin/UserFormDrawer.vue b/client/src/features/admin/UserFormDrawer.vue
index 47349f163..4d975c020 100644
--- a/client/src/features/admin/UserFormDrawer.vue
+++ b/client/src/features/admin/UserFormDrawer.vue
@@ -1,79 +1,96 @@
 <script setup lang="ts">
-import { Button } from '@/components/ui/button'
-import { ref, watch, computed } from 'vue'
+import { computed, ref, toRef, watch } from 'vue'
 import { useI18n } from 'vue-i18n'
-import { ShieldCheck, X } from '@lucide/vue'
-import { api } from '@/lib/api'
-import { Permission, PERMISSION_LABELS } from '@bookorbit/types'
-import type { AuthUser } from '@bookorbit/types'
 import { useMediaQuery } from '@vueuse/core'
-import ContentFilterChipInput from '@/components/ui/ContentFilterChipInput.vue'
-import ToggleSwitch from '@/components/ui/ToggleSwitch.vue'
+import {
+  ChevronLeft,
+  ChevronRight,
+  KeyRound,
+  Library as LibraryIcon,
+  ShieldCheck,
+  SlidersHorizontal,
+  TriangleAlert,
+  UserRound,
+  X,
+  type LucideIcon,
+} from '@lucide/vue'
+import { Button } from '@/components/ui/button'
+import { Sheet, SheetContent, SheetDescription, SheetTitle } from '@/components/ui/sheet'
 import Badge from '@/components/ui/badge/Badge.vue'
-import { useTagSearchWithIds, useGenreSearchWithIds } from './composables/useContentFilterSearch'
-import { PERMISSION_GROUPS, presetPermissions, type PermissionPreset } from './lib/permission-presets'
+import ToggleSwitch from '@/components/ui/ToggleSwitch.vue'
+import { formatDate, formatDateTime, formatNumber } from '@/i18n/formatters'
+import StatusPill from './components/StatusPill.vue'
+import UserPermissionsSection from './components/UserPermissionsSection.vue'
+import UserRestrictionsSection from './components/UserRestrictionsSection.vue'
+import { useUserForm, type UserFormSection, type UserFormTarget } from './composables/useUserForm'
 
-interface Library {
-  id: number
-  name: string
-}
-
-interface NamedItem {
+interface LibraryOption {
   id: number
   name: string
+  bookCount?: number
 }
 
 const props = defineProps<{
-  user: Partial<AuthUser> | null
-  libraries: Library[]
+  user: UserFormTarget | null
+  libraries: LibraryOption[]
   defaultLibraryIds?: number[]
   canManageSuperuser?: boolean
   currentUserId?: number
+  canDelete?: boolean
 }>()
 
 const emit = defineEmits<{
   close: []
   saved: [resetUrl?: string]
   requestSuperuserChange: [isSuperuser: boolean]
+  delete: []
 }>()
 
 const { t } = useI18n()
 
-const permissionGroups = computed(() =>
-  PERMISSION_GROUPS.map((group) => ({ ...group, label: t(`adminFeature.userForm.permissionGroups.${group.id}`) })),
-)
+const {
+  name,
+  username,
+  email,
+  active,
+  isSharedAccount,
+  selectedPermissionNames,
+  selectedLibraryIds,
+  includeTagItems,
+  excludeTagItems,
+  includeGenreItems,
+  excludeGenreItems,
+  seeOwnRequestedBooks,
+  contentFiltersEnabled,
+  loading,
+  error,
+  errorKey,
+  isEdit,
+  isSuperuserTarget,
+  grantedCount,
+  totalPermissions,
+  restrictionState,
+  changeCount,
+  toggleLibrary,
+  setLibraries,
+  togglePermission,
+  applyPreset,
+  setContentFiltersEnabled,
+  save,
+} = useUserForm(toRef(props, 'user'), toRef(props, 'defaultLibraryIds'))
 
-function permissionLabel(permission: Permission): string {
-  if (permission === Permission.ViewUserActivity) return t('adminFeature.accountActivity.permissionLabel')
-  return PERMISSION_LABELS[permission] ?? permission
-}
+/** Below this the sheet is too narrow to carry the rail, so sections become a drill-in list. */
+const isWide = useMediaQuery('(min-width: 768px)')
+const isNarrowViewport = useMediaQuery('(max-width: 639px)')
 
-const name = ref('')
-const username = ref('')
-const email = ref('')
-const active = ref(true)
-const isSharedAccount = ref(false)
-const selectedPermissionNames = ref<Set<string>>(new Set())
-const selectedLibraryIds = ref<Set<number>>(new Set())
-const error = ref<string | null>(null)
-const loading = ref(false)
-const libraryAccessOpen = ref(true)
-const permissionGroupOpen = ref<Record<string, boolean>>({})
-const contentFiltersOpen = ref(false)
+const open = ref(true)
+const activeSection = ref<UserFormSection | null>(null)
 
-const includeTagItems = ref<NamedItem[]>([])
-const excludeTagItems = ref<NamedItem[]>([])
-const includeGenreItems = ref<NamedItem[]>([])
-const excludeGenreItems = ref<NamedItem[]>([])
+const side = computed(() => (isNarrowViewport.value ? ('bottom' as const) : ('right' as const)))
+const sizeClass = computed(() => (isNarrowViewport.value ? 'h-full rounded-none' : 'w-full sm:max-w-[52.5rem]'))
 
-const currentTab = ref<'general' | 'access' | 'restrictions'>('general')
-const restrictionsEnabled = ref(false)
-
-const { search: searchTags } = useTagSearchWithIds()
-const { search: searchGenres } = useGenreSearchWithIds()
-
-const isEdit = computed(() => !!props.user?.id)
-const isSuperuserTarget = computed(() => !!props.user?.isSuperuser)
+const showSectionMenu = computed(() => !isWide.value && activeSection.value === null)
+const showBackButton = computed(() => !isWide.value && activeSection.value !== null)
 const isOwnAccount = computed(() => props.user?.id === props.currentUserId)
 const canChangeSuperuser = computed(
   () =>
@@ -83,514 +100,470 @@ const canChangeSuperuser = computed(
     !isOwnAccount.value &&
     props.user?.provisioningMethod !== 'shared',
 )
-const isMobile = useMediaQuery('(max-width: 767px)')
 
-function toggleLibrary(libraryId: number) {
-  if (selectedLibraryIds.value.has(libraryId)) {
-    selectedLibraryIds.value.delete(libraryId)
-  } else {
-    selectedLibraryIds.value.add(libraryId)
-  }
-}
-
-const hasRestrictions = computed(() => {
-  return (
-    includeTagItems.value.length > 0 || excludeTagItems.value.length > 0 || includeGenreItems.value.length > 0 || excludeGenreItems.value.length > 0
-  )
+const headerTitle = computed(() => {
+  if (isEdit.value) return name.value || username.value || t('adminFeature.userForm.editUser')
+  return isSharedAccount.value ? t('adminFeature.userForm.createSharedAccount') : t('adminFeature.userForm.createUser')
 })
 
-function applyPreset(preset: PermissionPreset) {
-  selectedPermissionNames.value = new Set(presetPermissions(preset))
+const avatarInitial = computed(() => (name.value || username.value || '?').trim().charAt(0).toUpperCase())
+
+const signInMethod = computed(() => {
+  const method = props.user?.provisioningMethod ?? 'local'
+  if (method === 'oidc') return t('adminFeature.userForm.signInMethods.oidc')
+  if (method === 'shared') return t('adminFeature.userForm.signInMethods.shared')
+  return t('adminFeature.userForm.signInMethods.password')
+})
+
+const createdLabel = computed(() => (props.user?.createdAt ? formatDate(new Date(props.user.createdAt), { dateStyle: 'medium' }) : null))
+
+const lockedUntil = computed(() => {
+  const value = props.user?.lockedUntil
+  if (!value) return null
+  const until = new Date(value)
+  return until.getTime() > Date.now() ? until : null
+})
+
+const restrictionSummary = computed(() => {
+  switch (restrictionState.value) {
+    case 'both':
+      return t('adminFeature.userForm.sectionSummary.restrictionsBoth')
+    case 'content':
+      return t('adminFeature.userForm.sectionSummary.restrictionsContent')
+    case 'demo':
+      return t('adminFeature.userForm.sectionSummary.restrictionsDemo')
+    default:
+      return t('adminFeature.userForm.sectionSummary.restrictionsNone')
+  }
+})
+
+const profileSummary = computed(() => {
+  if (!isEdit.value) return t('adminFeature.userForm.sectionSummary.newAccount')
+  if (lockedUntil.value) return t('adminFeature.usersPage.lockedBadge')
+  return active.value ? t('adminFeature.userForm.active') : t('adminFeature.userForm.suspended')
+})
+
+interface SectionEntry {
+  id: UserFormSection
+  label: string
+  summary: string
+  icon: LucideIcon
 }
 
+const sections = computed<SectionEntry[]>(() => [
+  { id: 'profile', label: t('adminFeature.userForm.sections.profile'), summary: profileSummary.value, icon: UserRound },
+  {
+    id: 'libraries',
+    label: t('adminFeature.userForm.sections.libraries'),
+    summary: t('adminFeature.userForm.sectionSummary.libraries', {
+      selected: formatNumber(selectedLibraryIds.value.size),
+      total: formatNumber(props.libraries.length),
+    }),
+    icon: LibraryIcon,
+  },
+  {
+    id: 'permissions',
+    label: t('adminFeature.userForm.sections.permissions'),
+    summary: t('adminFeature.userForm.sectionSummary.permissions', { count: grantedCount.value }),
+    icon: KeyRound,
+  },
+  { id: 'restrictions', label: t('adminFeature.userForm.sections.restrictions'), summary: restrictionSummary.value, icon: SlidersHorizontal },
+])
+
+const activeSectionLabel = computed(() => sections.value.find((section) => section.id === activeSection.value)?.label ?? '')
+
+const allLibrariesSelected = computed(() => props.libraries.length > 0 && selectedLibraryIds.value.size === props.libraries.length)
+
+const libraryReach = computed(() => {
+  const counted = props.libraries.filter((library) => library.bookCount !== undefined)
+  if (counted.length === 0) return null
+  const total = counted.reduce((sum, library) => sum + (library.bookCount ?? 0), 0)
+  const selected = counted.filter((library) => selectedLibraryIds.value.has(library.id)).reduce((sum, library) => sum + (library.bookCount ?? 0), 0)
+  return { selected: formatNumber(selected), total: formatNumber(total) }
+})
+
+const errorMessage = computed(() => {
+  if (error.value) return error.value
+  if (!errorKey.value) return null
+  return t(`adminFeature.userForm.errors.${errorKey.value}`)
+})
+
 watch(
-  hasRestrictions,
-  (val) => {
-    if (val) restrictionsEnabled.value = true
+  isWide,
+  (wide) => {
+    if (wide && activeSection.value === null) activeSection.value = 'profile'
   },
   { immediate: true },
 )
 
 watch(
   () => props.user,
-  async (u) => {
-    name.value = u?.name ?? ''
-    username.value = u?.username ?? ''
-    email.value = u?.email ?? ''
-    active.value = u?.active ?? true
-    isSharedAccount.value = u?.provisioningMethod === 'shared'
-    selectedPermissionNames.value = new Set(u?.permissions?.filter((p) => p !== '*') ?? [])
-    selectedLibraryIds.value = u?.id ? new Set() : new Set(props.defaultLibraryIds ?? [])
-    error.value = null
-    includeTagItems.value = []
-    excludeTagItems.value = []
-    includeGenreItems.value = []
-    excludeGenreItems.value = []
-
-    if (u?.id) {
-      const [libRes, filtersRes] = await Promise.all([
-        api(`/api/v1/users/${u.id}/libraries`),
-        !u.isSuperuser ? api(`/api/v1/users/${u.id}/content-filters`) : Promise.resolve(null),
-      ])
-      if (libRes.ok) {
-        const ids: number[] = await libRes.json()
-        selectedLibraryIds.value = new Set(ids)
-      }
-      if (filtersRes?.ok) {
-        const filters = await filtersRes.json()
-        includeTagItems.value = filters.includeTags ?? []
-        excludeTagItems.value = filters.excludeTags ?? []
-        includeGenreItems.value = filters.includeGenres ?? []
-        excludeGenreItems.value = filters.excludeGenres ?? []
-      }
-    }
-
-    libraryAccessOpen.value = !isMobile.value
-    permissionGroupOpen.value = Object.fromEntries(PERMISSION_GROUPS.map((group) => [group.id, !isMobile.value]))
-    contentFiltersOpen.value = false
-    currentTab.value = 'general'
-  },
-  { immediate: true },
-)
-
-watch(
-  () => props.defaultLibraryIds,
-  (ids) => {
-    if (!isEdit.value) selectedLibraryIds.value = new Set(ids ?? [])
+  () => {
+    activeSection.value = isWide.value ? 'profile' : null
   },
 )
 
-watch(isMobile, (mobile) => {
-  libraryAccessOpen.value = !mobile
-  permissionGroupOpen.value = Object.fromEntries(PERMISSION_GROUPS.map((group) => [group.id, !mobile]))
-})
-
-function togglePermission(permName: string) {
-  if (selectedPermissionNames.value.has(permName)) {
-    selectedPermissionNames.value.delete(permName)
-  } else {
-    selectedPermissionNames.value.add(permName)
-  }
+function selectSection(section: UserFormSection) {
+  activeSection.value = section
 }
 
-async function handleSubmit() {
-  error.value = null
-  loading.value = true
-  try {
-    const trimmedEmail = email.value.trim()
-
-    if (isEdit.value) {
-      const res = await api(`/api/v1/users/${props.user!.id}`, {
-        method: 'PATCH',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ name: name.value, email: trimmedEmail || undefined, active: active.value }),
-      })
-      if (!res.ok) {
-        const err = await res.json().catch(() => ({}))
-        error.value = err.message ?? t('adminFeature.userForm.errors.updateUser')
-        return
-      }
-
-      const permRes = await api(`/api/v1/users/${props.user!.id}/permissions`, {
-        method: 'PUT',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ permissionNames: [...selectedPermissionNames.value] }),
-      })
-      if (!permRes.ok) {
-        const err = await permRes.json().catch(() => ({}))
-        error.value = err.message ?? t('adminFeature.userForm.errors.updatePermissions')
-        return
-      }
-
-      const libRes = await api(`/api/v1/users/${props.user!.id}/libraries`, {
-        method: 'PUT',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ libraryIds: [...selectedLibraryIds.value] }),
-      })
-      if (!libRes.ok) {
-        const err = await libRes.json().catch(() => ({}))
-        error.value = err.message ?? t('adminFeature.userForm.errors.updateLibraryAccess')
-        return
-      }
-
-      if (!isSuperuserTarget.value) {
-        const cfRes = await api(`/api/v1/users/${props.user!.id}/content-filters`, {
-          method: 'PUT',
-          headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({
-            includeTagIds: includeTagItems.value.map((i) => i.id),
-            excludeTagIds: excludeTagItems.value.map((i) => i.id),
-            includeGenreIds: includeGenreItems.value.map((i) => i.id),
-            excludeGenreIds: excludeGenreItems.value.map((i) => i.id),
-          }),
-        })
-        if (!cfRes.ok) {
-          const err = await cfRes.json().catch(() => ({}))
-          error.value = err.message ?? t('adminFeature.userForm.errors.updateContentFilters')
-          return
-        }
-      }
-    } else {
-      if (!isSharedAccount.value && !trimmedEmail) {
-        error.value = t('adminFeature.userForm.errors.emailRequired')
-        return
-      }
-
-      if (isSharedAccount.value) {
-        const res = await api('/api/v1/users/shared', {
-          method: 'POST',
-          headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({
-            name: name.value,
-            username: username.value,
-            email: trimmedEmail || undefined,
-            permissionNames: [...selectedPermissionNames.value],
-            libraryIds: [...selectedLibraryIds.value],
-          }),
-        })
-        if (!res.ok) {
-          const err = await res.json().catch(() => ({}))
-          error.value = err.message ?? t('adminFeature.userForm.errors.createSharedAccount')
-          return
-        }
-        emit('saved')
-        return
-      }
-
-      const res = await api('/api/v1/users', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-          name: name.value,
-          username: username.value,
-          email: trimmedEmail,
-          permissionNames: [...selectedPermissionNames.value],
-          libraryIds: [...selectedLibraryIds.value],
-        }),
-      })
-      if (!res.ok) {
-        const err = await res.json().catch(() => ({}))
-        error.value = err.message ?? t('adminFeature.userForm.errors.createUser')
-        return
-      }
-      const data = await res.json()
-      emit('saved', data.resetUrl)
-      return
-    }
-
-    emit('saved')
-  } finally {
-    loading.value = false
-  }
-}
-function selectSection(tab: 'general' | 'access' | 'restrictions') {
-  currentTab.value = tab
+function backToSections() {
+  activeSection.value = null
 }
 
-function enableRestrictions() {
-  restrictionsEnabled.value = true
-}
-
-function disableRestrictions() {
-  restrictionsEnabled.value = false
+function handleOpenChange(value: boolean) {
+  if (!value) emit('close')
 }
 
 function handleClose() {
+  open.value = false
   emit('close')
 }
 
-function applyStandardPermissions() {
-  applyPreset('standard')
-}
-
-function applyAdminPermissions() {
-  applyPreset('admin')
-}
-
-function clearPermissions() {
-  applyPreset('clear')
+function handleDelete() {
+  emit('delete')
 }
 
 function requestSuperuserChange() {
   if (!canChangeSuperuser.value) return
   emit('requestSuperuserChange', !isSuperuserTarget.value)
 }
+
+function toggleAllLibraries() {
+  setLibraries(allLibrariesSelected.value ? [] : props.libraries.map((library) => library.id))
+}
+
+async function handleSubmit() {
+  const result = await save()
+  if (!result.ok) {
+    if (result.section) activeSection.value = result.section
+    return
+  }
+  emit('saved', result.resetUrl)
+}
 </script>
 
 <template>
-  <div class="fixed inset-0 z-[60] flex" @click.self="emit('close')">
-    <div class="fixed inset-0 bg-black/40" @click="handleClose" />
-    <div class="relative ml-auto flex h-full w-full max-w-md flex-col bg-card shadow-xl">
-      <div class="flex items-center justify-between px-6 pt-5 pb-4">
-        <div class="flex items-center gap-3">
-          <h2 class="text-base font-semibold text-foreground">
-            {{
-              isEdit
-                ? name || username || t('adminFeature.userForm.editUser')
-                : isSharedAccount
-                  ? t('adminFeature.userForm.createSharedAccount')
-                  : t('adminFeature.userForm.createUser')
-            }}
-          </h2>
-          <Badge
-            v-if="isSharedAccount"
-            variant="secondary"
-            class="bg-amber-500/10 text-amber-600 dark:text-amber-400 border-amber-500/20 hover:bg-amber-500/20"
-            >{{ t('adminFeature.userForm.sharedBadge') }}</Badge
-          >
-          <div v-if="isEdit" class="flex items-center gap-2">
-            <ToggleSwitch v-model="active" />
-            <span class="text-xs text-muted-foreground">{{ active ? t('adminFeature.userForm.active') : t('adminFeature.userForm.suspended') }}</span>
-          </div>
-        </div>
-        <Button variant="ghost" size="icon-sm" @click="handleClose">
-          <X :size="16" />
+  <Sheet :open="open" @update:open="handleOpenChange">
+    <SheetContent :side="side" hide-close class="gap-0 p-0" :class="sizeClass">
+      <SheetTitle class="sr-only">{{ headerTitle }}</SheetTitle>
+      <SheetDescription class="sr-only">{{ t('adminFeature.userForm.drawerDescription') }}</SheetDescription>
+
+      <header class="flex shrink-0 items-center gap-3 border-b border-border px-4 py-3 sm:px-5">
+        <Button v-if="showBackButton" variant="ghost" size="icon-sm" type="button" :aria-label="t('common.back')" @click="backToSections">
+          <ChevronLeft :size="18" aria-hidden="true" />
         </Button>
-      </div>
-
-      <div class="px-6 border-b border-border flex gap-6">
-        <button
-          type="button"
-          v-for="tab in ['general', 'access', 'restrictions'] as const"
-          :key="tab"
-          class="pb-3 text-sm font-medium border-b-2 transition-colors capitalize"
-          :class="currentTab === tab ? 'border-primary text-foreground' : 'border-transparent text-muted-foreground hover:text-foreground'"
-          @click="selectSection(tab)"
+        <span
+          v-else-if="isEdit"
+          aria-hidden="true"
+          class="flex size-9 shrink-0 items-center justify-center rounded-full bg-primary/15 text-sm font-semibold text-primary"
         >
-          {{ t(`adminFeature.userForm.tabs.${tab}`) }}
-        </button>
-      </div>
+          {{ avatarInitial }}
+        </span>
 
-      <form @submit.prevent="handleSubmit" class="flex-1 overflow-y-auto px-6 py-6 space-y-5">
-        <div v-if="currentTab === 'general'" class="space-y-5">
-          <div v-if="!isEdit" class="rounded-md border border-border px-4 py-3">
-            <label class="flex items-start gap-3 cursor-pointer">
-              <input id="isShared" v-model="isSharedAccount" type="checkbox" class="mt-0.5 h-4 w-4 rounded border-input" />
-              <div>
-                <p class="text-sm font-medium text-foreground">{{ t('adminFeature.userForm.sharedAccount') }}</p>
-                <p class="text-xs text-muted-foreground mt-0.5">{{ t('adminFeature.userForm.sharedAccountHint') }}</p>
-              </div>
-            </label>
-          </div>
-          <div v-else-if="isSharedAccount" class="rounded-md border border-amber-500/30 bg-amber-500/5 px-4 py-3">
-            <p class="text-sm text-amber-600 dark:text-amber-400 font-medium">{{ t('adminFeature.userForm.sharedAccount') }}</p>
-            <p class="text-xs text-muted-foreground mt-0.5">{{ t('adminFeature.userForm.sharedAccountManageHint') }}</p>
-          </div>
-
-          <div v-if="!isEdit" class="space-y-1.5">
-            <label class="settings-label">{{ t('adminFeature.userForm.username') }}</label>
-            <input
-              v-model="username"
-              type="text"
-              required
-              class="w-full rounded-md border border-input bg-background px-3 py-2 text-sm text-foreground focus:outline-none focus:ring-2 focus:ring-primary/50"
-            />
-          </div>
-          <div class="space-y-1.5">
-            <label class="settings-label">{{ t('adminFeature.userForm.fullName') }}</label>
-            <input
-              v-model="name"
-              type="text"
-              required
-              class="w-full rounded-md border border-input bg-background px-3 py-2 text-sm text-foreground focus:outline-none focus:ring-2 focus:ring-primary/50"
-            />
-          </div>
-          <div class="space-y-1.5">
-            <label class="settings-label">
-              {{ t('adminFeature.userForm.email') }}
-              <span v-if="isSharedAccount && !isEdit" class="text-muted-foreground font-normal">{{ t('adminFeature.userForm.optional') }}</span>
-            </label>
-            <input
-              v-model="email"
-              type="email"
-              :required="!isEdit && !isSharedAccount"
-              class="w-full rounded-md border border-input bg-background px-3 py-2 text-sm text-foreground focus:outline-none focus:ring-2 focus:ring-primary/50"
-            />
+        <div class="min-w-0 flex-1">
+          <div class="flex items-center gap-2">
+            <h2 class="truncate text-base font-semibold text-foreground">{{ showBackButton ? activeSectionLabel : headerTitle }}</h2>
+            <StatusPill v-if="isEdit && !showBackButton" :tone="active ? 'success' : 'danger'" class="shrink-0">
+              {{ active ? t('adminFeature.userForm.active') : t('adminFeature.userForm.suspended') }}
+            </StatusPill>
+            <Badge v-if="isSharedAccount && !showBackButton" variant="secondary" class="shrink-0">
+              {{ t('adminFeature.userForm.sharedBadge') }}
+            </Badge>
           </div>
+          <p v-if="showBackButton" class="mt-0.5 truncate text-xs text-muted-foreground">{{ headerTitle }}</p>
+          <p v-else-if="isEdit" class="mt-0.5 flex min-w-0 items-center gap-2 text-xs text-muted-foreground">
+            <span class="truncate font-mono">@{{ username }}</span>
+            <template v-if="email">
+              <span aria-hidden="true">&middot;</span>
+              <span class="truncate">{{ email }}</span>
+            </template>
+            <template v-if="isWide">
+              <span aria-hidden="true">&middot;</span>
+              <span class="shrink-0">{{ signInMethod }}</span>
+            </template>
+          </p>
+          <p v-else class="mt-0.5 text-xs text-muted-foreground">{{ t('adminFeature.userForm.createHint') }}</p>
         </div>
 
-        <div v-if="currentTab === 'access'" class="space-y-6">
-          <section
-            v-if="isEdit && canManageSuperuser"
-            aria-labelledby="superuser-access-heading"
-            class="rounded-lg border border-border bg-muted p-4"
-          >
-            <div class="flex items-start gap-3">
-              <div class="flex size-9 shrink-0 items-center justify-center rounded-full bg-primary/10">
-                <ShieldCheck :size="18" class="text-primary" aria-hidden="true" />
+        <Button variant="ghost" size="icon-sm" type="button" :aria-label="t('common.close')" @click="handleClose">
+          <X :size="16" aria-hidden="true" />
+        </Button>
+      </header>
+
+      <div class="flex min-h-0 flex-1">
+        <nav v-if="isWide" :aria-label="t('adminFeature.userForm.sectionsLabel')" class="w-52 shrink-0 border-e border-border bg-card p-2.5">
+          <ul class="space-y-0.5">
+            <li v-for="section in sections" :key="section.id">
+              <button
+                type="button"
+                class="flex w-full items-start gap-2.5 rounded-lg px-2.5 py-2 text-start transition-colors"
+                :class="activeSection === section.id ? 'bg-primary/10' : 'hover:bg-muted'"
+                :aria-current="activeSection === section.id ? 'true' : undefined"
+                @click="selectSection(section.id)"
+              >
+                <component
+                  :is="section.icon"
+                  :size="15"
+                  class="mt-0.5 shrink-0"
+                  :class="activeSection === section.id ? 'text-primary' : 'text-muted-foreground'"
+                  aria-hidden="true"
+                />
+                <span class="min-w-0">
+                  <span class="block truncate text-sm font-medium" :class="activeSection === section.id ? 'text-primary' : 'text-foreground'">
+                    {{ section.label }}
+                  </span>
+                  <span class="mt-0.5 block truncate text-xs text-muted-foreground">{{ section.summary }}</span>
+                </span>
+              </button>
+            </li>
+          </ul>
+        </nav>
+
+        <div class="@container min-w-0 flex-1 overflow-y-auto p-4 sm:p-5">
+          <ul v-if="showSectionMenu" class="space-y-2">
+            <li v-for="section in sections" :key="section.id">
+              <button
+                type="button"
+                class="flex w-full items-center gap-3 rounded-lg border border-border bg-card px-3 py-3 text-start"
+                @click="selectSection(section.id)"
+              >
+                <component :is="section.icon" :size="17" class="shrink-0 text-muted-foreground" aria-hidden="true" />
+                <span class="min-w-0 flex-1">
+                  <span class="block truncate text-sm font-medium text-foreground">{{ section.label }}</span>
+                  <span class="mt-0.5 block truncate text-xs text-muted-foreground">{{ section.summary }}</span>
+                </span>
+                <ChevronRight :size="16" class="shrink-0 text-muted-foreground" aria-hidden="true" />
+              </button>
+            </li>
+          </ul>
+
+          <section v-else-if="activeSection === 'profile'" class="space-y-5">
+            <label v-if="!isEdit" class="flex cursor-pointer items-start gap-3 rounded-lg border border-border bg-card px-3 py-2.5">
+              <input v-model="isSharedAccount" type="checkbox" class="mt-0.5 size-4 shrink-0 rounded border-input accent-primary" />
+              <span>
+                <span class="block text-sm font-medium text-foreground">{{ t('adminFeature.userForm.sharedAccount') }}</span>
+                <span class="settings-hint block">{{ t('adminFeature.userForm.sharedAccountHint') }}</span>
+              </span>
+            </label>
+
+            <div class="grid gap-3 @lg:grid-cols-2">
+              <div class="space-y-1.5">
+                <label for="user-form-name" class="settings-label block">{{ t('adminFeature.userForm.fullName') }}</label>
+                <input
+                  id="user-form-name"
+                  v-model="name"
+                  type="text"
+                  required
+                  class="h-9 w-full rounded-lg border border-input bg-background px-3 text-sm text-foreground focus:outline-none focus:ring-2 focus:ring-primary/50"
+                />
               </div>
-              <div class="min-w-0 flex-1">
-                <div class="flex flex-wrap items-center gap-2">
-                  <h3 id="superuser-access-heading" class="text-sm font-semibold text-foreground">
-                    {{ t('adminFeature.userForm.superuserAccess.title') }}
-                  </h3>
-                  <Badge variant="secondary">
-                    {{ isSuperuserTarget ? t('adminFeature.userForm.superuserAccess.enabled') : t('adminFeature.userForm.superuserAccess.disabled') }}
-                  </Badge>
+              <div class="space-y-1.5">
+                <label for="user-form-username" class="settings-label block">{{ t('adminFeature.userForm.username') }}</label>
+                <input
+                  id="user-form-username"
+                  v-model="username"
+                  type="text"
+                  required
+                  :readonly="isEdit"
+                  class="h-9 w-full rounded-lg border border-input px-3 text-sm focus:outline-none focus:ring-2 focus:ring-primary/50"
+                  :class="isEdit ? 'bg-muted text-muted-foreground' : 'bg-background text-foreground'"
+                />
+                <p v-if="isEdit" class="settings-hint">{{ t('adminFeature.userForm.usernameFixedHint') }}</p>
+              </div>
+            </div>
+
+            <div class="space-y-1.5">
+              <label for="user-form-email" class="settings-label block">
+                {{ t('adminFeature.userForm.email') }}
+                <span v-if="isSharedAccount && !isEdit" class="font-normal text-muted-foreground">{{ t('adminFeature.userForm.optional') }}</span>
+              </label>
+              <input
+                id="user-form-email"
+                v-model="email"
+                type="email"
+                :required="!isEdit && !isSharedAccount"
+                class="h-9 w-full rounded-lg border border-input bg-background px-3 text-sm text-foreground focus:outline-none focus:ring-2 focus:ring-primary/50"
+              />
+              <p class="settings-hint">{{ t('adminFeature.userForm.emailHint') }}</p>
+            </div>
+
+            <div v-if="isEdit">
+              <h3 class="settings-group-label">{{ t('adminFeature.userForm.account') }}</h3>
+              <dl class="divide-y divide-border rounded-lg border border-border bg-card">
+                <div class="flex flex-wrap items-center gap-x-3 gap-y-1 px-3 py-2.5">
+                  <dt id="user-form-status" class="w-24 shrink-0 text-xs text-muted-foreground">{{ t('adminFeature.userForm.status') }}</dt>
+                  <dd class="flex items-center gap-2.5">
+                    <ToggleSwitch v-model="active" aria-labelledby="user-form-status" />
+                    <span class="text-sm text-foreground">{{
+                      active ? t('adminFeature.userForm.active') : t('adminFeature.userForm.suspended')
+                    }}</span>
+                  </dd>
+                  <dd class="settings-hint w-full @lg:ms-auto @lg:mt-0 @lg:w-auto">{{ t('adminFeature.userForm.statusHint') }}</dd>
                 </div>
-                <p class="mt-1 text-xs leading-5 text-muted-foreground">
-                  {{
-                    isOwnAccount
-                      ? t('adminFeature.userForm.superuserAccess.selfHint')
-                      : isSharedAccount
-                        ? t('adminFeature.userForm.superuserAccess.sharedHint')
-                        : isSuperuserTarget
-                          ? t('adminFeature.userForm.superuserAccess.enabledHint')
-                          : t('adminFeature.userForm.superuserAccess.disabledHint')
-                  }}
-                </p>
-                <Button
-                  v-if="canChangeSuperuser"
-                  :variant="isSuperuserTarget ? 'destructive' : 'outline'"
-                  size="sm"
-                  type="button"
-                  class="mt-3"
-                  @click="requestSuperuserChange"
-                >
-                  {{ isSuperuserTarget ? t('adminFeature.userForm.superuserAccess.demote') : t('adminFeature.userForm.superuserAccess.promote') }}
-                </Button>
+                <div class="flex flex-wrap items-center gap-x-3 gap-y-1 px-3 py-2.5">
+                  <dt class="w-24 shrink-0 text-xs text-muted-foreground">{{ t('adminFeature.userForm.signInMethod') }}</dt>
+                  <dd class="text-sm text-foreground">{{ signInMethod }}</dd>
+                </div>
+                <div v-if="createdLabel" class="flex flex-wrap items-center gap-x-3 gap-y-1 px-3 py-2.5">
+                  <dt class="w-24 shrink-0 text-xs text-muted-foreground">{{ t('adminFeature.userForm.created') }}</dt>
+                  <dd class="text-sm text-foreground">{{ createdLabel }}</dd>
+                </div>
+                <div v-if="lockedUntil" class="flex flex-wrap items-center gap-x-3 gap-y-1 px-3 py-2.5">
+                  <dt class="w-24 shrink-0 text-xs text-muted-foreground">{{ t('adminFeature.usersPage.lockedBadge') }}</dt>
+                  <dd class="text-sm text-foreground">{{ t('adminFeature.userForm.lockedUntil', { time: formatDateTime(lockedUntil) }) }}</dd>
+                  <dd class="settings-hint w-full @lg:ms-auto @lg:mt-0 @lg:w-auto">{{ t('adminFeature.userForm.lockedHint') }}</dd>
+                </div>
+              </dl>
+            </div>
+
+            <div v-else-if="isSharedAccount" class="flex gap-3 rounded-lg border border-border bg-card px-3 py-2.5">
+              <ShieldCheck :size="16" class="mt-0.5 shrink-0 text-muted-foreground" aria-hidden="true" />
+              <p class="settings-hint">{{ t('adminFeature.userForm.sharedAccountManageHint') }}</p>
+            </div>
+
+            <div v-if="isEdit && canDelete">
+              <h3 class="settings-group-label">{{ t('adminFeature.userForm.dangerZone') }}</h3>
+              <div class="flex flex-wrap items-center gap-3 rounded-lg border border-destructive/30 bg-card px-3 py-2.5">
+                <div class="min-w-0 flex-1">
+                  <p class="text-sm font-medium text-foreground">{{ t('adminFeature.usersPage.deleteUserAction') }}</p>
+                  <p class="settings-hint">{{ t('adminFeature.userForm.deleteUserHint') }}</p>
+                </div>
+                <Button variant="destructive-outline" size="sm" type="button" @click="handleDelete">{{ t('common.delete') }}</Button>
               </div>
             </div>
           </section>
 
-          <div v-if="libraries.length > 0" class="space-y-3">
-            <label class="settings-label">{{ t('adminFeature.userForm.libraryAccess') }}</label>
-            <div class="space-y-1.5 rounded-md border border-border p-3">
-              <label v-for="lib in libraries" :key="lib.id" class="flex cursor-pointer items-center gap-2">
-                <input
-                  type="checkbox"
-                  :checked="selectedLibraryIds.has(lib.id)"
-                  @change="toggleLibrary(lib.id)"
-                  class="h-4 w-4 rounded border-input"
-                />
-                <span class="text-sm text-foreground">{{ lib.name }}</span>
-              </label>
-            </div>
-            <p v-if="selectedLibraryIds.size === 0" class="text-xs text-muted-foreground">{{ t('adminFeature.userForm.noLibrariesSelected') }}</p>
-          </div>
-
-          <div class="space-y-3">
-            <div class="flex items-center justify-between">
-              <label class="settings-label">{{ t('adminFeature.userForm.permissions') }}</label>
-              <div class="flex items-center gap-2">
-                <Button variant="ghost" size="sm" type="button" @click="applyStandardPermissions">
-                  {{ t('adminFeature.userForm.presetStandard') }}
-                </Button>
-                <span class="text-border">•</span>
-                <Button variant="ghost" size="sm" type="button" @click="applyAdminPermissions">
-                  {{ t('adminFeature.userForm.presetAdmin') }}
-                </Button>
-                <span class="text-border">•</span>
-                <Button variant="ghost" size="sm" type="button" @click="clearPermissions">
-                  {{ t('adminFeature.userForm.presetClearAll') }}
-                </Button>
+          <section v-else-if="activeSection === 'libraries'" class="space-y-3">
+            <div class="flex flex-wrap items-start justify-between gap-x-4 gap-y-2">
+              <div class="min-w-0">
+                <h3 class="settings-label">{{ t('adminFeature.userForm.libraryAccess') }}</h3>
+                <p class="settings-hint">{{ t('adminFeature.userForm.libraryAccessHint') }}</p>
               </div>
-            </div>
-
-            <div class="space-y-5">
-              <div v-for="group in permissionGroups" :key="group.id" class="space-y-2">
-                <p class="text-xs font-medium uppercase tracking-wide text-muted-foreground">{{ group.label }}</p>
-                <div class="grid grid-cols-1 md:grid-cols-2 gap-2">
-                  <label v-for="permName in group.permissions" :key="permName" class="flex cursor-pointer items-start gap-2">
-                    <input
-                      type="checkbox"
-                      :checked="selectedPermissionNames.has(permName)"
-                      @change="togglePermission(permName)"
-                      class="mt-0.5 h-4 w-4 rounded border-input"
-                    />
-                    <span class="text-sm text-foreground leading-tight">{{ permissionLabel(permName) }}</span>
-                  </label>
-                </div>
-              </div>
-            </div>
-          </div>
-        </div>
-
-        <div v-if="currentTab === 'restrictions'" class="space-y-5">
-          <div v-if="isSuperuserTarget" class="rounded-md border border-amber-500/30 bg-amber-500/5 px-4 py-3">
-            <p class="text-sm text-amber-600 dark:text-amber-400 font-medium">{{ t('adminFeature.userForm.superuserTarget') }}</p>
-            <p class="text-xs text-muted-foreground mt-0.5">{{ t('adminFeature.userForm.superuserTargetHint') }}</p>
-          </div>
-          <template v-else>
-            <div
-              v-if="!restrictionsEnabled"
-              class="rounded-md border border-dashed border-border px-4 py-8 text-center flex flex-col items-center gap-3"
-            >
-              <div class="space-y-1">
-                <p class="text-sm font-medium text-foreground">{{ t('adminFeature.userForm.noRestrictions') }}</p>
-                <p class="text-xs text-muted-foreground">{{ t('adminFeature.userForm.noRestrictionsHint') }}</p>
-              </div>
-              <Button variant="secondary" size="sm" type="button" @click="enableRestrictions">
-                {{ t('adminFeature.userForm.addRestrictions') }}
+              <Button v-if="libraries.length > 0" variant="outline" size="sm" type="button" class="shrink-0" @click="toggleAllLibraries">
+                {{ allLibrariesSelected ? t('adminFeature.userForm.clearAll') : t('adminFeature.userForm.selectAll') }}
               </Button>
             </div>
-            <div v-else class="space-y-5">
-              <div class="flex items-center justify-between">
-                <p class="text-sm font-medium text-foreground">{{ t('adminFeature.userForm.contentRestrictions') }}</p>
-                <Button variant="destructive-ghost" size="sm" type="button" v-if="!hasRestrictions" @click="disableRestrictions">
-                  {{ t('adminFeature.userForm.remove') }}
-                </Button>
-              </div>
 
-              <div class="space-y-1.5">
-                <label class="text-xs font-medium text-foreground"
-                  >{{ t('adminFeature.userForm.includeTags') }}
-                  <span class="text-muted-foreground font-normal">{{ t('adminFeature.userForm.includeTagsHint') }}</span></label
+            <p
+              v-if="libraries.length === 0"
+              class="rounded-lg border border-dashed border-border px-4 py-8 text-center text-sm text-muted-foreground"
+            >
+              {{ t('adminFeature.usersPage.defaultLibraryAccess.noLibraries') }}
+            </p>
+            <template v-else>
+              <div class="grid gap-2 @lg:grid-cols-2">
+                <label
+                  v-for="library in libraries"
+                  :key="library.id"
+                  class="flex cursor-pointer items-center gap-2.5 rounded-lg border border-border bg-card px-3 py-2 transition-colors hover:bg-muted focus-within:ring-2 focus-within:ring-ring"
                 >
-                <ContentFilterChipInput
-                  v-model="includeTagItems"
-                  :placeholder="t('adminFeature.userForm.searchTagsPlaceholder')"
-                  :search-fn="searchTags"
-                />
+                  <input
+                    type="checkbox"
+                    :checked="selectedLibraryIds.has(library.id)"
+                    class="size-4 shrink-0 rounded border-input accent-primary"
+                    @change="toggleLibrary(library.id)"
+                  />
+                  <span class="min-w-0 flex-1 truncate text-sm text-foreground">{{ library.name }}</span>
+                  <span v-if="library.bookCount !== undefined" class="shrink-0 text-xs tabular-nums text-muted-foreground">
+                    {{ t('adminFeature.userForm.libraryBookCount', { count: library.bookCount }) }}
+                  </span>
+                </label>
               </div>
-              <div class="space-y-1.5">
-                <label class="text-xs font-medium text-foreground"
-                  >{{ t('adminFeature.userForm.excludeTags') }}
-                  <span class="text-muted-foreground font-normal">{{ t('adminFeature.userForm.excludeTagsHint') }}</span></label
-                >
-                <ContentFilterChipInput
-                  v-model="excludeTagItems"
-                  :placeholder="t('adminFeature.userForm.searchTagsPlaceholder')"
-                  :search-fn="searchTags"
-                />
+              <p v-if="selectedLibraryIds.size === 0" class="flex items-center gap-2 text-xs text-[var(--pill-warning)]">
+                <TriangleAlert :size="14" aria-hidden="true" />
+                {{ t('adminFeature.userForm.noLibrariesSelected') }}
+              </p>
+              <p v-else-if="libraryReach" class="settings-hint">{{ t('adminFeature.userForm.libraryReach', libraryReach) }}</p>
+            </template>
+          </section>
+
+          <section v-else-if="activeSection === 'permissions'" class="space-y-5">
+            <section
+              v-if="isEdit && canManageSuperuser"
+              aria-labelledby="superuser-access-heading"
+              class="rounded-lg border border-border bg-muted p-4"
+            >
+              <div class="flex items-start gap-3">
+                <div class="flex size-9 shrink-0 items-center justify-center rounded-full bg-primary/10">
+                  <ShieldCheck :size="18" class="text-primary" aria-hidden="true" />
+                </div>
+                <div class="min-w-0 flex-1">
+                  <div class="flex flex-wrap items-center gap-2">
+                    <h3 id="superuser-access-heading" class="text-sm font-semibold text-foreground">
+                      {{ t('adminFeature.userForm.superuserAccess.title') }}
+                    </h3>
+                    <Badge variant="secondary">
+                      {{
+                        isSuperuserTarget ? t('adminFeature.userForm.superuserAccess.enabled') : t('adminFeature.userForm.superuserAccess.disabled')
+                      }}
+                    </Badge>
+                  </div>
+                  <p class="mt-1 text-xs leading-5 text-muted-foreground">
+                    {{
+                      isOwnAccount
+                        ? t('adminFeature.userForm.superuserAccess.selfHint')
+                        : isSharedAccount
+                          ? t('adminFeature.userForm.superuserAccess.sharedHint')
+                          : isSuperuserTarget
+                            ? t('adminFeature.userForm.superuserAccess.enabledHint')
+                            : t('adminFeature.userForm.superuserAccess.disabledHint')
+                    }}
+                  </p>
+                  <Button
+                    v-if="canChangeSuperuser"
+                    :variant="isSuperuserTarget ? 'destructive' : 'outline'"
+                    size="sm"
+                    type="button"
+                    class="mt-3"
+                    @click="requestSuperuserChange"
+                  >
+                    {{ isSuperuserTarget ? t('adminFeature.userForm.superuserAccess.demote') : t('adminFeature.userForm.superuserAccess.promote') }}
+                  </Button>
+                </div>
               </div>
-              <div class="space-y-1.5">
-                <label class="text-xs font-medium text-foreground"
-                  >{{ t('adminFeature.userForm.includeGenres') }}
-                  <span class="text-muted-foreground font-normal">{{ t('adminFeature.userForm.includeGenresHint') }}</span></label
-                >
-                <ContentFilterChipInput
-                  v-model="includeGenreItems"
-                  :placeholder="t('adminFeature.userForm.searchGenresPlaceholder')"
-                  :search-fn="searchGenres"
-                />
-              </div>
-              <div class="space-y-1.5">
-                <label class="text-xs font-medium text-foreground"
-                  >{{ t('adminFeature.userForm.excludeGenres') }}
-                  <span class="text-muted-foreground font-normal">{{ t('adminFeature.userForm.excludeGenresHint') }}</span></label
-                >
-                <ContentFilterChipInput
-                  v-model="excludeGenreItems"
-                  :placeholder="t('adminFeature.userForm.searchGenresPlaceholder')"
-                  :search-fn="searchGenres"
-                />
-              </div>
-            </div>
-          </template>
+            </section>
+
+            <UserPermissionsSection
+              :selected="selectedPermissionNames"
+              :granted="grantedCount"
+              :total="totalPermissions"
+              @toggle="togglePermission"
+              @preset="applyPreset"
+            />
+          </section>
+
+          <UserRestrictionsSection
+            v-else-if="activeSection === 'restrictions'"
+            v-model:include-tags="includeTagItems"
+            v-model:exclude-tags="excludeTagItems"
+            v-model:include-genres="includeGenreItems"
+            v-model:exclude-genres="excludeGenreItems"
+            v-model:see-own-requested-books="seeOwnRequestedBooks"
+            :is-edit="isEdit"
+            :is-superuser-target="isSuperuserTarget"
+            :selected="selectedPermissionNames"
+            :content-filters-enabled="contentFiltersEnabled"
+            @toggle="togglePermission"
+            @update:content-filters-enabled="setContentFiltersEnabled"
+          />
         </div>
-
-        <div v-if="error" class="text-sm text-destructive">{{ error }}</div>
-      </form>
-
-      <div class="border-t border-border px-6 py-4 flex gap-3 justify-end mt-auto bg-card">
-        <Button variant="outline" size="sm" @click="handleClose" type="button">
-          {{ t('common.cancel') }}
-        </Button>
-        <Button size="sm" @click="handleSubmit" type="button" :disabled="loading">
-          {{ loading ? t('adminFeature.userForm.saving') : t('common.save') }}
-        </Button>
       </div>
-    </div>
-  </div>
+
+      <footer class="flex shrink-0 flex-wrap items-center gap-x-3 gap-y-2 border-t border-border px-4 py-3 sm:px-5">
+        <p v-if="errorMessage" role="alert" class="min-w-0 flex-1 basis-full text-sm text-destructive md:basis-auto">{{ errorMessage }}</p>
+        <p v-else-if="changeCount > 0" class="flex min-w-0 flex-1 basis-full items-center gap-2 text-xs text-[var(--pill-warning)] md:basis-auto">
+          <TriangleAlert :size="14" class="shrink-0" aria-hidden="true" />
+          <span class="truncate">{{ t('adminFeature.userForm.unsavedChanges', { count: changeCount }) }}</span>
+        </p>
+        <span v-else class="hidden flex-1 md:block" />
+        <div class="flex w-full gap-2 md:ms-auto md:w-auto">
+          <Button variant="outline" size="sm" type="button" class="flex-1 md:flex-none" @click="handleClose">{{ t('common.cancel') }}</Button>
+          <Button size="sm" type="button" class="flex-1 md:flex-none" :disabled="loading" @click="handleSubmit">
+            {{ loading ? t('adminFeature.userForm.saving') : t('common.save') }}
+          </Button>
+        </div>
+      </footer>
+    </SheetContent>
+  </Sheet>
 </template>
diff --git a/client/src/features/admin/UsersPage.vue b/client/src/features/admin/UsersPage.vue
index 0078ce90c..5c8d880aa 100644
--- a/client/src/features/admin/UsersPage.vue
+++ b/client/src/features/admin/UsersPage.vue
@@ -2,7 +2,7 @@
 import { computed, onMounted, ref } from 'vue'
 import { useI18n } from 'vue-i18n'
 import { Search, TriangleAlert, UserPlus, X } from '@lucide/vue'
-import { Permission, type AuthUser, type DefaultLibraryAccessConfig, type UserListSortField, type UserListState } from '@bookorbit/types'
+import { Permission, type DefaultLibraryAccessConfig, type UserListSortField, type UserListState } from '@bookorbit/types'
 
 import { Button } from '@/components/ui/button'
 import ConfirmDialog from '@/components/ui/ConfirmDialog.vue'
@@ -55,7 +55,7 @@ const {
 } = useUsers()
 
 const drawerOpen = ref(false)
-const editingUser = ref<Partial<AuthUser> | null>(null)
+const editingUser = ref<UserRow | null>(null)
 const resetUrl = ref<string | null>(null)
 const deleteConfirmUser = ref<UserRow | null>(null)
 const superuserConfirm = ref<{ user: UserRow; isSuperuser: boolean } | null>(null)
@@ -163,6 +163,16 @@ function openById(userId: number) {
   if (match) openEdit(match)
 }
 
+const canDeleteEditingUser = computed(() => !!editingUser.value && canManage(editingUser.value))
+
+/** Deleting from inside the editor closes it first: the confirm is the page's, and so is the list. */
+function handleDrawerDelete() {
+  const user = editingUser.value
+  if (!user) return
+  drawerOpen.value = false
+  requestDeleteUser(user)
+}
+
 function closeDrawer() {
   drawerOpen.value = false
 }
@@ -512,9 +522,11 @@ async function saveDefaultLibraryAccess() {
       :default-library-ids="defaultLibraryIdsArray"
       :can-manage-superuser="isSuperuser"
       :current-user-id="currentUser?.id"
+      :can-delete="canDeleteEditingUser"
       @close="closeDrawer"
       @saved="onSaved"
       @request-superuser-change="requestSuperuserChange"
+      @delete="handleDrawerDelete"
     />
     <ResetLinkModal v-if="resetUrl" :reset-url="resetUrl" @close="clearResetUrl" />
 
diff --git a/client/src/features/admin/__tests__/UserFormDrawer.spec.ts b/client/src/features/admin/__tests__/UserFormDrawer.spec.ts
new file mode 100644
index 000000000..79f82e6c7
--- /dev/null
+++ b/client/src/features/admin/__tests__/UserFormDrawer.spec.ts
@@ -0,0 +1,301 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { flushPromises, mount } from '@vue/test-utils'
+import { Permission } from '@bookorbit/types'
+import UserFormDrawer from '../UserFormDrawer.vue'
+
+const { apiMock } = vi.hoisted(() => ({
+  apiMock: vi.fn<(input: string, init?: RequestInit) => Promise<unknown>>(),
+}))
+
+vi.mock('@/lib/api', () => ({ api: apiMock }))
+
+// The sheet portals its content out of the wrapper, which puts every assertion behind
+// `document`. Stubbing it keeps the markup under test where Test Utils can see it.
+vi.mock('@/components/ui/sheet', () => ({
+  Sheet: { template: '<div><slot /></div>' },
+  SheetContent: { template: '<div><slot /></div>' },
+  SheetTitle: { template: '<h2><slot /></h2>' },
+  SheetDescription: { template: '<p><slot /></p>' },
+}))
+
+const LIBRARIES = [
+  { id: 1, name: 'Novels', bookCount: 120 },
+  { id: 2, name: 'Comics', bookCount: 30 },
+  { id: 3, name: 'Podcasts', bookCount: 0 },
+]
+
+const USER = {
+  id: 7,
+  username: 'ada',
+  name: 'Ada Lovelace',
+  email: 'ada@example.com',
+  active: true,
+  isSuperuser: false,
+  provisioningMethod: 'local' as const,
+  createdAt: '2026-03-14T10:00:00.000Z',
+  permissions: [Permission.LibraryDownload, Permission.KoboSync] as string[],
+}
+
+function jsonResponse(body: unknown) {
+  return { ok: true, json: async () => body }
+}
+
+function stubApi(overrides: { libraryIds?: number[]; filters?: unknown } = {}) {
+  apiMock.mockImplementation(async (input: string) => {
+    if (input.endsWith('/libraries')) return jsonResponse(overrides.libraryIds ?? [1])
+    if (input.endsWith('/content-filters')) {
+      return jsonResponse(overrides.filters ?? { includeTags: [], excludeTags: [], includeGenres: [], excludeGenres: [] })
+    }
+    return jsonResponse({})
+  })
+}
+
+/** The drawer reads the viewport to decide between the section rail and the drill-in list. */
+function stubViewport(wide: boolean) {
+  window.matchMedia = vi.fn<(query: string) => unknown>().mockImplementation((query: string) => ({
+    matches: query.includes('min-width') ? wide : !wide,
+    media: query,
+    onchange: null,
+    addEventListener: vi.fn<() => void>(),
+    removeEventListener: vi.fn<() => void>(),
+    addListener: vi.fn<() => void>(),
+    removeListener: vi.fn<() => void>(),
+    dispatchEvent: vi.fn<() => void>(),
+  })) as unknown as typeof window.matchMedia
+}
+
+type Drawer = ReturnType<typeof mount>
+
+async function mountDrawer(props: Record<string, unknown> = {}): Promise<Drawer> {
+  const wrapper = mount(UserFormDrawer, {
+    props: { user: USER, libraries: LIBRARIES, defaultLibraryIds: [], ...props },
+  })
+  await flushPromises()
+  return wrapper
+}
+
+async function openSection(wrapper: Drawer, label: string) {
+  const entry = wrapper.findAll('button').find((button) => button.text().includes(label))
+  await entry?.trigger('click')
+  await flushPromises()
+}
+
+function checkboxFor(wrapper: Drawer, label: string) {
+  const field = wrapper.findAll('label').find((candidate) => candidate.text().includes(label))
+  return field?.find<HTMLInputElement>('input[type="checkbox"]')
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  stubViewport(true)
+  stubApi()
+})
+
+describe('UserFormDrawer sections', () => {
+  it('summarises every section beside its nav entry', async () => {
+    const wrapper = await mountDrawer()
+    const nav = wrapper.find('nav').text()
+
+    expect(nav).toContain('Profile')
+    expect(nav).toContain('1 of 3')
+    expect(nav).toContain('2 granted')
+    expect(nav).toContain('None')
+  })
+
+  it('reports the account facts the list row only hints at', async () => {
+    const wrapper = await mountDrawer()
+
+    expect(wrapper.text()).toContain('Password')
+    expect(wrapper.text()).toContain('2026')
+    expect(wrapper.find('button[role="switch"]').attributes('aria-checked')).toBe('true')
+  })
+
+  it('offers the drill-in list instead of the rail on a narrow viewport', async () => {
+    stubViewport(false)
+    const wrapper = await mountDrawer()
+
+    expect(wrapper.find('nav').exists()).toBe(false)
+    expect(wrapper.text()).toContain('Libraries')
+    expect(wrapper.text()).not.toContain('Full name')
+
+    await openSection(wrapper, 'Profile')
+    expect(wrapper.text()).toContain('Full name')
+  })
+
+  it('reports how much of the library the selection reaches', async () => {
+    const wrapper = await mountDrawer()
+    await openSection(wrapper, 'Libraries')
+
+    expect(wrapper.text()).toContain('120 books')
+    expect(wrapper.text()).toContain('This account can see 120 of 150 books.')
+  })
+
+  it('warns when no library is selected at all', async () => {
+    stubApi({ libraryIds: [] })
+    const wrapper = await mountDrawer()
+    await openSection(wrapper, 'Libraries')
+
+    expect(wrapper.text()).toContain('No libraries selected')
+  })
+})
+
+describe('UserFormDrawer permissions', () => {
+  it('tags the elevated permissions rather than heading every group twice', async () => {
+    const wrapper = await mountDrawer()
+    await openSection(wrapper, 'Permissions')
+
+    const deleteBooks = wrapper.findAll('label').find((label) => label.text().includes('Delete books'))
+    expect(deleteBooks?.text()).toContain('Manage')
+    expect(wrapper.text()).toContain('What this account is allowed to do. 2 of 26 granted.')
+  })
+
+  it('reports the preset the selection matches', async () => {
+    const wrapper = await mountDrawer({
+      user: { ...USER, permissions: [Permission.LibraryDownload, Permission.KoboSync, Permission.KoreaderSync] },
+    })
+    await openSection(wrapper, 'Permissions')
+
+    const custom = wrapper.findAll('button').find((button) => button.text() === 'Custom')
+    expect(custom?.attributes('aria-pressed')).toBe('true')
+    expect(custom?.attributes('disabled')).toBeDefined()
+  })
+
+  it('keeps a demo restriction when a preset is applied', async () => {
+    const wrapper = await mountDrawer({ user: { ...USER, permissions: [Permission.DemoRestricted] } })
+    await openSection(wrapper, 'Permissions')
+
+    const standard = wrapper.findAll('button').find((button) => button.text() === 'Standard')
+    await standard?.trigger('click')
+    await openSection(wrapper, 'Restrictions')
+
+    expect(checkboxFor(wrapper, 'Demo restricted')?.element.checked).toBe(true)
+  })
+
+  /** The server resolves this dependency on assignment, so the boxes have to agree with it. */
+  it('grants the permission that self-fulfilment depends on', async () => {
+    const wrapper = await mountDrawer()
+    await openSection(wrapper, 'Permissions')
+
+    await checkboxFor(wrapper, 'Download books directly')?.trigger('change')
+
+    expect(checkboxFor(wrapper, 'Request books')?.element.checked).toBe(true)
+  })
+
+  it('drops the dependent permission when its requirement is revoked', async () => {
+    const wrapper = await mountDrawer({
+      user: { ...USER, permissions: [Permission.BookRequestAccess, Permission.BookRequestSelfFulfill] },
+    })
+    await openSection(wrapper, 'Permissions')
+
+    await checkboxFor(wrapper, 'Request books')?.trigger('change')
+
+    expect(checkboxFor(wrapper, 'Download books directly')?.element.checked).toBe(false)
+  })
+
+  it('filters the grid down to matching permissions', async () => {
+    const wrapper = await mountDrawer()
+    await openSection(wrapper, 'Permissions')
+
+    await wrapper.find('input[type="search"]').setValue('kobo')
+
+    expect(wrapper.text()).toContain('Kobo sync')
+    expect(wrapper.text()).not.toContain('Upload books')
+  })
+
+  it('says so when a filter matches nothing', async () => {
+    const wrapper = await mountDrawer()
+    await openSection(wrapper, 'Permissions')
+
+    await wrapper.find('input[type="search"]').setValue('nothing matches this')
+
+    expect(wrapper.text()).toContain('No permissions match that filter.')
+  })
+})
+
+describe('UserFormDrawer saving', () => {
+  it('counts the fields a cancel would throw away', async () => {
+    const wrapper = await mountDrawer()
+    await openSection(wrapper, 'Permissions')
+    await checkboxFor(wrapper, 'Upload books')?.trigger('change')
+
+    expect(wrapper.text()).toContain('1 unsaved change')
+
+    await openSection(wrapper, 'Libraries')
+    await checkboxFor(wrapper, 'Comics')?.trigger('change')
+
+    expect(wrapper.text()).toContain('2 unsaved changes')
+  })
+
+  it('writes the profile, permissions, libraries and filters of an existing user', async () => {
+    const wrapper = await mountDrawer()
+    const save = wrapper.findAll('button').find((button) => button.text() === 'Save')
+    await save?.trigger('click')
+    await flushPromises()
+
+    const calls = apiMock.mock.calls.map(([input, init]) => `${(init as RequestInit)?.method ?? 'GET'} ${input}`)
+    expect(calls).toContain('PATCH /api/v1/users/7')
+    expect(calls).toContain('PUT /api/v1/users/7/permissions')
+    expect(calls).toContain('PUT /api/v1/users/7/libraries')
+    expect(calls).toContain('PUT /api/v1/users/7/content-filters')
+    expect(wrapper.emitted('saved')).toHaveLength(1)
+  })
+
+  it('surfaces a failed step and moves to the section that owns it', async () => {
+    apiMock.mockImplementation(async (input: string, init?: RequestInit) => {
+      if (input.endsWith('/permissions') && init?.method === 'PUT') {
+        return { ok: false, json: async () => ({ message: 'Permission denied' }) }
+      }
+      if (input.endsWith('/libraries')) return jsonResponse([1])
+      if (input.endsWith('/content-filters')) return jsonResponse({})
+      return jsonResponse({})
+    })
+
+    const wrapper = await mountDrawer()
+    const save = wrapper.findAll('button').find((button) => button.text() === 'Save')
+    await save?.trigger('click')
+    await flushPromises()
+
+    expect(wrapper.find('[role="alert"]').text()).toBe('Permission denied')
+    expect(wrapper.find('input[type="search"]').exists()).toBe(true)
+    expect(wrapper.emitted('saved')).toBeUndefined()
+  })
+
+  it('blocks a create with no name and lands back on the field', async () => {
+    const wrapper = await mountDrawer({ user: null })
+    await openSection(wrapper, 'Permissions')
+
+    const save = wrapper.findAll('button').find((button) => button.text() === 'Save')
+    await save?.trigger('click')
+    await flushPromises()
+
+    expect(wrapper.find('[role="alert"]').text()).toBe('Full name is required')
+    expect(wrapper.text()).toContain('Full name')
+    expect(apiMock).not.toHaveBeenCalled()
+  })
+
+  it('creates a password account and hands back its reset link', async () => {
+    apiMock.mockImplementation(async (input: string) => {
+      if (input === '/api/v1/users') return jsonResponse({ resetUrl: 'https://example.test/reset/abc' })
+      return jsonResponse({})
+    })
+
+    const wrapper = await mountDrawer({ user: null })
+    await wrapper.find('#user-form-name').setValue('Grace Hopper')
+    await wrapper.find('#user-form-username').setValue('grace')
+    await wrapper.find('#user-form-email').setValue('grace@example.com')
+
+    const save = wrapper.findAll('button').find((button) => button.text() === 'Save')
+    await save?.trigger('click')
+    await flushPromises()
+
+    expect(wrapper.emitted('saved')?.[0]).toEqual(['https://example.test/reset/abc'])
+  })
+
+  it('asks the page to delete rather than confirming inside the editor', async () => {
+    const wrapper = await mountDrawer({ canDelete: true })
+    const remove = wrapper.findAll('button').find((button) => button.text() === 'Delete')
+    await remove?.trigger('click')
+
+    expect(wrapper.emitted('delete')).toHaveLength(1)
+  })
+})
diff --git a/client/src/features/admin/__tests__/UsersPage.spec.ts b/client/src/features/admin/__tests__/UsersPage.spec.ts
index 9f6fa9760..5f211210c 100644
--- a/client/src/features/admin/__tests__/UsersPage.spec.ts
+++ b/client/src/features/admin/__tests__/UsersPage.spec.ts
@@ -2,6 +2,7 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { computed } from 'vue'
 import { flushPromises, mount, shallowMount } from '@vue/test-utils'
 import UsersPage from '../UsersPage.vue'
+import UserRosterTable from '../components/UserRosterTable.vue'
 
 const { apiMock, authState, permState } = vi.hoisted(() => ({
   apiMock: vi.fn<(input: string, init?: RequestInit) => Promise<unknown>>(),
@@ -11,6 +12,13 @@ const { apiMock, authState, permState } = vi.hoisted(() => ({
 
 vi.mock('@/lib/api', () => ({ api: apiMock }))
 
+vi.mock('@/components/ui/sheet', () => ({
+  Sheet: { template: '<div><slot /></div>' },
+  SheetContent: { template: '<div><slot /></div>' },
+  SheetTitle: { template: '<h2><slot /></h2>' },
+  SheetDescription: { template: '<p><slot /></p>' },
+}))
+
 vi.mock('@/features/auth/composables/usePermissions', () => ({
   usePermissions: () => ({
     isSuperuser: computed(() => permState.isSuperuser),
@@ -100,10 +108,10 @@ function stateButton(wrapper: ReturnType<typeof mount>, label: string) {
 }
 
 async function openUserAccess(wrapper: ReturnType<typeof mount>) {
-  const edit = wrapper.findAll('button').find((button) => button.text().trim() === 'Edit')
-  await edit?.trigger('click')
+  const roster = wrapper.findComponent(UserRosterTable)
+  roster.vm.$emit('edit', roster.props('users')[0])
   await flushPromises()
-  const access = wrapper.findAll('button').find((button) => button.text().trim() === 'access')
+  const access = wrapper.findAll('button').find((button) => button.text().trim().startsWith('Permissions'))
   await access?.trigger('click')
   await flushPromises()
 }
diff --git a/client/src/features/admin/components/UserPermissionsSection.vue b/client/src/features/admin/components/UserPermissionsSection.vue
new file mode 100644
index 000000000..689df5526
--- /dev/null
+++ b/client/src/features/admin/components/UserPermissionsSection.vue
@@ -0,0 +1,239 @@
+<script setup lang="ts">
+import { computed, ref } from 'vue'
+import { useI18n } from 'vue-i18n'
+import { Search } from '@lucide/vue'
+import { Permission, PERMISSION_LABELS } from '@bookorbit/types'
+import { formatNumber } from '@/i18n/formatters'
+import {
+  PERMISSION_GROUPS,
+  detectPermissionSelection,
+  permissionsInGroup,
+  type PermissionPreset,
+  type PermissionSelection,
+} from '../lib/permission-presets'
+
+const props = defineProps<{
+  selected: ReadonlySet<string>
+  total: number
+  granted: number
+}>()
+
+const emit = defineEmits<{
+  toggle: [permissionName: string]
+  preset: [preset: PermissionPreset]
+}>()
+
+const { t } = useI18n()
+
+const filter = ref('')
+const grantedOnly = ref(false)
+
+const selection = computed<PermissionSelection>(() => detectPermissionSelection(props.selected))
+
+interface PresetOption {
+  id: PermissionSelection
+  label: string
+  preset?: PermissionPreset
+}
+
+const presetOptions = computed<PresetOption[]>(() => [
+  { id: 'clear', label: t('adminFeature.userForm.presets.none'), preset: 'clear' },
+  { id: 'standard', label: t('adminFeature.userForm.presets.standard'), preset: 'standard' },
+  { id: 'custom', label: t('adminFeature.userForm.presets.custom') },
+  { id: 'admin', label: t('adminFeature.userForm.presets.admin'), preset: 'admin' },
+])
+
+function permissionLabel(permission: Permission): string {
+  if (permission === Permission.ViewUserActivity) return t('adminFeature.accountActivity.permissionLabel')
+  return PERMISSION_LABELS[permission] ?? permission
+}
+
+interface PermissionRow {
+  name: Permission
+  label: string
+  manage: boolean
+  checked: boolean
+}
+
+interface RenderedGroup {
+  id: string
+  label: string
+  legend: string
+  granted: number
+  total: number
+  /** Every permission is administration-level, so one group tag replaces a tag on every row. */
+  manageOnly: boolean
+  /** Groups past four permissions run the full width rather than squeezing into a column. */
+  wide: boolean
+  rows: PermissionRow[]
+}
+
+const groups = computed<RenderedGroup[]>(() => {
+  const query = filter.value.trim().toLowerCase()
+
+  return PERMISSION_GROUPS.map((group) => {
+    const label = t(`adminFeature.userForm.permissionGroups.${group.id}`)
+    const groupMatches = query.length > 0 && label.toLowerCase().includes(query)
+    const permissions = permissionsInGroup(group)
+
+    const rows = permissions
+      .map((permission) => ({
+        name: permission,
+        label: permissionLabel(permission),
+        manage: group.manage.includes(permission),
+        checked: props.selected.has(permission),
+      }))
+      .filter((row) => (grantedOnly.value ? row.checked : true))
+      .filter((row) => (query.length === 0 || groupMatches ? true : row.label.toLowerCase().includes(query)))
+
+    const granted = permissions.filter((permission) => props.selected.has(permission)).length
+
+    return {
+      id: group.id,
+      label,
+      legend: t('adminFeature.userForm.groupLegend', { group: label, granted: formatNumber(granted), total: formatNumber(permissions.length) }),
+      granted,
+      total: permissions.length,
+      manageOnly: group.use.length === 0,
+      wide: permissions.length > 4,
+      rows,
+    }
+  }).filter((group) => group.rows.length > 0)
+})
+
+const isFiltering = computed(() => filter.value.trim().length > 0 || grantedOnly.value)
+
+function applyPreset(option: PresetOption) {
+  if (!option.preset) return
+  emit('preset', option.preset)
+}
+
+function togglePermission(permissionName: string) {
+  emit('toggle', permissionName)
+}
+
+function toggleGrantedOnly() {
+  grantedOnly.value = !grantedOnly.value
+}
+
+function clearFilters() {
+  filter.value = ''
+  grantedOnly.value = false
+}
+</script>
+
+<template>
+  <section class="space-y-3">
+    <div class="flex flex-wrap items-start justify-between gap-x-4 gap-y-2">
+      <div class="min-w-0">
+        <h3 class="settings-label sr-only md:not-sr-only">{{ t('adminFeature.userForm.permissions') }}</h3>
+        <p class="settings-hint">
+          {{ t('adminFeature.userForm.permissionsHint', { granted: formatNumber(granted), total: formatNumber(total) }) }}
+        </p>
+      </div>
+      <div
+        role="group"
+        :aria-label="t('adminFeature.userForm.presets.label')"
+        class="flex shrink-0 gap-0.5 rounded-lg border border-border bg-muted p-0.5"
+      >
+        <button
+          v-for="option in presetOptions"
+          :key="option.id"
+          type="button"
+          :aria-pressed="selection === option.id"
+          :disabled="!option.preset"
+          :title="option.preset ? undefined : t('adminFeature.userForm.presets.customHint')"
+          class="rounded-[7px] px-2.5 py-1 text-xs transition-colors disabled:cursor-default"
+          :class="
+            selection === option.id
+              ? 'bg-card font-semibold text-foreground shadow-xs'
+              : option.preset
+                ? 'text-muted-foreground hover:text-foreground'
+                : 'text-muted-foreground'
+          "
+          @click="applyPreset(option)"
+        >
+          {{ option.label }}
+        </button>
+      </div>
+    </div>
+
+    <div class="flex flex-wrap items-center gap-2">
+      <div class="relative min-w-[10rem] flex-1">
+        <Search :size="14" class="pointer-events-none absolute start-3 top-1/2 -translate-y-1/2 text-muted-foreground" aria-hidden="true" />
+        <input
+          v-model="filter"
+          type="search"
+          :placeholder="t('adminFeature.userForm.filterPermissions')"
+          :aria-label="t('adminFeature.userForm.filterPermissions')"
+          class="h-9 w-full rounded-lg border border-input bg-background ps-9 pe-3 text-sm text-foreground focus:outline-none focus:ring-2 focus:ring-primary/50"
+        />
+      </div>
+      <button
+        type="button"
+        :aria-pressed="grantedOnly"
+        class="h-9 shrink-0 rounded-lg border px-3 text-xs font-medium transition-colors"
+        :class="grantedOnly ? 'border-primary/40 bg-primary/10 text-primary' : 'border-input text-muted-foreground hover:text-foreground'"
+        @click="toggleGrantedOnly"
+      >
+        {{ t('adminFeature.userForm.grantedOnly') }}
+      </button>
+    </div>
+
+    <div v-if="groups.length === 0" class="rounded-lg border border-dashed border-border px-4 py-8 text-center">
+      <p class="text-sm text-foreground">{{ t('adminFeature.userForm.noPermissionMatches') }}</p>
+      <button type="button" class="mt-2 text-xs font-medium text-primary hover:underline" @click="clearFilters">
+        {{ t('adminFeature.userForm.clearFilters') }}
+      </button>
+    </div>
+
+    <div v-else class="grid gap-2.5 @lg:grid-cols-2">
+      <fieldset
+        v-for="group in groups"
+        :key="group.id"
+        class="rounded-lg border border-border bg-card px-3 pb-2.5 pt-2"
+        :class="group.wide ? '@lg:col-span-2' : ''"
+      >
+        <legend class="sr-only">{{ group.legend }}</legend>
+        <div class="mb-1.5 flex items-center gap-2">
+          <span aria-hidden="true" class="text-xs font-semibold text-foreground">{{ group.label }}</span>
+          <span
+            v-if="group.manageOnly"
+            aria-hidden="true"
+            class="rounded bg-muted px-1.5 py-0.5 text-[10px] font-semibold uppercase tracking-wide text-muted-foreground"
+          >
+            {{ t('adminFeature.userForm.permissionLevels.manage') }}
+          </span>
+          <span aria-hidden="true" class="ms-auto text-[11px] font-semibold tabular-nums text-muted-foreground">
+            {{ formatNumber(group.granted) }}/{{ formatNumber(group.total) }}
+          </span>
+        </div>
+        <div :class="group.wide ? 'grid gap-x-4 @md:grid-cols-2 @xl:grid-cols-3' : ''">
+          <label
+            v-for="row in group.rows"
+            :key="row.name"
+            class="flex cursor-pointer items-start gap-2 rounded py-1 focus-within:ring-2 focus-within:ring-ring"
+          >
+            <input
+              type="checkbox"
+              :checked="row.checked"
+              class="mt-0.5 size-4 shrink-0 rounded border-input accent-primary"
+              @change="togglePermission(row.name)"
+            />
+            <span class="text-sm leading-tight text-foreground">{{ row.label }}</span>
+            <span
+              v-if="row.manage && !group.manageOnly"
+              class="ms-auto mt-0.5 shrink-0 rounded bg-muted px-1.5 py-0.5 text-[10px] font-semibold uppercase tracking-wide text-muted-foreground"
+            >
+              {{ t('adminFeature.userForm.permissionLevels.manage') }}
+            </span>
+          </label>
+        </div>
+      </fieldset>
+    </div>
+
+    <p v-if="isFiltering && groups.length > 0" class="text-xs text-muted-foreground">
+      {{ t('adminFeature.userForm.filteredNotice') }}
+    </p>
+  </section>
+</template>
diff --git a/client/src/features/admin/components/UserRestrictionsSection.vue b/client/src/features/admin/components/UserRestrictionsSection.vue
new file mode 100644
index 000000000..6b15b1684
--- /dev/null
+++ b/client/src/features/admin/components/UserRestrictionsSection.vue
@@ -0,0 +1,150 @@
+<script setup lang="ts">
+import { computed, useId } from 'vue'
+import { useI18n } from 'vue-i18n'
+import { ShieldAlert } from '@lucide/vue'
+import { Permission, PERMISSION_LABELS } from '@bookorbit/types'
+import ContentFilterChipInput from '@/components/ui/ContentFilterChipInput.vue'
+import ToggleSwitch from '@/components/ui/ToggleSwitch.vue'
+import { RESTRICTION_PERMISSIONS } from '../lib/permission-presets'
+import { useTagSearchWithIds, useGenreSearchWithIds } from '../composables/useContentFilterSearch'
+import type { NamedItem } from '../composables/useUserForm'
+
+const props = defineProps<{
+  isEdit: boolean
+  isSuperuserTarget: boolean
+  selected: ReadonlySet<string>
+  contentFiltersEnabled: boolean
+}>()
+
+const emit = defineEmits<{
+  toggle: [permissionName: string]
+  'update:contentFiltersEnabled': [enabled: boolean]
+}>()
+
+const includeTags = defineModel<NamedItem[]>('includeTags', { required: true })
+const excludeTags = defineModel<NamedItem[]>('excludeTags', { required: true })
+const includeGenres = defineModel<NamedItem[]>('includeGenres', { required: true })
+const excludeGenres = defineModel<NamedItem[]>('excludeGenres', { required: true })
+const seeOwnRequestedBooks = defineModel<boolean>('seeOwnRequestedBooks', { required: true })
+
+const { t } = useI18n()
+const { search: searchTags } = useTagSearchWithIds()
+const { search: searchGenres } = useGenreSearchWithIds()
+
+const contentFiltersId = useId()
+
+/** Content filters are saved against an existing account, so creation has nowhere to put them. */
+const canEditContentFilters = computed(() => props.isEdit && !props.isSuperuserTarget)
+
+const restrictions = computed(() =>
+  RESTRICTION_PERMISSIONS.map((permission) => ({
+    name: permission,
+    label: PERMISSION_LABELS[permission] ?? permission,
+    hint: permission === Permission.DemoRestricted ? t('adminFeature.userForm.demoRestrictedHint') : '',
+    checked: props.selected.has(permission),
+  })),
+)
+
+function toggleRestriction(permissionName: string) {
+  emit('toggle', permissionName)
+}
+
+function toggleContentFilters(enabled: boolean) {
+  emit('update:contentFiltersEnabled', enabled)
+}
+</script>
+
+<template>
+  <section class="space-y-4">
+    <div class="space-y-3">
+      <div class="flex items-start gap-3">
+        <div class="min-w-0">
+          <h3 :id="contentFiltersId" class="settings-label">{{ t('adminFeature.userForm.contentRestrictions') }}</h3>
+          <p class="settings-hint">{{ t('adminFeature.userForm.contentRestrictionsHint') }}</p>
+        </div>
+        <ToggleSwitch
+          v-if="canEditContentFilters"
+          :model-value="contentFiltersEnabled"
+          :aria-labelledby="contentFiltersId"
+          class="ms-auto mt-0.5"
+          @update:model-value="toggleContentFilters"
+        />
+      </div>
+
+      <div v-if="isSuperuserTarget" class="flex gap-3 rounded-lg border border-[var(--pill-warning)]/40 bg-[var(--pill-warning)]/10 px-3 py-2.5">
+        <ShieldAlert :size="16" class="mt-0.5 shrink-0 text-[var(--pill-warning)]" aria-hidden="true" />
+        <div>
+          <p class="text-sm font-medium text-[var(--pill-warning)]">{{ t('adminFeature.userForm.superuserTarget') }}</p>
+          <p class="settings-hint">{{ t('adminFeature.userForm.superuserTargetHint') }}</p>
+        </div>
+      </div>
+
+      <p v-else-if="!isEdit" class="rounded-lg border border-dashed border-border px-3 py-2.5 text-xs text-muted-foreground">
+        {{ t('adminFeature.userForm.contentRestrictionsAfterCreate') }}
+      </p>
+
+      <div v-else-if="contentFiltersEnabled" class="grid gap-3 @lg:grid-cols-2">
+        <div class="space-y-1.5">
+          <label class="settings-label block text-xs">{{ t('adminFeature.userForm.includeTags') }}</label>
+          <ContentFilterChipInput v-model="includeTags" :placeholder="t('adminFeature.userForm.searchTagsPlaceholder')" :search-fn="searchTags" />
+          <p class="settings-hint">{{ t('adminFeature.userForm.includeTagsHint') }}</p>
+        </div>
+        <div class="space-y-1.5">
+          <label class="settings-label block text-xs">{{ t('adminFeature.userForm.excludeTags') }}</label>
+          <ContentFilterChipInput v-model="excludeTags" :placeholder="t('adminFeature.userForm.searchTagsPlaceholder')" :search-fn="searchTags" />
+          <p class="settings-hint">{{ t('adminFeature.userForm.excludeTagsHint') }}</p>
+        </div>
+        <div class="space-y-1.5">
+          <label class="settings-label block text-xs">{{ t('adminFeature.userForm.includeGenres') }}</label>
+          <ContentFilterChipInput
+            v-model="includeGenres"
+            :placeholder="t('adminFeature.userForm.searchGenresPlaceholder')"
+            :search-fn="searchGenres"
+          />
+          <p class="settings-hint">{{ t('adminFeature.userForm.includeGenresHint') }}</p>
+        </div>
+        <div class="space-y-1.5">
+          <label class="settings-label block text-xs">{{ t('adminFeature.userForm.excludeGenres') }}</label>
+          <ContentFilterChipInput
+            v-model="excludeGenres"
+            :placeholder="t('adminFeature.userForm.searchGenresPlaceholder')"
+            :search-fn="searchGenres"
+          />
+          <p class="settings-hint">{{ t('adminFeature.userForm.excludeGenresHint') }}</p>
+        </div>
+        <label class="flex cursor-pointer items-start gap-2 focus-within:ring-2 focus-within:ring-ring @lg:col-span-2">
+          <input v-model="seeOwnRequestedBooks" type="checkbox" class="mt-0.5 size-4 shrink-0 rounded border-input accent-primary" />
+          <span>
+            <span class="block text-sm leading-tight text-foreground">{{ t('adminFeature.userForm.seeOwnRequestedBooks') }}</span>
+            <span class="settings-hint block">{{ t('adminFeature.userForm.seeOwnRequestedBooksHint') }}</span>
+          </span>
+        </label>
+      </div>
+
+      <p v-else class="rounded-lg border border-dashed border-border px-3 py-2.5 text-xs text-muted-foreground">
+        {{ t('adminFeature.userForm.noRestrictionsHint') }}
+      </p>
+    </div>
+
+    <fieldset class="space-y-2 rounded-lg border border-border bg-card px-3 pb-2.5 pt-2">
+      <legend class="sr-only">{{ t('adminFeature.userForm.accountRestrictions') }}</legend>
+      <p aria-hidden="true" class="text-xs font-semibold text-foreground">{{ t('adminFeature.userForm.accountRestrictions') }}</p>
+      <label
+        v-for="restriction in restrictions"
+        :key="restriction.name"
+        class="flex cursor-pointer items-start gap-2 focus-within:ring-2 focus-within:ring-ring"
+      >
+        <input
+          type="checkbox"
+          :checked="restriction.checked"
+          class="mt-0.5 size-4 shrink-0 rounded border-input accent-primary"
+          @change="toggleRestriction(restriction.name)"
+        />
+        <span>
+          <span class="block text-sm leading-tight text-foreground">{{ restriction.label }}</span>
+          <span class="settings-hint block">{{ restriction.hint }}</span>
+        </span>
+      </label>
+    </fieldset>
+  </section>
+</template>
diff --git a/client/src/features/admin/composables/useUserForm.ts b/client/src/features/admin/composables/useUserForm.ts
new file mode 100644
index 000000000..094567c7f
--- /dev/null
+++ b/client/src/features/admin/composables/useUserForm.ts
@@ -0,0 +1,370 @@
+import { computed, ref, watch, type Ref } from 'vue'
+import { PERMISSION_REQUIRES, type AuthUser, type Permission } from '@bookorbit/types'
+import { api } from '@/lib/api'
+import { grantingPermissions, isRestrictionPermission, presetPermissions, type PermissionPreset } from '../lib/permission-presets'
+
+export type UserFormSection = 'profile' | 'libraries' | 'permissions' | 'restrictions'
+
+/**
+ * The list row the drawer is opened from. `createdAt` and `lockedUntil` ride along on the list
+ * response without living on `AuthUser`, and the Profile section reports both.
+ */
+export interface UserFormTarget extends Partial<AuthUser> {
+  createdAt?: string
+  lockedUntil?: string | null
+}
+
+export interface NamedItem {
+  id: number
+  name: string
+}
+
+export interface UserFormSaveResult {
+  ok: boolean
+  /** Present when creating a password account, so the caller can offer the one-time link. */
+  resetUrl?: string
+  /** The section holding the field a failed save complained about. */
+  section?: UserFormSection
+}
+
+interface FormSnapshot {
+  name: string
+  email: string
+  active: boolean
+  permissions: string
+  libraries: string
+  filters: string
+}
+
+/** What the Restrictions section currently holds, for the summary beside its nav entry. */
+export type RestrictionState = 'none' | 'content' | 'demo' | 'both'
+
+export function useUserForm(user: Ref<UserFormTarget | null>, defaultLibraryIds: Ref<number[] | undefined>) {
+  const name = ref('')
+  const username = ref('')
+  const email = ref('')
+  const active = ref(true)
+  const isSharedAccount = ref(false)
+  const selectedPermissionNames = ref<Set<string>>(new Set())
+  const selectedLibraryIds = ref<Set<number>>(new Set())
+
+  const includeTagItems = ref<NamedItem[]>([])
+  const excludeTagItems = ref<NamedItem[]>([])
+  const includeGenreItems = ref<NamedItem[]>([])
+  const excludeGenreItems = ref<NamedItem[]>([])
+  const contentFiltersEnabled = ref(false)
+  const seeOwnRequestedBooks = ref(false)
+
+  const loading = ref(false)
+  const error = ref<string | null>(null)
+  const errorKey = ref<string | null>(null)
+
+  const snapshot = ref<FormSnapshot | null>(null)
+
+  const isEdit = computed(() => !!user.value?.id)
+  const isSuperuserTarget = computed(() => !!user.value?.isSuperuser)
+  const totalPermissions = computed(() => grantingPermissions().length)
+  const grantedCount = computed(() => [...selectedPermissionNames.value].filter((permissionName) => !isRestrictionPermission(permissionName)).length)
+
+  const hasContentFilters = computed(
+    () =>
+      includeTagItems.value.length > 0 ||
+      excludeTagItems.value.length > 0 ||
+      includeGenreItems.value.length > 0 ||
+      excludeGenreItems.value.length > 0,
+  )
+
+  const restrictionPermissionNames = computed(() => [...selectedPermissionNames.value].filter(isRestrictionPermission))
+
+  const restrictionState = computed<RestrictionState>(() => {
+    const demo = restrictionPermissionNames.value.length > 0
+    if (demo && hasContentFilters.value) return 'both'
+    if (demo) return 'demo'
+    return hasContentFilters.value ? 'content' : 'none'
+  })
+
+  function currentSnapshot(): FormSnapshot {
+    return {
+      name: name.value,
+      email: email.value.trim(),
+      active: active.value,
+      permissions: [...selectedPermissionNames.value].sort().join(','),
+      libraries: [...selectedLibraryIds.value].sort((a, b) => a - b).join(','),
+      filters: filterSignature(),
+    }
+  }
+
+  function filterSignature(): string {
+    const lists = [includeTagItems, excludeTagItems, includeGenreItems, excludeGenreItems]
+      .map((items) =>
+        items.value
+          .map((item) => item.id)
+          .sort((a, b) => a - b)
+          .join('.'),
+      )
+      .join('|')
+    return `${lists}|exempt:${seeOwnRequestedBooks.value}`
+  }
+
+  /** Field-level count, so the footer can say how much a Cancel would throw away. */
+  const changeCount = computed(() => {
+    const base = snapshot.value
+    if (!base) return 0
+    const next = currentSnapshot()
+    let changes = 0
+    if (base.name !== next.name) changes++
+    if (base.email !== next.email) changes++
+    if (base.active !== next.active) changes++
+    if (base.libraries !== next.libraries) changes++
+    if (base.permissions !== next.permissions) changes++
+    if (base.filters !== next.filters) changes++
+    return changes
+  })
+
+  function toggleLibrary(libraryId: number) {
+    const next = new Set(selectedLibraryIds.value)
+    if (next.has(libraryId)) next.delete(libraryId)
+    else next.add(libraryId)
+    selectedLibraryIds.value = next
+  }
+
+  function setLibraries(libraryIds: number[]) {
+    selectedLibraryIds.value = new Set(libraryIds)
+  }
+
+  /**
+   * Mirrors the dependency the server applies on assignment: granting a permission that is inert on
+   * its own pulls in what it needs, and revoking that requirement takes the dependent with it.
+   * Without this the checkboxes and the saved account disagree until the next reload.
+   */
+  function togglePermission(permissionName: string) {
+    const next = new Set(selectedPermissionNames.value)
+    if (next.has(permissionName)) {
+      next.delete(permissionName)
+      for (const [dependent, required] of Object.entries(PERMISSION_REQUIRES)) {
+        if ((required as readonly string[]).includes(permissionName)) next.delete(dependent)
+      }
+    } else {
+      next.add(permissionName)
+      for (const required of PERMISSION_REQUIRES[permissionName as Permission] ?? []) next.add(required)
+    }
+    selectedPermissionNames.value = next
+  }
+
+  /** Presets speak for granting permissions only, so a demo restriction survives applying one. */
+  function applyPreset(preset: PermissionPreset) {
+    selectedPermissionNames.value = new Set([...presetPermissions(preset), ...restrictionPermissionNames.value])
+  }
+
+  function setContentFiltersEnabled(enabled: boolean) {
+    contentFiltersEnabled.value = enabled
+    if (enabled) return
+    includeTagItems.value = []
+    excludeTagItems.value = []
+    includeGenreItems.value = []
+    excludeGenreItems.value = []
+    seeOwnRequestedBooks.value = false
+  }
+
+  function reset() {
+    const target = user.value
+    name.value = target?.name ?? ''
+    username.value = target?.username ?? ''
+    email.value = target?.email ?? ''
+    active.value = target?.active ?? true
+    isSharedAccount.value = target?.provisioningMethod === 'shared'
+    selectedPermissionNames.value = new Set(target?.permissions?.filter((permissionName) => permissionName !== '*') ?? [])
+    selectedLibraryIds.value = target?.id ? new Set() : new Set(defaultLibraryIds.value ?? [])
+    includeTagItems.value = []
+    excludeTagItems.value = []
+    includeGenreItems.value = []
+    excludeGenreItems.value = []
+    contentFiltersEnabled.value = false
+    seeOwnRequestedBooks.value = false
+    error.value = null
+    errorKey.value = null
+    snapshot.value = null
+  }
+
+  async function load() {
+    reset()
+    const target = user.value
+    if (!target?.id) {
+      snapshot.value = currentSnapshot()
+      return
+    }
+
+    const [librariesRes, filtersRes] = await Promise.all([
+      api(`/api/v1/users/${target.id}/libraries`),
+      target.isSuperuser ? Promise.resolve(null) : api(`/api/v1/users/${target.id}/content-filters`),
+    ])
+
+    if (user.value?.id !== target.id) return
+
+    if (librariesRes.ok) {
+      const libraryIds: number[] = await librariesRes.json()
+      selectedLibraryIds.value = new Set(libraryIds)
+    }
+    if (filtersRes?.ok) {
+      const filters = await filtersRes.json()
+      includeTagItems.value = filters.includeTags ?? []
+      excludeTagItems.value = filters.excludeTags ?? []
+      includeGenreItems.value = filters.includeGenres ?? []
+      excludeGenreItems.value = filters.excludeGenres ?? []
+      seeOwnRequestedBooks.value = filters.seeOwnRequestedBooks ?? false
+      contentFiltersEnabled.value = hasContentFilters.value
+    }
+
+    if (user.value?.id !== target.id) return
+    snapshot.value = currentSnapshot()
+  }
+
+  function fail(key: string, section: UserFormSection, message?: string): UserFormSaveResult {
+    errorKey.value = key
+    error.value = message ?? null
+    return { ok: false, section }
+  }
+
+  async function readMessage(response: Response): Promise<string | undefined> {
+    const body = await response.json().catch(() => ({}))
+    return typeof body?.message === 'string' ? body.message : undefined
+  }
+
+  function validate(): UserFormSaveResult | null {
+    if (!name.value.trim()) return fail('nameRequired', 'profile')
+    if (!isEdit.value && !username.value.trim()) return fail('usernameRequired', 'profile')
+    if (!isEdit.value && !isSharedAccount.value && !email.value.trim()) return fail('emailRequired', 'profile')
+    return null
+  }
+
+  async function saveExisting(userId: number): Promise<UserFormSaveResult> {
+    const trimmedEmail = email.value.trim()
+
+    const userRes = await api(`/api/v1/users/${userId}`, {
+      method: 'PATCH',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ name: name.value, email: trimmedEmail || undefined, active: active.value }),
+    })
+    if (!userRes.ok) return fail('updateUser', 'profile', await readMessage(userRes))
+
+    const permissionsRes = await api(`/api/v1/users/${userId}/permissions`, {
+      method: 'PUT',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ permissionNames: [...selectedPermissionNames.value] }),
+    })
+    if (!permissionsRes.ok) return fail('updatePermissions', 'permissions', await readMessage(permissionsRes))
+
+    const librariesRes = await api(`/api/v1/users/${userId}/libraries`, {
+      method: 'PUT',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ libraryIds: [...selectedLibraryIds.value] }),
+    })
+    if (!librariesRes.ok) return fail('updateLibraryAccess', 'libraries', await readMessage(librariesRes))
+
+    if (!isSuperuserTarget.value) {
+      const filtersRes = await api(`/api/v1/users/${userId}/content-filters`, {
+        method: 'PUT',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          includeTagIds: includeTagItems.value.map((item) => item.id),
+          excludeTagIds: excludeTagItems.value.map((item) => item.id),
+          includeGenreIds: includeGenreItems.value.map((item) => item.id),
+          excludeGenreIds: excludeGenreItems.value.map((item) => item.id),
+          seeOwnRequestedBooks: seeOwnRequestedBooks.value,
+        }),
+      })
+      if (!filtersRes.ok) return fail('updateContentFilters', 'restrictions', await readMessage(filtersRes))
+    }
+
+    return { ok: true }
+  }
+
+  async function createNew(): Promise<UserFormSaveResult> {
+    const trimmedEmail = email.value.trim()
+    const payload = {
+      name: name.value,
+      username: username.value,
+      email: trimmedEmail || undefined,
+      permissionNames: [...selectedPermissionNames.value],
+      libraryIds: [...selectedLibraryIds.value],
+    }
+
+    if (isSharedAccount.value) {
+      const res = await api('/api/v1/users/shared', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(payload),
+      })
+      if (!res.ok) return fail('createSharedAccount', 'profile', await readMessage(res))
+      return { ok: true }
+    }
+
+    const res = await api('/api/v1/users', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ ...payload, email: trimmedEmail }),
+    })
+    if (!res.ok) return fail('createUser', 'profile', await readMessage(res))
+    const data = await res.json()
+    return { ok: true, resetUrl: data.resetUrl }
+  }
+
+  async function save(): Promise<UserFormSaveResult> {
+    error.value = null
+    errorKey.value = null
+
+    const invalid = validate()
+    if (invalid) return invalid
+
+    loading.value = true
+    try {
+      const userId = user.value?.id
+      const result = userId ? await saveExisting(userId) : await createNew()
+      if (result.ok) snapshot.value = currentSnapshot()
+      return result
+    } finally {
+      loading.value = false
+    }
+  }
+
+  watch(user, () => void load(), { immediate: true })
+
+  watch(defaultLibraryIds, (libraryIds) => {
+    if (!isEdit.value) {
+      setLibraries(libraryIds ?? [])
+      snapshot.value = currentSnapshot()
+    }
+  })
+
+  return {
+    name,
+    username,
+    email,
+    active,
+    isSharedAccount,
+    selectedPermissionNames,
+    selectedLibraryIds,
+    includeTagItems,
+    excludeTagItems,
+    includeGenreItems,
+    excludeGenreItems,
+    contentFiltersEnabled,
+    seeOwnRequestedBooks,
+    loading,
+    error,
+    errorKey,
+    isEdit,
+    isSuperuserTarget,
+    grantedCount,
+    totalPermissions,
+    hasContentFilters,
+    restrictionState,
+    changeCount,
+    toggleLibrary,
+    setLibraries,
+    togglePermission,
+    applyPreset,
+    setContentFiltersEnabled,
+    save,
+  }
+}
diff --git a/client/src/features/admin/composables/useUsers.ts b/client/src/features/admin/composables/useUsers.ts
index 39c19167b..4378f1611 100644
--- a/client/src/features/admin/composables/useUsers.ts
+++ b/client/src/features/admin/composables/useUsers.ts
@@ -25,7 +25,7 @@ export interface UserRow extends AuthUser {
   provisioningMethod: ProvisioningMethod
 }
 
-export type UserLibrary = Pick<Library, 'id' | 'name'>
+export type UserLibrary = Pick<Library, 'id' | 'name' | 'bookCount'>
 
 const EMPTY_SUMMARY: UserListSummary = { total: 0, admins: 0, active: 0, inactive: 0, attention: 0 }
 
diff --git a/client/src/features/admin/lib/__tests__/permission-presets.spec.ts b/client/src/features/admin/lib/__tests__/permission-presets.spec.ts
index d0acceccd..71e8b47c5 100644
--- a/client/src/features/admin/lib/__tests__/permission-presets.spec.ts
+++ b/client/src/features/admin/lib/__tests__/permission-presets.spec.ts
@@ -1,21 +1,27 @@
 // @vitest-environment node
 import { describe, expect, it } from 'vitest'
 import { Permission } from '@bookorbit/types'
-import { PERMISSION_GROUPS, presetPermissions } from '../permission-presets'
+import { PERMISSION_GROUPS, RESTRICTION_PERMISSIONS, detectPermissionSelection, permissionsInGroup, presetPermissions } from '../permission-presets'
 
 describe('permission-presets', () => {
-  it('keeps demo_restricted selectable as its own group', () => {
-    const restrictions = PERMISSION_GROUPS.find((group) => group.id === 'restrictions')
-    expect(restrictions?.permissions).toEqual([Permission.DemoRestricted])
-    expect(restrictions?.inverted).toBe(true)
+  // The user form renders permissions by walking the groups, so a permission missing from every
+  // group is not merely unlabelled: nobody but a superuser can ever hold it.
+  it('offers every permission in exactly one group', () => {
+    const grouped = [...PERMISSION_GROUPS.flatMap(permissionsInGroup), ...RESTRICTION_PERMISSIONS]
+    expect([...grouped].sort()).toEqual(Object.values(Permission).sort())
   })
 
-  it('never selects an inverted permission in the admin preset', () => {
+  it('keeps demo_restricted separate from granting permissions', () => {
+    expect(RESTRICTION_PERMISSIONS).toEqual([Permission.DemoRestricted])
+    expect(PERMISSION_GROUPS.flatMap(permissionsInGroup)).not.toContain(Permission.DemoRestricted)
+  })
+
+  it('never selects a restriction permission in the admin preset', () => {
     expect(presetPermissions('admin')).not.toContain(Permission.DemoRestricted)
   })
 
   it('selects every granting permission in the admin preset', () => {
-    const granting = PERMISSION_GROUPS.filter((group) => !group.inverted).flatMap((group) => group.permissions)
+    const granting = PERMISSION_GROUPS.flatMap(permissionsInGroup)
     expect(presetPermissions('admin')).toEqual(granting)
     expect(granting.length).toBeGreaterThan(0)
   })
@@ -35,13 +41,28 @@ describe('permission-presets', () => {
   })
 
   it('separates personal Book Dock access from global Book Dock administration', () => {
-    const content = PERMISSION_GROUPS.find((group) => group.id === 'content')
+    const bookDock = PERMISSION_GROUPS.find((group) => group.id === 'bookDock')
+
+    expect(bookDock?.use).toEqual([Permission.BookDockAccess])
+    expect(bookDock?.manage).toEqual([Permission.ManageBookDock])
+  })
+
+  it('separates requesting a book from moderating the queue', () => {
+    const bookRequests = PERMISSION_GROUPS.find((group) => group.id === 'bookRequests')
+
+    expect(bookRequests?.use).toContain(Permission.BookRequestAccess)
+    expect(bookRequests?.use).toContain(Permission.BookRequestAutoApprove)
+    expect(bookRequests?.use).toContain(Permission.BookRequestSelfFulfill)
+    expect(bookRequests?.manage).toEqual([Permission.ManageBookRequests])
+  })
+
+  it('collapses everything only an administrator holds into one group', () => {
     const administration = PERMISSION_GROUPS.find((group) => group.id === 'administration')
 
-    expect(content?.permissions).toContain(Permission.BookDockAccess)
-    expect(content?.permissions).not.toContain(Permission.ManageBookDock)
-    expect(administration?.permissions).toContain(Permission.ManageBookDock)
-    expect(administration?.permissions).not.toContain(Permission.BookDockAccess)
+    expect(administration?.use).toEqual([])
+    expect(administration?.manage).toContain(Permission.ManageUsers)
+    expect(administration?.manage).toContain(Permission.ManageLibraries)
+    expect(administration?.manage).toContain(Permission.ManageAppSettings)
   })
 
   it('selects nothing for the clear preset', () => {
@@ -54,3 +75,23 @@ describe('permission-presets', () => {
     expect(presetPermissions('standard')).not.toContain(Permission.ManageUsers)
   })
 })
+
+describe('detectPermissionSelection', () => {
+  it('names the preset a selection matches', () => {
+    expect(detectPermissionSelection(new Set())).toBe('clear')
+    expect(detectPermissionSelection(new Set(presetPermissions('standard')))).toBe('standard')
+    expect(detectPermissionSelection(new Set(presetPermissions('admin')))).toBe('admin')
+  })
+
+  // The preset control speaks for granting permissions, so a demo account on the standard set is
+  // still Standard rather than dropping to Custom the moment a restriction is ticked.
+  it('ignores restrictions, which no preset speaks for', () => {
+    const selection = new Set<string>([...presetPermissions('standard'), Permission.DemoRestricted])
+
+    expect(detectPermissionSelection(selection)).toBe('standard')
+  })
+
+  it('falls through to custom for a selection no preset covers', () => {
+    expect(detectPermissionSelection(new Set([Permission.ManageUsers]))).toBe('custom')
+  })
+})
diff --git a/client/src/features/admin/lib/permission-presets.ts b/client/src/features/admin/lib/permission-presets.ts
index 713b58826..ec68ea57a 100644
--- a/client/src/features/admin/lib/permission-presets.ts
+++ b/client/src/features/admin/lib/permission-presets.ts
@@ -2,61 +2,82 @@ import { Permission } from '@bookorbit/types'
 
 export interface PermissionGroup {
   id: string
-  permissions: Permission[]
-  /** Permissions in this group take capability away instead of granting it, so presets must never select them. */
-  inverted?: boolean
+  use: Permission[]
+  manage: Permission[]
 }
 
+/**
+ * The order the user form renders. Groups that pair a personal capability with its administration
+ * come first; everything that only an administrator ever holds collapses into a single group at the
+ * end, because splitting it three ways spent three headings on rows that are all the same answer to
+ * "should this account run the server".
+ */
 export const PERMISSION_GROUPS: PermissionGroup[] = [
   {
-    id: 'content',
-    permissions: [
-      Permission.LibraryDownload,
-      Permission.LibraryUpload,
-      Permission.LibraryEditMetadata,
-      Permission.LibraryDeleteBooks,
-      Permission.BookDockAccess,
-    ],
+    id: 'libraryBooks',
+    use: [Permission.LibraryDownload, Permission.LibraryUpload, Permission.LibraryEditMetadata],
+    manage: [Permission.LibraryDeleteBooks],
   },
   {
-    id: 'devicesAccess',
-    permissions: [
-      Permission.KoboSync,
-      Permission.KoreaderSync,
-      Permission.HardcoverSync,
-      Permission.ReadwiseSync,
-      Permission.StorygraphSync,
-      Permission.OpdsAccess,
-    ],
+    id: 'bookRequests',
+    use: [Permission.BookRequestAccess, Permission.BookRequestAutoApprove, Permission.BookRequestSelfFulfill],
+    manage: [Permission.ManageBookRequests],
   },
   {
-    id: 'email',
-    permissions: [Permission.EmailSend, Permission.ManageEmail],
+    id: 'devices',
+    use: [Permission.KoboSync, Permission.KoreaderSync, Permission.OpdsAccess],
+    manage: [],
+  },
+  {
+    id: 'readingIntegrations',
+    use: [Permission.HardcoverSync, Permission.ReadwiseSync, Permission.StorygraphSync],
+    manage: [],
+  },
+  {
+    id: 'bookDock',
+    use: [Permission.BookDockAccess],
+    manage: [Permission.ManageBookDock],
+  },
+  {
+    id: 'emailNotifications',
+    use: [Permission.EmailSend, Permission.NotificationAccess],
+    manage: [Permission.ManageEmail],
   },
   {
     id: 'administration',
-    permissions: [
+    use: [],
+    manage: [
       Permission.ManageLibraries,
       Permission.ManageMetadataConfig,
       Permission.ManageIcons,
-      Permission.ManageAppSettings,
-      Permission.ManageBookDock,
       Permission.ManageUsers,
       Permission.ViewUserActivity,
       Permission.ViewAuditLog,
+      Permission.ManageAppSettings,
     ],
   },
-  {
-    id: 'notifications',
-    permissions: [Permission.NotificationAccess],
-  },
-  {
-    id: 'restrictions',
-    permissions: [Permission.DemoRestricted],
-    inverted: true,
-  },
 ]
 
+export const RESTRICTION_PERMISSIONS: Permission[] = [Permission.DemoRestricted]
+
+export function permissionsInGroup(group: PermissionGroup): Permission[] {
+  return [...group.use, ...group.manage]
+}
+
+/** Every permission the presets and the permission grid deal in, restrictions excluded. */
+export function grantingPermissions(): Permission[] {
+  return PERMISSION_GROUPS.flatMap(permissionsInGroup)
+}
+
+export function isRestrictionPermission(permissionName: string): boolean {
+  return RESTRICTION_PERMISSIONS.includes(permissionName as Permission)
+}
+
+/**
+ * What an ordinary reader gets. Deliberately no request capability: whether people may ask for
+ * books at all is an instance-level decision an operator makes once, so it belongs on the role
+ * they choose rather than on the button that fills the form in for them.
+ */
 const STANDARD_PRESET: Permission[] = [
   Permission.LibraryDownload,
   Permission.KoboSync,
@@ -69,13 +90,32 @@ const STANDARD_PRESET: Permission[] = [
 
 export type PermissionPreset = 'standard' | 'admin' | 'clear'
 
+/** What the preset control reports: a preset the selection matches, or the absence of one. */
+export type PermissionSelection = PermissionPreset | 'custom'
+
+export const PERMISSION_PRESETS: PermissionPreset[] = ['clear', 'standard', 'admin']
+
 export function presetPermissions(preset: PermissionPreset): Permission[] {
   switch (preset) {
     case 'admin':
-      return PERMISSION_GROUPS.filter((group) => !group.inverted).flatMap((group) => group.permissions)
+      return grantingPermissions()
     case 'standard':
       return [...STANDARD_PRESET]
     case 'clear':
       return []
   }
 }
+
+/**
+ * Restrictions are deliberately ignored: `demo_restricted` is set on the Restrictions section and
+ * says nothing about which preset the granting permissions match, so a demo account on the standard
+ * set still reads as Standard rather than falling through to Custom.
+ */
+export function detectPermissionSelection(selected: ReadonlySet<string>): PermissionSelection {
+  const granted = new Set([...selected].filter((name) => !isRestrictionPermission(name)))
+  for (const preset of PERMISSION_PRESETS) {
+    const names = presetPermissions(preset)
+    if (names.length === granted.size && names.every((name) => granted.has(name))) return preset
+  }
+  return 'custom'
+}
diff --git a/client/src/features/audit/audit-resources.ts b/client/src/features/audit/audit-resources.ts
index 22e8ca01b..294962560 100644
--- a/client/src/features/audit/audit-resources.ts
+++ b/client/src/features/audit/audit-resources.ts
@@ -21,6 +21,9 @@ const domainByResource: Record<AuditResource, AuditResourceDomain> = {
   [AuditResource.Collection]: 'content',
   [AuditResource.SmartScope]: 'content',
   [AuditResource.BookDockFile]: 'content',
+  [AuditResource.BookRequest]: 'content',
+  [AuditResource.DownloadClient]: 'integrations',
+  [AuditResource.RequestIndexer]: 'integrations',
   [AuditResource.Author]: 'people',
   [AuditResource.AppSettings]: 'settings',
   [AuditResource.Genre]: 'metadata',
diff --git a/client/src/features/auth/composables/useAuth.ts b/client/src/features/auth/composables/useAuth.ts
index e354d14f6..e1699dc22 100644
--- a/client/src/features/auth/composables/useAuth.ts
+++ b/client/src/features/auth/composables/useAuth.ts
@@ -13,6 +13,7 @@ import { resetLibraries } from '@/features/library/composables/useLibraries'
 import { resetSmartScopes } from '@/features/smart-scope/composables/useSmartScopes'
 import { resetCollections } from '@/features/collection/composables/useCollections'
 import { resetBrowseCounts } from '@/composables/useBrowseCounts'
+import { resetBookRequestSummary } from '@/features/book-requests/composables/useBookRequestSummary'
 
 const SESSION_REFRESH_INTERVAL_MS = 5 * 60 * 1000
 
@@ -59,6 +60,7 @@ function clearAuth() {
   resetSmartScopes()
   resetCollections()
   resetBrowseCounts()
+  resetBookRequestSummary()
   user.value = null
   setAccessToken(null)
   disconnectAuthorEnrichmentSocket()
diff --git a/client/src/features/book-dock/components/BookDockFileRow.vue b/client/src/features/book-dock/components/BookDockFileRow.vue
index b09bd4e26..00d5676c6 100644
--- a/client/src/features/book-dock/components/BookDockFileRow.vue
+++ b/client/src/features/book-dock/components/BookDockFileRow.vue
@@ -1,7 +1,7 @@
 <script setup lang="ts">
 import { computed } from 'vue'
 import { useI18n } from 'vue-i18n'
-import { AlertCircle, ArrowRight, Check, ChevronRight, Copy, FolderPlus, PenLine, RotateCw, Trash2, Wand2 } from '@lucide/vue'
+import { AlertCircle, ArrowRight, Check, ChevronRight, Copy, Files, FolderPlus, PenLine, RotateCw, Trash2, Wand2 } from '@lucide/vue'
 import type { BookDockFile } from '@bookorbit/types'
 import { formatBytes } from '@/lib/formatting'
 import BookDockStatusBadge from './BookDockStatusBadge.vue'
@@ -71,13 +71,28 @@ const conflictLabel = computed(() => {
   return t(`bookDock.layout.conflict.${props.conflict.status}`)
 })
 
+/** A unit's anchor row describes only its primary file, so the row must state the whole unit. */
+const isUnit = computed(() => props.file.unitFiles.length > 1)
+
+const unitSizeBytes = computed(() => {
+  const sizes = props.file.unitFiles.map((file) => file.fileSize).filter((size): size is number => size != null)
+  return sizes.length ? sizes.reduce((total, size) => total + size, 0) : null
+})
+
 const subtitle = computed(() => {
   const parts = [author.value || t('bookDock.layout.row.noAuthor')]
-  if (props.file.fileSize != null) parts.push(formatBytes(props.file.fileSize))
+  const sizeBytes = isUnit.value ? unitSizeBytes.value : props.file.fileSize
+  if (sizeBytes != null) parts.push(formatBytes(sizeBytes))
   if (props.file.format) parts.push(props.file.format.toUpperCase())
   return parts.join(' · ')
 })
 
+function unitFileDetail(file: BookDockFile['unitFiles'][number]): string {
+  const parts = [t(`bookDock.layout.unit.role.${file.role}`)]
+  if (file.fileSize != null) parts.push(formatBytes(file.fileSize))
+  return parts.join(' · ')
+}
+
 function onSelect(event: MouseEvent) {
   emit('select', props.file.id, event.shiftKey)
 }
@@ -139,6 +154,16 @@ function onRetry() {
       </button>
 
       <span class="row-meta flex shrink-0 items-center gap-1.5">
+        <!-- The row's own name is the primary file's, so without this a 31-track audiobook reads
+             as a single mp3 until someone expands it. -->
+        <span
+          v-if="isUnit"
+          class="inline-flex items-center gap-1 rounded-md bg-muted px-1.5 py-0.5 text-[10.5px] font-semibold text-muted-foreground"
+        >
+          <Files class="size-2.5" aria-hidden="true" />
+          {{ t('bookDock.layout.unit.fileCount', { count: props.file.unitFiles.length }) }}
+        </span>
+
         <!-- Known before finalize rather than discovered during it. -->
         <span
           v-if="props.conflict"
@@ -257,6 +282,25 @@ function onRetry() {
     </div>
 
     <div v-if="props.expanded" class="border-t border-border bg-muted/25 px-3 py-2.5 sm:pl-[3.4rem]">
+      <!-- Read-only on purpose: a unit is filed whole, so "finalize track 7 of 31" is not a
+           thing the interface should let anyone express. -->
+      <div v-if="isUnit" class="mb-2.5 rounded-lg border border-border bg-card p-3">
+        <p class="mb-2 text-[9.5px] font-semibold uppercase tracking-[0.09em] text-muted-foreground">
+          {{ t('bookDock.layout.unit.filesHeading', { count: props.file.unitFiles.length }) }}
+        </p>
+        <ol class="grid gap-1">
+          <li
+            v-for="(unitFile, unitFileIndex) in props.file.unitFiles"
+            :key="`${unitFileIndex}:${unitFile.fileName}`"
+            class="flex min-w-0 items-baseline gap-2 text-xs"
+          >
+            <span class="w-6 shrink-0 text-right tabular-nums text-muted-foreground">{{ unitFileIndex + 1 }}</span>
+            <span class="min-w-0 flex-1 truncate text-foreground">{{ unitFile.fileName }}</span>
+            <span class="shrink-0 text-muted-foreground">{{ unitFileDetail(unitFile) }}</span>
+          </li>
+        </ol>
+      </div>
+
       <div class="rounded-lg border border-border bg-card p-3">
         <div class="mb-2 flex items-center gap-2">
           <p class="text-[9.5px] font-semibold uppercase tracking-[0.09em] text-muted-foreground">
diff --git a/client/src/features/book-dock/components/__tests__/BookDockFileRow.spec.ts b/client/src/features/book-dock/components/__tests__/BookDockFileRow.spec.ts
index 8bbd773ec..9825fdf70 100644
--- a/client/src/features/book-dock/components/__tests__/BookDockFileRow.spec.ts
+++ b/client/src/features/book-dock/components/__tests__/BookDockFileRow.spec.ts
@@ -1,49 +1,74 @@
-import { createI18n } from 'vue-i18n'
-import { shallowMount } from '@vue/test-utils'
+import { mount, shallowMount } from '@vue/test-utils'
 import { describe, expect, it } from 'vitest'
-import type { BookDockFile } from '@bookorbit/types'
-import BookDockFileRow from '../BookDockFileRow.vue'
-import en from '@/locales/en.json'
+import type { BookDockFile, BookDockUnitFile } from '@bookorbit/types'
 
-function file(status: BookDockFile['status']): BookDockFile {
+import BookDockFileRow from '../BookDockFileRow.vue'
+
+function unitFile(overrides: Partial<BookDockUnitFile> = {}): BookDockUnitFile {
+  return { fileName: 'track-01.mp3', fileSize: 1024, format: 'mp3', role: 'content', sortOrder: 0, ...overrides }
+}
+
+function file(overrides: Partial<BookDockFile> = {}): BookDockFile {
   return {
-    id: 42,
-    fileName: 'book.epub',
+    id: 1,
+    fileName: 'track-01.mp3',
     fileSize: 1024,
-    format: 'epub',
-    status,
-    embeddedMetadata: { title: 'Book' },
+    format: 'mp3',
+    status: 'ready',
+    embeddedMetadata: { title: 'Neuromancer', authors: ['William Gibson'] },
     selectedMetadata: null,
     fetchedMetadata: null,
-    targetLibraryId: null,
-    targetFolderId: null,
-    confidence: null,
+    targetLibraryId: 2,
+    targetFolderId: 3,
+    confidence: 90,
     fetchedMetadataSources: null,
     errorMessage: null,
     metadataEditedAt: null,
     createdAt: '2026-01-01T00:00:00.000Z',
     updatedAt: '2026-01-01T00:00:00.000Z',
+    unitFiles: [],
+    ...overrides,
   }
 }
 
-function mountRow(status: BookDockFile['status']) {
-  const i18n = createI18n({ legacy: false, locale: 'en', messages: { en } })
+function mountStatusRow(status: BookDockFile['status']) {
   return shallowMount(BookDockFileRow, {
     props: {
-      file: file(status),
+      file: file({
+        id: 42,
+        fileName: 'book.epub',
+        format: 'epub',
+        status,
+        embeddedMetadata: { title: 'Book' },
+        targetLibraryId: null,
+        targetFolderId: null,
+        confidence: null,
+      }),
       selected: false,
       expanded: false,
       focused: false,
       libraryName: null,
       targetLabel: 'Unassigned',
     },
-    global: { plugins: [i18n] },
+  })
+}
+
+function mountUnitRow(overrides: Partial<BookDockFile> = {}, expanded = false) {
+  return mount(BookDockFileRow, {
+    props: {
+      file: file(overrides),
+      selected: false,
+      expanded,
+      focused: false,
+      libraryName: 'Books',
+      targetLabel: 'Books / Audiobooks',
+    },
   })
 }
 
 describe('BookDockFileRow metadata refetch action', () => {
   it.each(['ready', 'error'] as const)('emits retry for a %s file', async (status) => {
-    const wrapper = mountRow(status)
+    const wrapper = mountStatusRow(status)
 
     await wrapper.get('[data-testid="book-dock-row-retry"]').trigger('click')
 
@@ -51,16 +76,57 @@ describe('BookDockFileRow metadata refetch action', () => {
   })
 
   it.each(['pending', 'extracting', 'fetching'] as const)('disables refetch while a file is %s', (status) => {
-    const wrapper = mountRow(status)
+    const wrapper = mountStatusRow(status)
 
     expect(wrapper.get('[data-testid="book-dock-row-retry"]').attributes('disabled')).toBeDefined()
   })
 
   it('requests confirmation instead of deleting from the row', async () => {
-    const wrapper = mountRow('ready')
+    const wrapper = mountStatusRow('ready')
 
     await wrapper.get('[data-testid="book-dock-row-discard"]').trigger('click')
 
     expect(wrapper.emitted('discard')).toEqual([[expect.objectContaining({ id: 42 })]])
   })
 })
+
+describe('BookDockFileRow with a multi-file unit', () => {
+  const TRACKS = [
+    unitFile({ fileName: 'track-01.mp3', sortOrder: 0 }),
+    unitFile({ fileName: 'track-02.mp3', sortOrder: 1 }),
+    unitFile({ fileName: 'cover.jpg', format: 'jpg', role: 'cover', sortOrder: null, fileSize: 512 }),
+  ]
+
+  /** The row is named after its primary file, so without the badge it reads as a single mp3. */
+  it('badges the row with how many files the entry actually holds', () => {
+    expect(mountUnitRow({ unitFiles: TRACKS }).text()).toContain('3 files')
+  })
+
+  it('leaves an ordinary single file unbadged', () => {
+    expect(mountUnitRow().text()).not.toContain('3 files')
+  })
+
+  /** The anchor row's own size is one track's; the row must show what the whole unit weighs. */
+  it('sums the unit size rather than reporting the primary file alone', () => {
+    expect(mountUnitRow({ unitFiles: TRACKS }).text()).toContain('2.5 KB')
+  })
+
+  it('lists the unit files in order with their roles once expanded', () => {
+    const text = mountUnitRow({ unitFiles: TRACKS }, true).text()
+
+    expect(text).toContain('3 files in this entry')
+    expect(text).toContain('track-01.mp3')
+    expect(text).toContain('track-02.mp3')
+    expect(text).toContain('Cover')
+    expect(text.indexOf('track-01.mp3')).toBeLessThan(text.indexOf('track-02.mp3'))
+  })
+
+  /** A unit is filed whole, so "finalize track 7 of 31" must not be expressible. */
+  it('offers no per-file control in the expanded list', () => {
+    const wrapper = mountUnitRow({ unitFiles: TRACKS }, true)
+    const list = wrapper.get('ol')
+
+    expect(list.findAll('button')).toHaveLength(0)
+    expect(list.findAll('input')).toHaveLength(0)
+  })
+})
diff --git a/client/src/features/book-dock/components/__tests__/BookDockFileSheet.spec.ts b/client/src/features/book-dock/components/__tests__/BookDockFileSheet.spec.ts
index 476b9ab06..d6fe26899 100644
--- a/client/src/features/book-dock/components/__tests__/BookDockFileSheet.spec.ts
+++ b/client/src/features/book-dock/components/__tests__/BookDockFileSheet.spec.ts
@@ -80,6 +80,7 @@ function makeFile(overrides: Partial<BookDockFile> = {}): BookDockFile {
     metadataEditedAt: null,
     createdAt: '2026-01-01T00:00:00.000Z',
     updatedAt: '2026-01-01T00:00:00.000Z',
+    unitFiles: [],
     ...overrides,
   }
 }
diff --git a/client/src/features/book-requests/BookRequestsPage.vue b/client/src/features/book-requests/BookRequestsPage.vue
new file mode 100644
index 000000000..f92ea99b6
--- /dev/null
+++ b/client/src/features/book-requests/BookRequestsPage.vue
@@ -0,0 +1,798 @@
+<script setup lang="ts">
+import { computed, onMounted, provide, ref, watch } from 'vue'
+import { useI18n } from 'vue-i18n'
+import { useRoute, useRouter } from 'vue-router'
+import { toast } from 'vue-sonner'
+import { BookPlus, Rows3, Rows4, X } from '@lucide/vue'
+import { BOOK_REQUEST_MEDIA_KINDS, BOOK_REQUEST_STATUSES, Permission } from '@bookorbit/types'
+import type { BookRequestBulkResult, BookRequestItem, BookRequestSortField, BookRequestStatus } from '@bookorbit/types'
+import { Button } from '@/components/ui/button'
+import ConfirmDialog from '@/components/ui/ConfirmDialog.vue'
+import { usePermissions } from '@/features/auth/composables/usePermissions'
+import { useAuth } from '@/features/auth/composables/useAuth'
+import { formatCompactNumber, formatNumber } from '@/i18n/formatters'
+import { canBulkActRequest, canDismissRequest, cancelStopsATransfer } from './requestActions'
+import RequestDrawer from './components/RequestDrawer.vue'
+import NoRequestSourcesNotice from './components/NoRequestSourcesNotice.vue'
+import RequestEmptyState from './components/RequestEmptyState.vue'
+import RequestListSkeleton from './components/RequestListSkeleton.vue'
+import RequestListTable from './components/RequestListTable.vue'
+import RequestSearchPanel from './components/RequestSearchPanel.vue'
+import { useBookRequestActions, useBookRequests, type ActionOutcome } from './composables/useBookRequests'
+import { useBookRequestProgress } from './composables/useBookRequestProgress'
+import { useBookRequestSummary } from './composables/useBookRequestSummary'
+import { useRequestSourceStatus } from './composables/useRequestSourceStatus'
+import { useCoalescedRefresh } from './composables/useCoalescedRefresh'
+import { useRequestListDensity } from './composables/useRequestListDensity'
+import { useRequestQueue } from './composables/useRequestQueue'
+import { useRouteTab } from '@/composables/useRouteTab'
+import { REQUEST_DRAWER } from './requestDrawerContext'
+import { localizedRequestActionFailure } from './requestActionFailure'
+
+const TABS = ['search', 'mine', 'all'] as const
+type RequestsTab = (typeof TABS)[number]
+
+/** How close together two change broadcasts have to be for the page to answer them once. */
+const CHANGE_REFRESH_WINDOW_MS = 400
+
+const { t } = useI18n()
+const route = useRoute()
+const router = useRouter()
+const { hasPermission } = usePermissions()
+const { user } = useAuth()
+
+const canManage = computed(() => hasPermission(Permission.ManageBookRequests))
+const canSelfFulfil = computed(() => hasPermission(Permission.BookRequestSelfFulfill))
+const availableTabs = computed<RequestsTab[]>(() => (canManage.value ? [...TABS] : ['search', 'mine']))
+
+function normalizeTab(value: unknown): RequestsTab {
+  return typeof value === 'string' && (TABS as readonly string[]).includes(value) ? (value as RequestsTab) : 'search'
+}
+
+const { activeTab, selectTab } = useRouteTab<RequestsTab>({
+  normalize: normalizeTab,
+  availableTabs,
+  fallback: 'search',
+})
+
+const mine = useBookRequests('mine')
+const all = useBookRequests('all')
+const actions = useBookRequestActions(() => hasPermission(Permission.ManageBookRequests))
+const { summary: requestSummary, fetchSummary, refreshSummary } = useBookRequestSummary()
+const { noSourcesEnabled, noSourcesConfigured, fetchSourceStatus } = useRequestSourceStatus()
+const { density, setDensity } = useRequestListDensity()
+
+const { progressByRequest, onRequestsChanged, pruneSettledProgress } = useBookRequestProgress()
+
+const activeList = computed(() => (activeTab.value === 'all' ? all : mine))
+const activeItems = computed(() => activeList.value.items.value)
+const tabCounts = computed<Record<RequestsTab, number | null>>(() => ({
+  search: null,
+  mine: requestSummary.value?.mineTotal ?? null,
+  all: canManage.value ? (requestSummary.value?.allTotal ?? null) : null,
+}))
+
+/**
+ * The open request is whatever the child route names, so the drawer is a function of the URL and
+ * nothing else. A hard load of /requests/34 opens it; closing it is a navigation, not local state.
+ */
+const openRequestId = computed(() => {
+  const id = Number(route.params.id)
+  return Number.isInteger(id) && id > 0 ? id : null
+})
+const drawerOpen = computed(() => openRequestId.value !== null)
+const drawerLevel = computed<1 | 2>(() => (route.name === 'book-request-releases' ? 2 : 1))
+
+const queue = useRequestQueue(activeItems, openRequestId)
+const busyIds = computed(() => actions.pendingIds.value)
+const isCompact = computed(() => density.value === 'compact')
+
+/**
+ * Ids rather than rows: the list refetches under the selection on every progress transition, and
+ * holding the row objects would keep a stale copy of whatever the tick just changed.
+ */
+const selectedIds = ref<number[]>([])
+const selectedRows = computed(() => activeList.value.items.value.filter((request) => selectedIds.value.includes(request.id)))
+const selectableRows = computed(() => activeList.value.items.value.filter((request) => canBulkActRequest(request, canManage.value)))
+
+/**
+ * A selection can mix states, so each bulk button owns its own subset and says how big it is.
+ * Nothing is offered for rows it could not apply to, which is what stops a batch from being half
+ * refusals by construction.
+ */
+const approvableSelection = computed(() => selectedRows.value.filter((request) => canManage.value && request.status === 'pending'))
+const rejectableSelection = computed(() => selectedRows.value.filter((request) => canManage.value && request.status === 'pending'))
+const dismissableSelection = computed(() => selectedRows.value.filter((request) => canDismissRequest(request) && !request.dismissed))
+
+provide(REQUEST_DRAWER, {
+  position: queue.position,
+  total: queue.total,
+  hasPrevious: queue.hasPrevious,
+  hasNext: queue.hasNext,
+  goPrevious: goToPreviousRequest,
+  goNext: goToNextRequest,
+  close: closeDrawer,
+})
+
+const STATUS_FILTERS: Array<BookRequestStatus | ''> = ['', ...BOOK_REQUEST_STATUSES]
+
+const confirming = ref<{ request: BookRequestItem; action: 'cancel' | 'delete' } | null>(null)
+/** Open while the approver is writing the one reason the whole selection is being turned down for. */
+const rejectingSelection = ref(false)
+const rejectNote = ref('')
+
+const confirmTitle = computed(() =>
+  confirming.value?.action === 'delete' ? t('bookRequests.confirm.deleteTitle') : t('bookRequests.confirm.cancelTitle'),
+)
+
+const confirmDescription = computed(() => {
+  if (!confirming.value) return ''
+  if (confirming.value.action === 'delete') return t('bookRequests.confirm.deleteDescription')
+  return cancelStopsATransfer(confirming.value.request)
+    ? t('bookRequests.confirm.cancelDescriptionWithDownload')
+    : t('bookRequests.confirm.cancelDescription')
+})
+
+const confirmLabel = computed(() => (confirming.value?.action === 'delete' ? t('bookRequests.actions.delete') : t('bookRequests.actions.cancel')))
+/** The dialog acts on one row, so it is busy only while that row's own action is running. */
+const confirmBusy = computed(() => actions.isPending(confirming.value?.request.id))
+
+async function loadActive() {
+  if (activeTab.value === 'mine') await mine.fetchRequests()
+  else if (activeTab.value === 'all') await Promise.all([all.fetchRequests(), all.fetchRequesterOptions()])
+}
+
+function reloadActive() {
+  void loadActive()
+}
+
+/** A refetch can drop or settle a selected row, so the selection is trimmed to what is still there. */
+function pruneSelection() {
+  const present = new Set(selectableRows.value.map((request) => request.id))
+  selectedIds.value = selectedIds.value.filter((id) => present.has(id))
+}
+
+onMounted(() => {
+  void loadActive()
+  void fetchSummary()
+  void fetchSourceStatus()
+})
+
+function refreshAfterChange() {
+  void loadActive()
+  void refreshSummary()
+}
+
+// A status transition is more than a percentage, so the pipeline's coarse signal refetches.
+onRequestsChanged(useCoalescedRefresh(refreshAfterChange, CHANGE_REFRESH_WINDOW_MS))
+
+watch(activeTab, () => {
+  selectedIds.value = []
+  void loadActive()
+})
+
+watch(() => activeList.value.items.value, onRowsChanged)
+
+/** A refetch both trims the selection and retires the live ticks the fetched rows have overtaken. */
+function onRowsChanged() {
+  pruneSelection()
+  pruneSettledProgress(activeList.value.items.value)
+}
+
+function selectSearchTab() {
+  selectTab('search')
+}
+
+function selectComfortableDensity() {
+  setDensity('comfortable')
+}
+
+function selectCompactDensity() {
+  setDensity('compact')
+}
+
+/** A selection only means anything against the rows on screen, so anything that reloads clears it. */
+function clearSelection() {
+  selectedIds.value = []
+}
+
+function toggleSelect(request: BookRequestItem) {
+  const index = selectedIds.value.indexOf(request.id)
+  if (index === -1) selectedIds.value.push(request.id)
+  else selectedIds.value.splice(index, 1)
+}
+
+/** Tick-all covers the rows that can actually be approved, not every row on the page. */
+function toggleSelectAll() {
+  const ids = selectableRows.value.map((request) => request.id)
+  const alreadyAll = ids.length > 0 && ids.every((id) => selectedIds.value.includes(id))
+  selectedIds.value = alreadyAll ? [] : ids
+}
+
+function handleSort(field: BookRequestSortField) {
+  clearSelection()
+  void activeList.value.applySort(field)
+}
+
+/**
+ * A row opens the drawer by naming it in the URL, which is the only place the open id lives. The
+ * query rides along on every hop: the tab and the filters live there, and a push that names only
+ * the route drops them, so a refresh inside the drawer would land back on a different tab.
+ */
+function openRequest(request: BookRequestItem) {
+  void router.push({ name: 'book-request-detail', params: { id: request.id }, query: route.query })
+}
+
+function openReleases(request: BookRequestItem) {
+  void router.push({ name: 'book-request-releases', params: { id: request.id }, query: route.query })
+}
+
+/** The tab and the filters behind the drawer are in the query, so closing keeps them. */
+function closeDrawer() {
+  void router.push({ name: 'book-requests', query: route.query })
+}
+
+/** Back out of the release picker without losing the request it was opened for. */
+function returnToRequest() {
+  if (openRequestId.value === null) return
+  void router.push({ name: 'book-request-detail', params: { id: openRequestId.value }, query: route.query })
+}
+
+function stepTo(id: number | null) {
+  if (id === null) return
+  void router.push({ name: 'book-request-detail', params: { id }, query: route.query })
+}
+
+function goToPreviousRequest() {
+  stepTo(queue.previousId.value)
+}
+
+function goToNextRequest() {
+  stepTo(queue.nextId.value)
+}
+
+/** The row is gone for good, so both tabs let go of it rather than one keeping a dead id. */
+function dropFromLists(id: number) {
+  mine.dropItem(id)
+  all.dropItem(id)
+}
+
+/**
+ * One decision updates whichever lists are holding that row, so the tabs cannot disagree.
+ *
+ * The outcome is the call's own rather than the composable's latest, so acting on two rows at once
+ * cannot attach one row's refusal to the other's toast.
+ */
+function applyUpdate(outcome: ActionOutcome, failureKey: string): boolean {
+  if (!outcome.item) {
+    const localized = localizedRequestActionFailure(outcome)
+    const description = localized ? t(localized.key, localized.params) : outcome.reason
+    toast.error(t(failureKey), description ? { description } : undefined)
+    return false
+  }
+  mine.replaceItem(outcome.item)
+  all.replaceItem(outcome.item)
+  return true
+}
+
+/** Approving needs a destination, so a request without one goes to the page that can pick one. */
+async function approveRequest(request: BookRequestItem) {
+  if (request.targetLibraryId === null) {
+    openRequest(request)
+    return
+  }
+  const outcome = await actions.approve(request.id, {
+    targetLibraryId: request.targetLibraryId,
+    targetFolderId: request.targetFolderId ?? undefined,
+  })
+  if (applyUpdate(outcome, 'bookRequests.errors.approveFailed')) toast.success(t('bookRequests.toasts.approved'))
+}
+
+async function rejectRequest(request: BookRequestItem) {
+  const outcome = await actions.reject(request.id, {})
+  if (applyUpdate(outcome, 'bookRequests.errors.rejectFailed')) toast.success(t('bookRequests.toasts.rejected'))
+}
+
+async function cancelRequest(request: BookRequestItem) {
+  const outcome = await actions.cancel(request.id)
+  if (applyUpdate(outcome, 'bookRequests.errors.cancelFailed')) toast.success(t('bookRequests.toasts.cancelled'))
+}
+
+/**
+ * A dismissed row leaves the list it was hiding from, unless the list is showing dismissed rows,
+ * where it stays and picks up the badge instead.
+ */
+async function dismissRequest(request: BookRequestItem) {
+  const outcome = await actions.dismiss(request.id)
+  if (!applyUpdate(outcome, 'bookRequests.errors.dismissFailed')) return
+  if (!activeList.value.includeDismissed.value) dropFromLists(request.id)
+  void refreshSummary()
+  toast.success(t('bookRequests.toasts.dismissed'))
+}
+
+async function restoreRequest(request: BookRequestItem) {
+  const outcome = await actions.restore(request.id)
+  if (!applyUpdate(outcome, 'bookRequests.errors.restoreFailed')) return
+  void refreshSummary()
+  toast.success(t('bookRequests.toasts.restored'))
+}
+
+async function deleteRequest(request: BookRequestItem) {
+  const outcome = await actions.remove(request.id)
+  if (!outcome.ok) {
+    toast.error(t('bookRequests.errors.deleteFailed'), outcome.reason ? { description: outcome.reason } : undefined)
+    return
+  }
+  dropFromLists(request.id)
+  toast.success(t('bookRequests.toasts.deleted'))
+}
+
+function handleApprove(request: BookRequestItem) {
+  void approveRequest(request)
+}
+
+function handleReject(request: BookRequestItem) {
+  void rejectRequest(request)
+}
+
+/** Stopping a live transfer and deleting a row both ask first; the rest are one click. */
+function handleCancel(request: BookRequestItem) {
+  if (cancelStopsATransfer(request)) confirming.value = { request, action: 'cancel' }
+  else void cancelRequest(request)
+}
+
+function handleDismiss(request: BookRequestItem) {
+  void dismissRequest(request)
+}
+
+function handleRestore(request: BookRequestItem) {
+  void restoreRequest(request)
+}
+
+function handleRemove(request: BookRequestItem) {
+  confirming.value = { request, action: 'delete' }
+}
+
+/** Open until the action settles, so `busy` has something to render and a second Enter does nothing. */
+async function handleConfirm() {
+  const pending = confirming.value
+  if (!pending) return
+  if (pending.action === 'delete') await deleteRequest(pending.request)
+  else await cancelRequest(pending.request)
+  confirming.value = null
+}
+
+function handleConfirmCancel() {
+  confirming.value = null
+}
+
+function handleShowDismissedChange() {
+  clearSelection()
+  void activeList.value.applyFilters()
+}
+
+/**
+ * The batch is partly successful by design, so the toast reports both halves. The refused rows
+ * carry the server's own sentence, which for a missing destination library is the fix itself.
+ */
+async function runBulk(
+  rows: BookRequestItem[],
+  call: (ids: number[]) => Promise<BookRequestBulkResult | null>,
+  keys: { failed: string; done: string; partial: string },
+  dropUpdated: boolean,
+) {
+  if (rows.length === 0) return
+
+  const result = await call(rows.map((request) => request.id))
+  if (!result) {
+    toast.error(t(keys.failed), actions.lastReason.value ? { description: actions.lastReason.value } : undefined)
+    return
+  }
+
+  for (const updated of result.updated) {
+    // A hidden row leaves the list it was hiding from, unless that list is showing hidden rows.
+    if (dropUpdated) dropFromLists(updated.id)
+    else {
+      mine.replaceItem(updated)
+      all.replaceItem(updated)
+    }
+  }
+  clearSelection()
+  void refreshSummary()
+
+  if (result.failed.length === 0) {
+    toast.success(t(keys.done, { count: result.updated.length }))
+    return
+  }
+  toast.warning(t(keys.partial, { done: result.updated.length, failed: result.failed.length }), {
+    description: result.failed
+      .map((failure) => {
+        const localized = localizedRequestActionFailure(failure)
+        return `${failure.title}: ${localized ? t(localized.key, localized.params) : failure.reason}`
+      })
+      .join('\n'),
+  })
+}
+
+function handleApproveSelected() {
+  void runBulk(
+    approvableSelection.value,
+    actions.approveMany,
+    {
+      failed: 'bookRequests.errors.bulkApproveFailed',
+      done: 'bookRequests.toasts.bulkApproved',
+      partial: 'bookRequests.toasts.bulkApprovedPartial',
+    },
+    false,
+  )
+}
+
+function handleRejectSelected() {
+  rejectNote.value = ''
+  rejectingSelection.value = true
+}
+
+function handleRejectSelectionCancel() {
+  rejectingSelection.value = false
+}
+
+function handleRejectSelectionConfirm() {
+  const note = rejectNote.value.trim()
+  const rows = rejectableSelection.value
+  rejectingSelection.value = false
+  void runBulk(
+    rows,
+    (ids) => actions.rejectMany(ids, note || undefined),
+    {
+      failed: 'bookRequests.errors.bulkRejectFailed',
+      done: 'bookRequests.toasts.bulkRejected',
+      partial: 'bookRequests.toasts.bulkRejectedPartial',
+    },
+    false,
+  )
+}
+
+function handleDismissSelected() {
+  void runBulk(
+    dismissableSelection.value,
+    actions.dismissMany,
+    {
+      failed: 'bookRequests.errors.bulkDismissFailed',
+      done: 'bookRequests.toasts.bulkDismissed',
+      partial: 'bookRequests.toasts.bulkDismissedPartial',
+    },
+    !activeList.value.includeDismissed.value,
+  )
+}
+
+function handleSubmitted() {
+  void mine.fetchRequests()
+  void refreshSummary()
+}
+
+function handleFilterChange() {
+  clearSelection()
+  void activeList.value.applyFilters()
+}
+
+function goToPreviousPage() {
+  clearSelection()
+  void activeList.value.goToPage(activeList.value.page.value - 1)
+}
+
+function goToNextPage() {
+  clearSelection()
+  void activeList.value.goToPage(activeList.value.page.value + 1)
+}
+</script>
+
+<template>
+  <div class="mx-auto flex w-full max-w-420 flex-col py-4">
+    <header class="mb-4">
+      <div class="flex items-center gap-2.5">
+        <div class="flex size-9 items-center justify-center rounded-lg bg-primary/10">
+          <BookPlus class="size-4.5 text-primary" aria-hidden="true" />
+        </div>
+        <h1 class="text-xl font-semibold tracking-tight text-foreground">{{ t('bookRequests.title') }}</h1>
+      </div>
+      <p class="mt-1.5 text-sm text-muted-foreground">{{ t('bookRequests.subtitle') }}</p>
+    </header>
+
+    <!--
+      Above the tabs rather than inside one of them: it is the same fact whether you are filing a
+      request or waiting on one, and the queue below it is otherwise a list of rows with no stated
+      reason for standing still.
+    -->
+    <NoRequestSourcesNotice v-if="noSourcesEnabled" :nothing-configured="noSourcesConfigured" class="mb-4" />
+
+    <!-- Underline tabs with a roving tabindex, matching the only other tablist in the app. -->
+    <div role="tablist" :aria-label="t('bookRequests.title')" class="mb-4 flex gap-1 border-b border-border">
+      <button
+        v-for="tab in availableTabs"
+        :id="`requests-tab-${tab}`"
+        :key="tab"
+        type="button"
+        role="tab"
+        :aria-selected="activeTab === tab"
+        :aria-controls="`requests-panel-${tab}`"
+        :tabindex="activeTab === tab ? 0 : -1"
+        class="-mb-px shrink-0 border-b-2 px-3 py-2.5 text-sm font-medium transition-colors focus-visible:ring-2 focus-visible:ring-ring focus-visible:outline-none motion-reduce:transition-none"
+        :class="activeTab === tab ? 'border-primary text-foreground' : 'border-transparent text-muted-foreground hover:text-foreground'"
+        @click="selectTab(tab)"
+      >
+        {{ t(`bookRequests.tabs.${tab}`) }}
+        <template v-if="tabCounts[tab] !== null">
+          <span
+            class="ms-1 inline-flex h-5 min-w-5 items-center justify-center rounded-full bg-primary/15 px-1.5 text-xs font-semibold text-primary tabular-nums"
+            aria-hidden="true"
+          >
+            {{ formatCompactNumber(tabCounts[tab] ?? 0) }}
+          </span>
+          <span class="sr-only">{{ formatNumber(tabCounts[tab] ?? 0) }}</span>
+        </template>
+      </button>
+    </div>
+
+    <!--
+      The lists want every pixel; this tab is a form and a result list, and stretching a search
+      field to the full width only pushes its own submit button away from what you just typed. It
+      is capped rather than centred, so switching tabs does not shift the content sideways.
+    -->
+    <section v-if="activeTab === 'search'" id="requests-panel-search" role="tabpanel" aria-labelledby="requests-tab-search" class="w-full max-w-5xl">
+      <RequestSearchPanel @submitted="handleSubmitted" />
+    </section>
+
+    <section v-else :id="`requests-panel-${activeTab}`" role="tabpanel" :aria-labelledby="`requests-tab-${activeTab}`" class="space-y-4">
+      <div class="flex flex-wrap items-center justify-between gap-3">
+        <div class="flex flex-wrap items-center gap-2">
+          <!-- Each label travels with its own control: the bar wraps, and a lone label stranded on
+               the line above its select is what it looked like before these were grouped. -->
+          <div class="flex items-center gap-2">
+            <label :for="`requests-status-${activeTab}`" class="text-sm text-muted-foreground">
+              {{ t('bookRequests.filters.status') }}
+            </label>
+            <select
+              :id="`requests-status-${activeTab}`"
+              v-model="activeList.status.value"
+              class="h-8 rounded-md border border-input bg-background px-2 text-sm text-foreground focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 focus-visible:outline-none"
+              @change="handleFilterChange"
+            >
+              <option v-for="status in STATUS_FILTERS" :key="status || 'any'" :value="status">
+                {{ status ? t(`bookRequests.status.${status}`) : t('bookRequests.filters.anyStatus') }}
+              </option>
+            </select>
+          </div>
+
+          <div class="flex items-center gap-2">
+            <label :for="`requests-media-${activeTab}`" class="text-sm text-muted-foreground">
+              {{ t('bookRequests.filters.mediaKind') }}
+            </label>
+            <select
+              :id="`requests-media-${activeTab}`"
+              v-model="activeList.mediaKind.value"
+              class="h-8 rounded-md border border-input bg-background px-2 text-sm text-foreground focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 focus-visible:outline-none"
+              @change="handleFilterChange"
+            >
+              <option value="">{{ t('bookRequests.filters.anyMediaKind') }}</option>
+              <option v-for="mediaKind in BOOK_REQUEST_MEDIA_KINDS" :key="mediaKind" :value="mediaKind">
+                {{ t(`bookRequests.mediaKind.${mediaKind}`) }}
+              </option>
+            </select>
+          </div>
+
+          <div v-if="activeTab === 'all'" class="flex items-center gap-2">
+            <label for="requests-requester-all" class="text-sm text-muted-foreground">
+              {{ t('bookRequests.filters.requester') }}
+            </label>
+            <select
+              id="requests-requester-all"
+              v-model.number="all.requesterUserId.value"
+              class="h-8 max-w-56 rounded-md border border-input bg-background px-2 text-sm text-foreground focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 focus-visible:outline-none"
+              @change="handleFilterChange"
+            >
+              <option value="">{{ t('bookRequests.filters.anyRequester') }}</option>
+              <option v-for="requester in all.requesterOptions.value" :key="requester.userId" :value="requester.userId">
+                {{ requester.name }} (@{{ requester.username }})
+              </option>
+            </select>
+          </div>
+
+          <!--
+            Server-side, unlike the badge it complements: filtering the twenty rows already fetched
+            would narrow a page rather than the queue, and page 2 would disagree with page 1.
+          -->
+          <div class="flex items-center gap-2">
+            <label :for="`requests-fulfilment-${activeTab}`" class="text-sm text-muted-foreground">
+              {{ t('bookRequests.filters.fulfilment') }}
+            </label>
+            <select
+              :id="`requests-fulfilment-${activeTab}`"
+              v-model="activeList.selfServe.value"
+              class="h-8 rounded-md border border-input bg-background px-2 text-sm text-foreground focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 focus-visible:outline-none"
+              @change="handleFilterChange"
+            >
+              <option value="">{{ t('bookRequests.filters.anyFulfilment') }}</option>
+              <option value="true">{{ t('bookRequests.filters.selfServeOnly') }}</option>
+              <option value="false">{{ t('bookRequests.filters.approvedOnly') }}</option>
+            </select>
+          </div>
+
+          <label class="flex items-center gap-2 text-sm text-muted-foreground">
+            <input
+              v-model="activeList.includeDismissed.value"
+              type="checkbox"
+              class="h-3.5 w-3.5 rounded border-border accent-primary"
+              @change="handleShowDismissedChange"
+            />
+            {{ t('bookRequests.filters.showDismissed') }}
+          </label>
+        </div>
+
+        <!-- One list at two row heights. Cards and the table were the same view twice over. -->
+        <div class="inline-flex gap-0.5 rounded-lg border border-border bg-muted p-0.5" role="group" :aria-label="t('bookRequests.density.label')">
+          <button
+            type="button"
+            class="inline-flex items-center gap-1.5 rounded-md px-2.5 py-1.5 text-sm font-medium transition-colors focus-visible:ring-2 focus-visible:ring-ring focus-visible:outline-none motion-reduce:transition-none"
+            :class="!isCompact ? 'bg-background text-foreground shadow-xs' : 'text-muted-foreground hover:text-foreground'"
+            :aria-pressed="!isCompact"
+            @click="selectComfortableDensity"
+          >
+            <Rows3 :size="14" aria-hidden="true" />
+            {{ t('bookRequests.density.comfortable') }}
+          </button>
+          <button
+            type="button"
+            class="inline-flex items-center gap-1.5 rounded-md px-2.5 py-1.5 text-sm font-medium transition-colors focus-visible:ring-2 focus-visible:ring-ring focus-visible:outline-none motion-reduce:transition-none"
+            :class="isCompact ? 'bg-background text-foreground shadow-xs' : 'text-muted-foreground hover:text-foreground'"
+            :aria-pressed="isCompact"
+            @click="selectCompactDensity"
+          >
+            <Rows4 :size="14" aria-hidden="true" />
+            {{ t('bookRequests.density.compact') }}
+          </button>
+        </div>
+      </div>
+
+      <!--
+        The skeleton is for a list with nothing on screen yet. A filter change, a page turn and a
+        progress tick all refetch, and swapping twenty rows out for six grey bars and back is a
+        flash rather than feedback: the rows stay put and go quiet instead.
+      -->
+      <RequestListSkeleton v-if="activeList.loading.value && activeList.items.value.length === 0" />
+
+      <!-- A failure with no way out of it leaves reloading the page as the only move. -->
+      <div v-else-if="activeList.error.value" role="alert" class="flex flex-wrap items-center gap-3">
+        <p class="text-sm text-destructive">{{ t('bookRequests.errors.loadFailed') }}</p>
+        <Button variant="outline" size="sm" :disabled="activeList.loading.value" @click="reloadActive">{{ t('common.retry') }}</Button>
+      </div>
+
+      <RequestEmptyState
+        v-else-if="activeList.items.value.length === 0"
+        :icon="BookPlus"
+        :title="activeTab === 'all' ? t('bookRequests.list.emptyAll') : t('bookRequests.list.emptyMine')"
+        :message="t('bookRequests.list.emptyHint')"
+      >
+        <Button v-if="activeTab !== 'all'" size="sm" @click="selectSearchTab">{{ t('bookRequests.tabs.search') }}</Button>
+      </RequestEmptyState>
+
+      <div v-else class="space-y-2" :aria-busy="activeList.loading.value">
+        <!--
+          Announced, because approving four rows at once and watching four buttons disappear is the
+          kind of change a screen reader user otherwise has to go looking for.
+        -->
+        <div
+          v-if="selectedIds.length > 0"
+          role="status"
+          class="flex flex-wrap items-center gap-2 rounded-lg border border-primary/30 bg-primary/10 px-3 py-2"
+        >
+          <span class="text-sm font-medium text-foreground">
+            {{ t('bookRequests.bulk.selected', { count: selectedIds.length }) }}
+          </span>
+          <Button v-if="approvableSelection.length > 0" size="sm" :disabled="actions.bulkPending.value" @click="handleApproveSelected">
+            {{ t('bookRequests.bulk.approveSelected', { count: approvableSelection.length }) }}
+          </Button>
+          <Button
+            v-if="rejectableSelection.length > 0"
+            variant="destructive-outline"
+            size="sm"
+            :disabled="actions.bulkPending.value"
+            @click="handleRejectSelected"
+          >
+            {{ t('bookRequests.bulk.rejectSelected', { count: rejectableSelection.length }) }}
+          </Button>
+          <Button
+            v-if="dismissableSelection.length > 0"
+            variant="outline"
+            size="sm"
+            :disabled="actions.bulkPending.value"
+            @click="handleDismissSelected"
+          >
+            {{ t('bookRequests.bulk.dismissSelected', { count: dismissableSelection.length }) }}
+          </Button>
+          <Button variant="ghost" size="sm" class="ms-auto" @click="clearSelection">
+            <X :size="14" aria-hidden="true" />
+            {{ t('bookRequests.bulk.clear') }}
+          </Button>
+        </div>
+
+        <RequestListTable
+          class="transition-opacity duration-150 motion-reduce:transition-none"
+          :class="activeList.loading.value && 'opacity-60'"
+          :requests="activeList.items.value"
+          :can-manage="canManage"
+          :can-self-fulfil="canSelfFulfil"
+          :current-user-id="user?.id ?? null"
+          :busy-ids="busyIds"
+          :progress-by-request="progressByRequest"
+          :density="density"
+          :sort-by="activeList.sortBy.value"
+          :sort-dir="activeList.sortDir.value"
+          :selected-ids="selectedIds"
+          @open="openRequest"
+          @approve="handleApprove"
+          @reject="handleReject"
+          @cancel="handleCancel"
+          @dismiss="handleDismiss"
+          @restore="handleRestore"
+          @remove="handleRemove"
+          @grab="openReleases"
+          @sort="handleSort"
+          @toggle-select="toggleSelect"
+          @toggle-select-all="toggleSelectAll"
+        />
+      </div>
+
+      <nav v-if="activeList.pageCount.value > 1" class="flex items-center justify-between" :aria-label="t('bookRequests.list.pagination')">
+        <Button variant="outline" size="sm" :disabled="activeList.page.value <= 1" @click="goToPreviousPage">
+          {{ t('common.previous') }}
+        </Button>
+        <span class="text-sm text-muted-foreground">
+          {{ t('bookRequests.list.pageOf', { page: activeList.page.value, total: activeList.pageCount.value }) }}
+        </span>
+        <Button variant="outline" size="sm" :disabled="activeList.page.value >= activeList.pageCount.value" @click="goToNextPage">
+          {{ t('common.next') }}
+        </Button>
+      </nav>
+    </section>
+
+    <ConfirmDialog
+      :open="confirming !== null"
+      :title="confirmTitle"
+      :description="confirmDescription"
+      :confirm-label="confirmLabel"
+      :busy="confirmBusy"
+      @confirm="handleConfirm"
+      @cancel="handleConfirmCancel"
+    />
+
+    <!--
+      A reason, because a batch is refused for one reason or none and this is the one bulk action
+      the people who asked are told about. Optional: "no" with nothing after it is still an answer.
+    -->
+    <ConfirmDialog
+      :open="rejectingSelection"
+      :title="t('bookRequests.bulk.rejectTitle', { count: rejectableSelection.length })"
+      :description="t('bookRequests.confirm.rejectDescription')"
+      :confirm-label="t('bookRequests.bulk.rejectConfirm')"
+      :busy="actions.bulkPending.value"
+      @confirm="handleRejectSelectionConfirm"
+      @cancel="handleRejectSelectionCancel"
+    >
+      <label for="bulk-reject-note" class="mt-4 block text-sm font-medium text-foreground">
+        {{ t('bookRequests.bulk.rejectNoteLabel') }}
+      </label>
+      <textarea
+        id="bulk-reject-note"
+        v-model="rejectNote"
+        rows="3"
+        maxlength="2000"
+        class="mt-1.5 w-full resize-y rounded-md border border-input bg-background px-3 py-2 text-sm text-foreground placeholder:text-muted-foreground focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 focus-visible:outline-none"
+        :placeholder="t('bookRequests.bulk.rejectNotePlaceholder')"
+      ></textarea>
+    </ConfirmDialog>
+
+    <RequestDrawer :open="drawerOpen" :level="drawerLevel" @close="closeDrawer" @back="returnToRequest">
+      <router-view />
+    </RequestDrawer>
+  </div>
+</template>
diff --git a/client/src/features/book-requests/__tests__/ReleaseFileInspectionPanel.spec.ts b/client/src/features/book-requests/__tests__/ReleaseFileInspectionPanel.spec.ts
new file mode 100644
index 000000000..a23264f1d
--- /dev/null
+++ b/client/src/features/book-requests/__tests__/ReleaseFileInspectionPanel.spec.ts
@@ -0,0 +1,227 @@
+import { mount } from '@vue/test-utils'
+import { describe, expect, it } from 'vitest'
+import type { ReleaseFileInspection } from '@bookorbit/types'
+import ReleaseFileInspectionPanel from '../components/ReleaseFileInspectionPanel.vue'
+
+function inspection(overrides: Partial<ReleaseFileInspection> = {}): ReleaseFileInspection {
+  return {
+    source: 'torrent_file',
+    status: 'ready',
+    files: [{ path: 'Pride and Prejudice/Pride and Prejudice.epub', sizeBytes: 2048, bookFile: true }],
+    totalFiles: 1,
+    primaryFileCount: 1,
+    truncated: false,
+    units: [{ mediaKind: 'ebook', title: 'Pride and Prejudice', contentFileCount: 1, totalFileCount: 1, sizeBytes: 2048 }],
+    unitCount: 1,
+    ignoredFileCount: 0,
+    containerCount: 0,
+    ...overrides,
+  }
+}
+
+function mountPanel(
+  overrides: Partial<{ inspection: ReleaseFileInspection | null; loading: boolean; failed: boolean; failureReason: string | null }> = {},
+) {
+  return mount(ReleaseFileInspectionPanel, {
+    props: { inspection: inspection(), loading: false, failed: false, ...overrides },
+  })
+}
+
+describe('ReleaseFileInspectionPanel', () => {
+  it('shows the actual manifest path and size', () => {
+    const wrapper = mountPanel()
+
+    expect(wrapper.text()).toContain('Pride and Prejudice/Pride and Prejudice.epub')
+    expect(wrapper.text()).toContain('2 KB')
+    expect(wrapper.get('[role="status"]').text()).toContain('1 file')
+  })
+
+  /** Marking every file in a list where every file is a book file marks nothing. */
+  it('leaves the files unmarked when they are all book files', () => {
+    const wrapper = mountPanel({
+      inspection: inspection({
+        files: [
+          { path: 'Dune/Dune.epub', sizeBytes: 2048, bookFile: true },
+          { path: 'Dune/Dune.azw3', sizeBytes: 4096, bookFile: true },
+        ],
+      }),
+    })
+
+    expect(wrapper.text()).not.toContain('Book file')
+    expect(wrapper.text()).not.toContain('Extra')
+  })
+
+  /** Three formats and a cover: the cover is the exception, so the cover is what gets marked. */
+  it('marks the extras rather than the book files when the books are the majority', () => {
+    const wrapper = mountPanel({
+      inspection: inspection({
+        files: [
+          { path: 'Dune/Dune.epub', sizeBytes: 2048, bookFile: true },
+          { path: 'Dune/Dune.azw3', sizeBytes: 4096, bookFile: true },
+          { path: 'Dune/Dune.mobi', sizeBytes: 4096, bookFile: true },
+          { path: 'Dune/cover.jpg', sizeBytes: 1024, bookFile: false },
+        ],
+      }),
+    })
+
+    expect(wrapper.text()).toContain('Extra')
+    expect(wrapper.text()).not.toContain('Book file')
+  })
+
+  /** One epub in a pack of junk: now the book file is the exception, so it is marked instead. */
+  it('marks the book files when they are the minority', () => {
+    const wrapper = mountPanel({
+      inspection: inspection({
+        files: [
+          { path: 'pack/Dune.epub', sizeBytes: 2048, bookFile: true },
+          { path: 'pack/readme.nfo', sizeBytes: 512, bookFile: false },
+          { path: 'pack/sample.txt', sizeBytes: 512, bookFile: false },
+        ],
+      }),
+    })
+
+    expect(wrapper.text()).toContain('Book file')
+    expect(wrapper.text()).not.toContain('Extra')
+  })
+
+  it('warns when a torrent has no directly supported book file', () => {
+    const wrapper = mountPanel({
+      inspection: inspection({
+        status: 'no_supported_file',
+        files: [{ path: 'release/book.zip', sizeBytes: 8192, bookFile: false }],
+        primaryFileCount: 0,
+      }),
+    })
+
+    expect(wrapper.get('[role="alert"]').text()).toContain('no directly supported book file')
+    expect(wrapper.text()).toContain('release/book.zip')
+  })
+
+  it('says how many separate books a release holds, and names them', () => {
+    const wrapper = mountPanel({
+      inspection: inspection({
+        status: 'multiple_supported_files',
+        files: [
+          { path: 'Mort.epub', sizeBytes: 1024, bookFile: true },
+          { path: 'Small Gods.epub', sizeBytes: 1024, bookFile: true },
+        ],
+        totalFiles: 2,
+        primaryFileCount: 2,
+        units: [
+          { mediaKind: 'ebook', title: 'Mort', contentFileCount: 1, totalFileCount: 1, sizeBytes: 1024 },
+          { mediaKind: 'ebook', title: 'Small Gods', contentFileCount: 1, totalFileCount: 1, sizeBytes: 1024 },
+        ],
+        unitCount: 2,
+      }),
+    })
+
+    expect(wrapper.get('[role="status"]').text()).toContain('2 separate books')
+    expect(wrapper.text()).toContain('Mort')
+    expect(wrapper.text()).toContain('Small Gods')
+  })
+
+  /** The distinction the old "N supported book files" wording could not draw. */
+  it('describes one book made of many parts as a single audiobook, not as many books', () => {
+    const wrapper = mountPanel({
+      inspection: inspection({
+        status: 'ready',
+        files: [
+          { path: 'Neuromancer/Chapter 1.mp3', sizeBytes: 1024, bookFile: true },
+          { path: 'Neuromancer/Chapter 2.mp3', sizeBytes: 1024, bookFile: true },
+        ],
+        totalFiles: 2,
+        primaryFileCount: 2,
+        units: [{ mediaKind: 'audiobook', title: 'Neuromancer', contentFileCount: 31, totalFileCount: 32, sizeBytes: 500_000 }],
+        unitCount: 1,
+      }),
+    })
+
+    expect(wrapper.get('[role="status"]').text()).toContain('one book made of 31 files')
+    expect(wrapper.text()).toContain('Audiobook')
+    expect(wrapper.text()).toContain('31 files')
+  })
+
+  /** An archive is extracted after downloading, so it is stated rather than warned about. */
+  it('states that an archived release is extracted after downloading', () => {
+    const wrapper = mountPanel({
+      inspection: inspection({
+        status: 'contents_unknown',
+        files: [{ path: 'release/book.rar', sizeBytes: 8192, bookFile: false }],
+        primaryFileCount: 0,
+        units: [],
+        unitCount: 0,
+        containerCount: 1,
+      }),
+    })
+
+    expect(wrapper.get('[role="status"]').text()).toContain('packaged as an archive')
+    expect(wrapper.find('[role="alert"]').exists()).toBe(false)
+  })
+
+  it('reports the samples and padding files it discarded', () => {
+    const wrapper = mountPanel({ inspection: inspection({ ignoredFileCount: 3 }) })
+
+    expect(wrapper.text()).toContain('Ignoring 3 sample and padding files')
+  })
+
+  /** A single ordinary book has nothing to add, so the unit list stays out of the way. */
+  it('does not list units for a plain one-file release', () => {
+    expect(mountPanel().text()).not.toContain('E-book')
+  })
+
+  it('explains why magnets have no file list yet', () => {
+    const wrapper = mountPanel({
+      inspection: inspection({
+        source: 'magnet',
+        status: 'metadata_unavailable',
+        files: [],
+        totalFiles: null,
+        primaryFileCount: null,
+      }),
+    })
+
+    expect(wrapper.get('[role="status"]').text()).toContain('until a torrent client fetches the metadata from the swarm')
+  })
+
+  it('exposes loading and failed inspection states accessibly', async () => {
+    const wrapper = mountPanel({ inspection: null, loading: true })
+    expect(wrapper.get('[role="status"]').text()).toContain('Reading the release file list')
+
+    await wrapper.setProps({ loading: false, failed: true })
+    expect(wrapper.get('[role="alert"]').text()).toContain('not sent to a download client')
+  })
+
+  it('states when the bounded display omits manifest entries', () => {
+    const wrapper = mountPanel({ inspection: inspection({ totalFiles: 500, truncated: true }) })
+
+    expect(wrapper.text()).toContain('Showing 1 of 500 files')
+  })
+
+  /**
+   * A tracker refusing one release says why, and that sentence is the whole answer: it tells an
+   * approver to pick another release rather than to retry the same one forever.
+   */
+  it('repeats what the tracker said when inspection was refused', () => {
+    const wrapper = mountPanel({
+      inspection: null,
+      failed: true,
+      failureReason: 'VIP torrent and you are not VIP or higher',
+    })
+
+    const alert = wrapper.get('[role="alert"]')
+    expect(alert.text()).toContain('VIP torrent and you are not VIP or higher')
+    expect(alert.text()).not.toContain('file list could not be read')
+  })
+
+  it('always says what happened to the grab, whatever the reason was', () => {
+    const wrapper = mountPanel({ inspection: null, failed: true, failureReason: 'VIP torrent and you are not VIP or higher' })
+
+    expect(wrapper.get('[role="alert"]').text()).toContain('not sent to a download client')
+  })
+
+  it('falls back to the generic line when nothing said why', () => {
+    const wrapper = mountPanel({ inspection: null, failed: true })
+
+    expect(wrapper.get('[role="alert"]').text()).toContain('file list could not be read')
+  })
+})
diff --git a/client/src/features/book-requests/__tests__/ReleasePickerPanel.spec.ts b/client/src/features/book-requests/__tests__/ReleasePickerPanel.spec.ts
new file mode 100644
index 000000000..48f668396
--- /dev/null
+++ b/client/src/features/book-requests/__tests__/ReleasePickerPanel.spec.ts
@@ -0,0 +1,764 @@
+import { flushPromises, mount, RouterLinkStub } from '@vue/test-utils'
+import type { DOMWrapper, VueWrapper } from '@vue/test-utils'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { Permission } from '@bookorbit/types'
+import type { BookRequestItem, IndexerSearchStatus, ReleaseCandidateItem } from '@bookorbit/types'
+
+const api = vi.fn<(input: string, init?: RequestInit) => Promise<Response>>()
+vi.mock('@/lib/api', () => ({ api: (...args: [string, RequestInit?]) => api(...args) }))
+// The panel reads whether the viewer moderates the queue, which decides whether it asks the admin
+// or the self-fulfil endpoint. Stubbed rather than pulled in: the real composable reaches `useAuth`,
+// which builds the router at module scope.
+const hasPermission = vi.fn<(permission: string) => boolean>()
+vi.mock('@/features/auth/composables/usePermissions', () => ({
+  usePermissions: () => ({ hasPermission: (permission: string) => hasPermission(permission) }),
+}))
+vi.mock('vue-router', () => ({
+  useRoute: () => ({ params: { id: '7' }, query: {} }),
+  useRouter: () => ({ push: vi.fn<() => void>() }),
+}))
+
+import ReleasePickerPanel from '../components/ReleasePickerPanel.vue'
+
+function request(overrides: Partial<BookRequestItem> = {}): BookRequestItem {
+  return {
+    id: 7,
+    userId: 1,
+    requesterUsername: 'neon',
+    requesterName: 'Neon',
+    mediaKind: 'ebook',
+    status: 'approved',
+    preferredFormats: ['epub'],
+    note: null,
+    targetLibraryId: 1,
+    targetLibraryName: 'Books',
+    targetFolderId: null,
+    decidedByUserId: null,
+    decidedByUsername: null,
+    decidedAt: null,
+    decisionNote: null,
+    matchedBookId: null,
+    bookDockFileId: null,
+    selfServe: false,
+    fulfillerUserId: null,
+    statusReason: null,
+    failureCode: null,
+    failureMeta: null,
+    subscribers: [],
+    download: null,
+    dismissed: false,
+    createdAt: '2026-08-01T00:00:00.000Z',
+    updatedAt: '2026-08-01T00:00:00.000Z',
+    title: 'Spark of the Everflame',
+    subtitle: null,
+    authors: ['Penn Cole'],
+    seriesName: null,
+    seriesIndex: null,
+    isbn10: null,
+    isbn13: null,
+    publishedYear: 2024,
+    language: null,
+    coverUrl: null,
+    providerKey: null,
+    providerId: null,
+    metadataSources: [],
+    ...overrides,
+  }
+}
+
+function release(overrides: Partial<ReleaseCandidateItem> = {}): ReleaseCandidateItem {
+  return {
+    indexerId: 1,
+    indexerName: 'MyAnonaMouse',
+    guid: 'g1',
+    title: 'Spark of the Everflame',
+    sizeBytes: 3_100_000,
+    seeders: 506,
+    leechers: 2,
+    format: 'epub',
+    formats: ['epub', 'azw3', 'mobi'],
+    language: 'ENG',
+    fileCount: null,
+    freeleech: false,
+    vipOnly: false,
+    alreadyGrabbed: false,
+    publishedAt: '2023-08-05T00:00:00.000Z',
+    audio: null,
+    score: 89,
+    tier: null,
+    tierName: null,
+    reasons: [{ code: 'titleMatch', points: 55 }],
+    ...overrides,
+  }
+}
+
+function audio(bitrateKbps: number) {
+  return { bitrateKbps, bitrateMode: 'CBR', channels: 2, samplingRateHz: 44100, durationSeconds: 3600, chapterCount: null }
+}
+
+function status(overrides: Partial<IndexerSearchStatus> = {}): IndexerSearchStatus {
+  return {
+    indexerId: 1,
+    indexerName: 'MyAnonaMouse',
+    color: null,
+    ok: true,
+    count: 1,
+    filtered: 0,
+    query: { kind: 'titleAuthor', value: 'Spark of the Everflame Penn Cole' },
+    seedsBack: true,
+    ...overrides,
+  }
+}
+
+/** A tracker release and a plain HTTP library release, which is the mix that exposed the bugs. */
+const MIXED = {
+  releases: [release(), release({ indexerId: 2, indexerName: 'Library Genesis', guid: 'g2', seeders: null, format: 'epub', formats: ['epub'] })],
+  criteria: {
+    title: 'Spark of the Everflame',
+    authors: ['Penn Cole'],
+    isbn10: '1234567890',
+    isbn13: '9781234567897',
+    activeIsbn: '9781234567897',
+    isbns: ['9781234567897'],
+    mediaKind: 'ebook',
+    language: 'en',
+    preferredFormats: ['epub'],
+  },
+  indexers: [
+    status(),
+    status({
+      indexerId: 2,
+      indexerName: 'Library Genesis',
+      query: { kind: 'isbn', value: '9781234567897' },
+      seedsBack: false,
+    }),
+  ],
+  uncoveredIndexerCount: 0,
+  enabledIndexerCount: 2,
+  configuredIndexerCount: 2,
+  profileActive: false,
+  searchedAt: '2026-08-20T00:00:00.000Z',
+  cached: false,
+}
+
+function respond(body: unknown) {
+  return Promise.resolve({ ok: true, json: () => Promise.resolve(body) } as Response)
+}
+
+function refuse(body: unknown) {
+  return Promise.resolve({ ok: false, status: 400, json: () => Promise.resolve(body) } as Response)
+}
+
+/** Whatever the picker asks about a release's files, so a click reaches the grab it is testing. */
+const READY_INSPECTION = {
+  source: 'torrent_file',
+  status: 'ready',
+  files: [{ path: 'book.epub', sizeBytes: 100, bookFile: true }],
+  totalFiles: 1,
+  primaryFileCount: 1,
+  truncated: false,
+  units: [],
+  unitCount: 1,
+  ignoredFileCount: 0,
+  containerCount: 0,
+}
+
+/** The release list, not the source transcript above it: both are lists, so both hold `li`. */
+function releaseRows(wrapper: VueWrapper): DOMWrapper<Element>[] {
+  return wrapper.findAll('ul[aria-label="Every other release, ranked"] > li')
+}
+
+function changeSearch(wrapper: VueWrapper): DOMWrapper<Element> {
+  return wrapper.findAll('button').find((button) => button.text().includes('Change search'))!
+}
+
+function editFields(wrapper: VueWrapper): DOMWrapper<Element> {
+  return wrapper.findAll('button').find((button) => button.text().includes('Edit fields'))!
+}
+
+async function render(search: unknown = MIXED) {
+  api.mockImplementation((input: string) => {
+    if (input.includes('/releases')) return respond(search)
+    if (input.includes('download-clients')) return respond([])
+    return respond(request())
+  })
+
+  const wrapper = mount(ReleasePickerPanel, { global: { stubs: { RouterLink: RouterLinkStub } } })
+  await flushPromises()
+  return wrapper
+}
+
+beforeEach(() => {
+  api.mockReset()
+  // A moderator by default, which is the path every existing case in this file was written against.
+  hasPermission.mockReturnValue(true)
+})
+
+describe('ReleasePickerPanel', () => {
+  it('states the searched key once, and what every source did with it', async () => {
+    const wrapper = await render()
+    const panel = wrapper.get('section[aria-label="Active search"]')
+    const sources = panel.get('ul[aria-label="Sources"]').text()
+
+    expect(panel.text()).toContain('Searched9781234567897')
+    // The source that was handed the same key says so rather than repeating the digits.
+    expect(sources).toContain('Library Genesissearched the ISBN')
+    expect(sources).toContain('1 release')
+    // The one that could not take an ISBN shows the string it was actually sent.
+    expect(sources).toContain('MyAnonaMouseSpark of the Everflame Penn Cole')
+  })
+
+  it('counts the releases a source had dropped by the hard filters', async () => {
+    const wrapper = await render({
+      ...MIXED,
+      indexers: [MIXED.indexers[0], { ...MIXED.indexers[1], count: 0, filtered: 3 }],
+    })
+
+    const sources = wrapper.get('ul[aria-label="Sources"]').text()
+    expect(sources).toContain('3 filtered out')
+    expect(sources).toContain('no matches')
+  })
+
+  it('names a source that failed and offers the one fix a re-run cannot make', async () => {
+    const wrapper = await render({
+      ...MIXED,
+      indexers: [MIXED.indexers[0], { ...MIXED.indexers[1], ok: false, count: 0, failure: 'unauthorized' }],
+    })
+
+    const sources = wrapper.get('ul[aria-label="Sources"]')
+    expect(sources.text()).toContain('sign-in expired')
+    expect(sources.text()).toContain('Fix in settings')
+    expect(sources.findComponent(RouterLinkStub).props('to')).toEqual({ name: 'settings-admin-requests' })
+  })
+
+  it('keeps the search options shut while a search is returning releases', async () => {
+    const wrapper = await render({
+      ...MIXED,
+      criteria: { ...MIXED.criteria, isbns: ['9781234567897', '9781250301697'] },
+    })
+
+    expect(wrapper.find('#release-search-options').exists()).toBe(false)
+    await changeSearch(wrapper).trigger('click')
+
+    const options = wrapper.get('#release-search-options').text()
+    expect(options).toContain('Search this instead')
+    expect(options).toContain('9781250301697')
+    expect(options).toContain('Title and author')
+    expect(options).toContain('Filtered locally:')
+    expect(options).toContain('Media:E-book')
+  })
+
+  it('opens itself on a search that found nothing, and leads with the other keys', async () => {
+    const wrapper = await render({
+      ...MIXED,
+      releases: [],
+      criteria: { ...MIXED.criteria, isbns: ['9781234567897', '9781250301697'] },
+      indexers: [{ ...MIXED.indexers[0], count: 0 }],
+    })
+
+    const panel = wrapper.get('section[aria-label="Active search"]')
+    expect(panel.text()).toContain('Nothing found for 9781234567897')
+    expect(wrapper.get('#release-search-options').text()).toContain('9781250301697')
+    // The panel is the empty state now, so nothing repeats it under the list.
+    expect(wrapper.text()).not.toContain('No release matched this request.')
+  })
+
+  /**
+   * The reported bug: with nothing switched on the panel said "Nothing found for <isbn>", which
+   * claims the ISBN was tried. No request was made, and the ISBN had no bearing on the outcome.
+   */
+  it('says nothing was searched rather than blaming the key when no source is enabled', async () => {
+    const wrapper = await render({ ...MIXED, releases: [], indexers: [], enabledIndexerCount: 0, configuredIndexerCount: 0 })
+
+    expect(wrapper.text()).not.toContain('Nothing found for')
+    expect(wrapper.text()).not.toContain('Searched9781234567897')
+    // The whole search transcript goes with it: its filters and alternate keys describe a search.
+    expect(wrapper.find('section[aria-label="Active search"]').exists()).toBe(false)
+    expect(wrapper.text()).toContain('No search sources are set up yet.')
+    expect(wrapper.text()).toContain('Add a source')
+  })
+
+  it('offers to switch a source back on rather than to add one when they are all off', async () => {
+    const wrapper = await render({ ...MIXED, releases: [], indexers: [], enabledIndexerCount: 0, configuredIndexerCount: 3 })
+
+    expect(wrapper.text()).toContain('Every search source is switched off.')
+    expect(wrapper.text()).toContain('Review sources')
+    expect(wrapper.text()).not.toContain('Add a source')
+  })
+
+  /** Nobody who cannot open the settings page is sent to it, in copy or in a link. */
+  it('tells a requester who to ask instead of linking them to settings they cannot open', async () => {
+    hasPermission.mockImplementation((permission: string) => permission !== Permission.ManageAppSettings)
+    const wrapper = await render({ ...MIXED, releases: [], indexers: [], enabledIndexerCount: 0, configuredIndexerCount: 0 })
+
+    expect(wrapper.text()).toContain('Ask an administrator to set up a search source')
+    expect(wrapper.text()).not.toContain('Add a source')
+  })
+
+  it('says what an alternative key returned once this visit has spent it', async () => {
+    const wrapper = await render({
+      ...MIXED,
+      criteria: { ...MIXED.criteria, isbns: ['9781234567897', '9781250301697'] },
+    })
+    await changeSearch(wrapper).trigger('click')
+
+    const alternative = wrapper.findAll('button').find((button) => button.text().includes('9781250301697'))!
+    expect(alternative.text()).not.toContain('tried')
+
+    api.mockImplementation(() =>
+      respond({
+        ...MIXED,
+        releases: [],
+        criteria: { ...MIXED.criteria, activeIsbn: '9781250301697', isbns: ['9781234567897', '9781250301697'] },
+      }),
+    )
+    await alternative.trigger('click')
+    await flushPromises()
+
+    const spent = wrapper.findAll('button').find((button) => button.text().includes('9781234567897'))!
+    expect(wrapper.findAll('button').find((button) => button.text().includes('9781250301697'))).toBeUndefined()
+    expect(spent.text()).toContain('tried, 2 releases')
+  })
+
+  it('collapses the sources that have nothing to explain, and expands them on request', async () => {
+    const many = Array.from({ length: 6 }, (_, index) =>
+      status({ indexerId: index + 10, indexerName: `Source ${index + 1}`, count: 2, query: { kind: 'isbn', value: '9781234567897' } }),
+    )
+    const wrapper = await render({ ...MIXED, indexers: [...many, status({ indexerId: 99, indexerName: 'Slow one', ok: false, failure: 'timeout' })] })
+
+    const sources = wrapper.get('ul[aria-label="Sources"]')
+    expect(sources.text()).toContain('6 sources searched')
+    expect(sources.text()).toContain('12 releases')
+    // A failure is never folded into a total: it is the reason the list is worth reading.
+    expect(sources.text()).toContain('Slow one')
+    expect(sources.text()).toContain('timed out')
+    expect(sources.text()).not.toContain('Source 1')
+
+    await wrapper
+      .findAll('button')
+      .find((button) => button.text() === 'Show each')!
+      .trigger('click')
+    expect(wrapper.get('ul[aria-label="Sources"]').text()).toContain('Source 1')
+  })
+
+  it('lets the user choose ISBNs and override every editable search field', async () => {
+    const wrapper = await render()
+
+    await changeSearch(wrapper).trigger('click')
+    await editFields(wrapper).trigger('click')
+    await wrapper.get('#release-search-title').setValue('Dune Messiah')
+    await wrapper.get('#release-search-authors').setValue('Frank Herbert')
+    await wrapper.get('#release-search-language').setValue('')
+    await wrapper.get('#release-search-formats').setValue('azw3, epub')
+    await wrapper.get('#release-search-custom-isbn').setValue('0593098234')
+    await wrapper.get('form').trigger('submit')
+    await flushPromises()
+
+    expect(api).toHaveBeenCalledWith('/api/v1/admin/book-requests/7/releases/search', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        title: 'Dune Messiah',
+        authors: ['Frank Herbert'],
+        isbn: '9780593098233',
+        language: null,
+        preferredFormats: ['azw3', 'epub'],
+      }),
+    })
+  })
+
+  it('can send no ISBNs and search only with manually edited text fields', async () => {
+    const wrapper = await render()
+
+    await changeSearch(wrapper).trigger('click')
+    await editFields(wrapper).trigger('click')
+    await wrapper.get('#release-search-without-isbn').setValue(true)
+    await wrapper.get('form').trigger('submit')
+    await flushPromises()
+
+    const customCall = api.mock.calls.find(([url]) => url.endsWith('/releases/search'))
+    expect(JSON.parse(String(customCall?.[1]?.body))).toEqual(expect.objectContaining({ isbn: null }))
+  })
+
+  it('searches again with the currently displayed fields instead of reverting silently', async () => {
+    const current = {
+      ...MIXED,
+      releases: [],
+      criteria: {
+        ...MIXED.criteria,
+        title: 'A manual title',
+        authors: ['A manual author'],
+        isbn10: null,
+        isbn13: null,
+        activeIsbn: null,
+        isbns: [],
+        language: null,
+        preferredFormats: ['azw3'],
+      },
+    }
+    const wrapper = await render(current)
+
+    await wrapper
+      .findAll('button')
+      .find((button) => button.text().includes('Search again'))!
+      .trigger('click')
+    await flushPromises()
+
+    const customCall = api.mock.calls.find(([url]) => url.endsWith('/releases/search'))
+    expect(JSON.parse(String(customCall?.[1]?.body))).toEqual({
+      title: 'A manual title',
+      authors: ['A manual author'],
+      isbn: null,
+      language: null,
+      preferredFormats: ['azw3'],
+    })
+  })
+
+  it('keeps media visible as search context when no optional filters are set', async () => {
+    const wrapper = await render({
+      ...MIXED,
+      criteria: { ...MIXED.criteria, isbn10: null, preferredFormats: [] },
+    })
+    await changeSearch(wrapper).trigger('click')
+
+    expect(wrapper.get('[aria-labelledby="release-search-local-criteria"]').text()).toContain('Media:E-book')
+    expect(wrapper.get('section[aria-label="Active search"]').text()).toContain('Searched9781234567897')
+  })
+
+  /**
+   * The label that started this: MyAnonaMouse lists "azw3 epub mobi" alphabetically, so the row
+   * read "AZW3" for a release that carries the requested EPUB.
+   */
+  it('labels a release with every format it carries, the requested one first', async () => {
+    const text = (await render()).text()
+
+    expect(text).toContain('EPUB + AZW3 + MOBI')
+  })
+
+  it('offers a format chip for every format a release carries, not just its first', async () => {
+    const chips = (await render()).findAll('[aria-pressed]').map((chip) => chip.text())
+
+    expect(chips.some((chip) => chip.startsWith('AZW3'))).toBe(true)
+    expect(chips.some((chip) => chip.startsWith('MOBI'))).toBe(true)
+  })
+
+  /** Per-theme tokens, not one hex for both themes: the chip's own text is what carries the colour. */
+  it('paints format chips from the shared per-theme format tokens', async () => {
+    const wrapper = await render()
+    const epub = wrapper.findAll('[aria-pressed]').find((chip) => chip.text().startsWith('EPUB'))
+
+    expect(epub!.attributes('style')).toContain('color: var(--pill-format-epub)')
+    expect(epub!.attributes('style')).toContain('background-color: color-mix(in oklch, var(--pill-format-epub) 10%, transparent)')
+  })
+
+  /** Filtering to EPUB used to hide the very release that carries one. */
+  it('keeps a multi-format release under a filter on a format it carries', async () => {
+    const wrapper = await render()
+    const epub = wrapper.findAll('[aria-pressed]').find((chip) => chip.text().startsWith('EPUB'))
+    await epub!.trigger('click')
+
+    expect(releaseRows(wrapper).some((row) => row.text().includes('EPUB + AZW3 + MOBI'))).toBe(true)
+  })
+
+  /** A plain HTTP library has no swarm, so silence there is not a missing count. */
+  it('says nothing about seeders for a source that serves the file itself', async () => {
+    const rows = releaseRows(await render())
+    const libgen = rows.find((row) => row.text().includes('Library Genesis'))
+
+    expect(libgen!.text()).not.toContain('Seeders unknown')
+    expect(libgen!.text()).toContain('Direct')
+  })
+
+  /**
+   * The two chips carry different facts, and before this they carried the same hue: a scan down
+   * the list could not tell a swarm row from a direct download without reading either one.
+   */
+  it('separates torrent and direct download by colour', async () => {
+    const rows = releaseRows(await render())
+    const chipClass = (row: (typeof rows)[number], label: string) =>
+      row
+        .findAll('span')
+        .find((span) => span.text() === label)!
+        .attributes('class')
+
+    const tracker = rows.find((row) => row.text().includes('MyAnonaMouse'))!
+    const libgen = rows.find((row) => row.text().includes('Library Genesis'))!
+
+    expect(chipClass(tracker, 'Torrent')).toContain('--pill-torrent')
+    expect(chipClass(libgen, 'Direct')).toContain('--pill-direct')
+  })
+
+  it('wears the colour the operator gave the source, and stays neutral for one with none', async () => {
+    const search = { ...MIXED, indexers: [status({ color: 'orange' }), status({ indexerId: 2, indexerName: 'Library Genesis', seedsBack: false })] }
+    const rows = releaseRows(await render(search))
+    const chipClass = (row: (typeof rows)[number], name: string) =>
+      row
+        .findAll('span')
+        .find((span) => span.text() === name)!
+        .attributes('class')
+
+    expect(
+      chipClass(
+        rows.find((row) => row.text().includes('MyAnonaMouse'))!,
+        'MyAnonaMouse',
+      ),
+    ).toContain('--pill-source-orange')
+    expect(
+      chipClass(
+        rows.find((row) => row.text().includes('Library Genesis'))!,
+        'Library Genesis',
+      ),
+    ).toContain('text-muted-foreground')
+  })
+
+  it('uses the assigned source color when every release comes from one tracker', async () => {
+    const search = {
+      ...MIXED,
+      releases: [release(), release({ guid: 'g2' })],
+      indexers: [status({ color: 'orange', count: 2 })],
+    }
+    const wrapper = await render(search)
+    const sourceSummary = wrapper.findAll('span').find((span) => span.text() === 'all from MyAnonaMouse')
+
+    expect(sourceSummary?.classes().join(' ')).toContain('--pill-source-orange')
+  })
+
+  it('uses each source color on its indexer filter pill', async () => {
+    const search = {
+      ...MIXED,
+      releases: [
+        release({ indexerName: 'MAM' }),
+        release({ indexerId: 2, indexerName: 'IPT', guid: 'g2' }),
+        release({ indexerId: 3, indexerName: 'TL', guid: 'g3' }),
+      ],
+      indexers: [
+        status({ indexerName: 'MAM', color: 'green' }),
+        status({ indexerId: 2, indexerName: 'IPT', color: 'blue' }),
+        status({ indexerId: 3, indexerName: 'TL', color: 'red' }),
+      ],
+    }
+    const wrapper = await render(search)
+    const buttons = wrapper.get('[aria-label="Indexer"]').findAll('button')
+    const classesFor = (name: string) =>
+      buttons
+        .find((button) => button.text().startsWith(name))
+        ?.classes()
+        .join(' ')
+
+    expect(classesFor('MAM')).toContain('--pill-source-green')
+    expect(classesFor('IPT')).toContain('--pill-source-blue')
+    expect(classesFor('TL')).toContain('--pill-source-red')
+  })
+
+  it('states the swarm on a tracker release', async () => {
+    const rows = releaseRows(await render())
+    const tracker = rows.find((row) => row.text().includes('MyAnonaMouse'))
+
+    expect(tracker!.text()).toContain('506 seeders')
+    expect(tracker!.text()).toContain('Torrent')
+  })
+
+  it('uses singular forms for one seeder and one chapter', async () => {
+    const item = release({
+      seeders: 1,
+      audio: { ...audio(128), chapterCount: 1 },
+    })
+    const wrapper = await render({ ...MIXED, releases: [item], indexers: [status()] })
+
+    expect(releaseRows(wrapper)[0].text()).toContain('1 seeder')
+    expect(releaseRows(wrapper)[0].text()).toContain('1 chapter')
+  })
+
+  /** On a tracker, a missing count really is the release omitting one, and still worth saying. */
+  /**
+   * The failure this exists for: a tracker refusing one release refuses the rest of its list the
+   * same way, so an approver should not have to click down them collecting the same 406.
+   */
+  it("rules out a source's remaining releases once it has refused one", async () => {
+    const search = {
+      ...MIXED,
+      releases: [
+        release({ guid: 'mam-1' }),
+        release({ guid: 'mam-2', score: 85 }),
+        release({ indexerId: 2, indexerName: 'Library Genesis', guid: 'libgen-1', seeders: null, score: 70 }),
+      ],
+    }
+    api.mockImplementation((input: string) => {
+      if (input.includes('/releases/inspect')) return respond(READY_INSPECTION)
+      if (input.includes('/releases')) return respond(search)
+      if (input.includes('download-clients')) return respond([])
+      if (input.includes('/grab')) return refuse({ message: 'the tracker answered 406', errorCode: 'GRAB_SOURCE_REFUSED' })
+      return respond(request())
+    })
+
+    const wrapper = mount(ReleasePickerPanel, { global: { stubs: { RouterLink: RouterLinkStub } } })
+    await flushPromises()
+
+    const grabButton = (row: ReturnType<typeof wrapper.findAll>[number]) =>
+      row.findAll('button').find((button) => /Download release|Send/.test(button.text()))!
+    const rowFor = (guid: string) => releaseRows(wrapper)[search.releases.findIndex((item) => item.guid === guid)]!
+
+    await grabButton(rowFor('mam-1')).trigger('click')
+    await flushPromises()
+
+    expect(rowFor('mam-2').text()).toContain('This source turned down an earlier release')
+    expect(grabButton(rowFor('mam-2')).attributes('disabled')).toBeDefined()
+    // The other source was never asked, so nothing has been established about it.
+    expect(rowFor('libgen-1').text()).not.toContain('turned down')
+    expect(grabButton(rowFor('libgen-1')).attributes('disabled')).toBeUndefined()
+  })
+
+  it('still reports an unknown count on a swarm source', async () => {
+    const wrapper = await render({
+      ...MIXED,
+      releases: [release({ seeders: null })],
+      indexers: [status()],
+    })
+
+    expect(wrapper.text()).toContain('Seeders unknown')
+  })
+
+  /**
+   * The gap this set closes: the tracker states `numfiles` on every row and it used to stop at a
+   * scoring penalty, so an approver could not tell one M4B from a forty-part MP3 set without
+   * expanding each row, which costs a credentialed fetch per release.
+   */
+  describe('file count', () => {
+    const AUDIO = {
+      ...MIXED,
+      releases: [
+        release({ guid: 'one', title: 'One file m4b', formats: ['m4b'], format: 'm4b', fileCount: 1 }),
+        release({ guid: 'many', title: 'Chaptered mp3', formats: ['mp3'], format: 'mp3', fileCount: 32 }),
+      ],
+      indexers: [status()],
+    }
+
+    it('states the file count on the row', async () => {
+      const text = (await render(AUDIO)).text()
+
+      expect(text).toContain('1 file')
+      expect(text).toContain('32 files')
+    })
+
+    it('says nothing where the source stated no count', async () => {
+      const wrapper = await render({ ...MIXED, releases: [release({ fileCount: null })], indexers: [status()] })
+
+      // Matched on the count itself: the panel says "View files" regardless, so a bare substring
+      // check on "file" would pass whether the fact was rendered or not.
+      expect(releaseRows(wrapper)[0].text()).not.toMatch(/\d+ files?/)
+    })
+
+    it('filters to a single file', async () => {
+      const wrapper = await render(AUDIO)
+      const chip = wrapper.findAll('[aria-pressed]').find((option) => option.text().startsWith('One book file'))
+      await chip!.trigger('click')
+
+      const rows = releaseRows(wrapper).map((row) => row.text())
+      expect(rows.some((row) => row.includes('One file m4b'))).toBe(true)
+      expect(rows.some((row) => row.includes('Chaptered mp3'))).toBe(false)
+    })
+
+    /** A release whose source stated no count is not a single file, so neither chip may claim it. */
+    it('leaves an unstated count out of both choices', async () => {
+      const wrapper = await render({
+        ...AUDIO,
+        releases: [...AUDIO.releases, release({ guid: 'silent', title: 'Unstated', fileCount: null })],
+      })
+      const chip = wrapper.findAll('[aria-pressed]').find((option) => option.text().startsWith('Several files'))
+      await chip!.trigger('click')
+
+      expect(releaseRows(wrapper).some((row) => row.text().includes('Unstated'))).toBe(false)
+    })
+  })
+
+  describe('VIP-only releases', () => {
+    const WITH_VIP = {
+      ...MIXED,
+      releases: [release({ guid: 'open', title: 'Open release' }), release({ guid: 'vip', title: 'Locked release', vipOnly: true })],
+      indexers: [status()],
+    }
+
+    /** These rows are dead ends for a non-VIP account, and today cost a grab to find that out. */
+    it('hides VIP-only releases on request', async () => {
+      const wrapper = await render(WITH_VIP)
+      const chip = wrapper.findAll('[aria-pressed]').find((option) => option.text().startsWith('Hide VIP only'))
+      await chip!.trigger('click')
+
+      const rows = releaseRows(wrapper).map((row) => row.text())
+      expect(rows.some((row) => row.includes('Open release'))).toBe(true)
+      expect(rows.some((row) => row.includes('Locked release'))).toBe(false)
+    })
+
+    it('offers no such toggle when no release is VIP-only', async () => {
+      const wrapper = await render({ ...MIXED, releases: [release()], indexers: [status()] })
+
+      expect(wrapper.findAll('[aria-pressed]').some((option) => option.text().startsWith('Hide VIP only'))).toBe(false)
+    })
+  })
+
+  it('filters to one source when several answered', async () => {
+    const wrapper = await render()
+    const chip = wrapper.findAll('[aria-pressed]').find((option) => option.text().startsWith('Library Genesis'))
+    await chip!.trigger('click')
+
+    expect(releaseRows(wrapper)).toHaveLength(1)
+    expect(releaseRows(wrapper)[0].text()).toContain('Library Genesis')
+  })
+
+  describe('bitrate floor', () => {
+    const ENCODES = {
+      ...MIXED,
+      releases: [
+        release({ guid: 'low', title: 'Sixty four', audio: audio(64) }),
+        release({ guid: 'high', title: 'One twenty eight', audio: audio(128) }),
+      ],
+      indexers: [status()],
+    }
+
+    it('keeps only encodes at or above the floor', async () => {
+      const wrapper = await render(ENCODES)
+      const chip = wrapper.findAll('[aria-pressed]').find((option) => option.text().startsWith('96k+'))
+      await chip!.trigger('click')
+
+      const rows = releaseRows(wrapper).map((row) => row.text())
+      expect(rows.some((row) => row.includes('One twenty eight'))).toBe(true)
+      expect(rows.some((row) => row.includes('Sixty four'))).toBe(false)
+    })
+
+    /** A step every release clears sorts nothing, and one none clears can only empty the list. */
+    it('offers no step that every release already clears', async () => {
+      const wrapper = await render({
+        ...ENCODES,
+        releases: [release({ guid: 'a', audio: audio(128) }), release({ guid: 'b', audio: audio(192) })],
+      })
+
+      expect(wrapper.findAll('[aria-pressed]').some((option) => option.text().startsWith('64k+'))).toBe(false)
+    })
+  })
+
+  describe('profile tiers', () => {
+    const TIERED = {
+      ...MIXED,
+      releases: [
+        release({ guid: 'untiered', title: 'Untiered but strong', score: 95, tier: null, tierName: null }),
+        release({ guid: 'tiered', title: 'Tiered but weaker', score: 60, tier: 0, tierName: 'M4B single file' }),
+      ],
+      indexers: [status()],
+    }
+
+    it('names the tier on the row', async () => {
+      expect((await render(TIERED)).text()).toContain('M4B single file')
+    })
+
+    /**
+     * The whole point of tier being its own axis: the operator said which edition they want, and a
+     * higher score on something they did not ask for must not reorder that.
+     */
+    it('puts a tiered release above a better-scoring untiered one', async () => {
+      const rows = releaseRows(await render(TIERED))
+
+      expect(rows[0].text()).toContain('Tiered but weaker')
+      expect(rows[1].text()).toContain('Untiered but strong')
+    })
+  })
+})
diff --git a/client/src/features/book-requests/__tests__/ReleaseUnitChooser.spec.ts b/client/src/features/book-requests/__tests__/ReleaseUnitChooser.spec.ts
new file mode 100644
index 000000000..329126fd6
--- /dev/null
+++ b/client/src/features/book-requests/__tests__/ReleaseUnitChooser.spec.ts
@@ -0,0 +1,74 @@
+import { mount } from '@vue/test-utils'
+import { describe, expect, it } from 'vitest'
+import type { ReleaseUnitChoice } from '@bookorbit/types'
+
+import ReleaseUnitChooser from '../components/ReleaseUnitChooser.vue'
+
+function unit(overrides: Partial<ReleaseUnitChoice> = {}): ReleaseUnitChoice {
+  return {
+    index: 0,
+    mediaKind: 'ebook',
+    title: 'Mort',
+    contentFileCount: 1,
+    totalFileCount: 1,
+    sizeBytes: 1024,
+    primaryPath: 'Pack/Mort.epub',
+    ...overrides,
+  }
+}
+
+const UNITS = [unit(), unit({ index: 1, title: 'Small Gods', primaryPath: 'Pack/Small Gods.epub' })]
+
+function mountChooser(units = UNITS, busy = false) {
+  return mount(ReleaseUnitChooser, { props: { units, busy } })
+}
+
+describe('ReleaseUnitChooser', () => {
+  it('lists every book the release turned out to hold', () => {
+    const text = mountChooser().text()
+
+    expect(text).toContain('2 separate books')
+    expect(text).toContain('Mort')
+    expect(text).toContain('Small Gods')
+  })
+
+  it('describes each book by kind, file count and size', () => {
+    const text = mountChooser([unit({ mediaKind: 'audiobook', title: 'Neuromancer', contentFileCount: 31, sizeBytes: 512 * 1024 ** 2 })]).text()
+
+    expect(text).toContain('Audiobook')
+    expect(text).toContain('31 files')
+    expect(text).toContain('512 MB')
+  })
+
+  /** BookOrbit could not tell which one was wanted, so it must not appear to have already decided. */
+  it('preselects nothing and keeps the action disabled until a choice is made', async () => {
+    const wrapper = mountChooser()
+    const button = wrapper.get('button')
+
+    expect(wrapper.findAll('input[type="radio"]').every((input) => !(input.element as HTMLInputElement).checked)).toBe(true)
+    expect(button.attributes('disabled')).toBeDefined()
+
+    await wrapper.findAll('input[type="radio"]')[1]!.setValue()
+    expect(button.attributes('disabled')).toBeUndefined()
+  })
+
+  it('emits the index of the chosen book', async () => {
+    const wrapper = mountChooser()
+
+    await wrapper.findAll('input[type="radio"]')[1]!.setValue()
+    await wrapper.get('button').trigger('click')
+
+    expect(wrapper.emitted('choose')).toEqual([[1]])
+  })
+
+  it('disables every control while the import runs', () => {
+    const wrapper = mountChooser(UNITS, true)
+
+    expect(wrapper.get('fieldset').attributes('disabled')).toBeDefined()
+    expect(wrapper.get('button').attributes('disabled')).toBeDefined()
+  })
+
+  it('names an untitled book rather than showing a blank row', () => {
+    expect(mountChooser([unit({ title: null })]).text()).toContain('Untitled')
+  })
+})
diff --git a/client/src/features/book-requests/__tests__/RequestAttemptsPanel.spec.ts b/client/src/features/book-requests/__tests__/RequestAttemptsPanel.spec.ts
new file mode 100644
index 000000000..82ca3f489
--- /dev/null
+++ b/client/src/features/book-requests/__tests__/RequestAttemptsPanel.spec.ts
@@ -0,0 +1,107 @@
+import { flushPromises, mount } from '@vue/test-utils'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { BookRequestDownloadItem, BookRequestItem } from '@bookorbit/types'
+
+const api = vi.fn<(input: string) => Promise<Response>>()
+vi.mock('@/lib/api', () => ({ api: (...args: [string]) => api(...args) }))
+
+import RequestAttemptsPanel from '../components/RequestAttemptsPanel.vue'
+
+function attempt(overrides: Partial<BookRequestDownloadItem> = {}): BookRequestDownloadItem {
+  return {
+    id: 12,
+    requestId: 7,
+    downloadClientId: null,
+    downloadClientName: null,
+    downloadClientColor: null,
+    source: 'torrent_file',
+    indexerId: 1,
+    indexerName: 'MyAnonaMouse',
+    indexerColor: null,
+    automated: true,
+    releaseTitle: 'Stalked by Seduction and Shadows [EPUB]',
+    releaseSizeBytes: 2_300_000,
+    clientHash: null,
+    status: 'failed',
+    progressPercent: 0,
+    downloadedBytes: 0,
+    totalBytes: null,
+    errorMessage: 'MyAnonaMouse: the tracker answered 406: Download blocked: VIP torrent',
+    grabbedAt: '2026-08-20T17:41:38.000Z',
+    completedAt: null,
+    importedAt: null,
+    releaseUnits: null,
+    createdAt: '2026-08-20T17:41:38.000Z',
+    ...overrides,
+  }
+}
+
+const CURRENT = attempt({
+  id: 13,
+  indexerId: 2,
+  indexerName: 'Library Genesis',
+  source: 'direct_url',
+  clientHash: 'a'.repeat(40),
+  status: 'imported',
+  errorMessage: null,
+})
+
+function request(download: BookRequestDownloadItem | null): BookRequestItem {
+  return { id: 7, status: 'available', download } as BookRequestItem
+}
+
+async function render(attempts: BookRequestDownloadItem[], download: BookRequestDownloadItem | null = CURRENT) {
+  api.mockResolvedValue({ ok: true, json: () => Promise.resolve(attempts) } as Response)
+  const wrapper = mount(RequestAttemptsPanel, { props: { request: request(download), canManage: true } })
+  await flushPromises()
+  return wrapper
+}
+
+beforeEach(() => {
+  api.mockReset()
+})
+
+describe('RequestAttemptsPanel', () => {
+  it('collapses earlier attempts by default and lets the user expand them', async () => {
+    const wrapper = await render([CURRENT, attempt()])
+    const disclosure = wrapper.get('details')
+
+    expect((disclosure.element as HTMLDetailsElement).open).toBe(false)
+
+    await disclosure.get('summary').trigger('click')
+
+    expect((disclosure.element as HTMLDetailsElement).open).toBe(true)
+  })
+
+  /**
+   * The question this answers: the book arrived from Library Genesis, and nothing on the request
+   * said the tracker had been asked first and had refused.
+   */
+  it('shows the release a source refused before the one that worked', async () => {
+    const text = (await render([CURRENT, attempt()])).text()
+
+    expect(text).toContain('MyAnonaMouse')
+    expect(text).toContain('the tracker answered 406')
+  })
+
+  /** Nothing was downloaded, so "Download failed" would describe something that never happened. */
+  it('calls an attempt that never reached a client refused rather than failed', async () => {
+    const text = (await render([CURRENT, attempt()])).text()
+
+    expect(text).toContain('Refused, nothing downloaded')
+    expect(text).not.toContain('Download failed')
+  })
+
+  /** The transfer section above is already showing it; saying it twice is not history. */
+  it('leaves out the attempt the request is already showing', async () => {
+    const text = (await render([CURRENT])).text()
+
+    expect(text).not.toContain('Library Genesis')
+  })
+
+  it('renders nothing at all when a request has only ever made one attempt', async () => {
+    const wrapper = await render([CURRENT])
+
+    expect(wrapper.find('details').exists()).toBe(false)
+  })
+})
diff --git a/client/src/features/book-requests/__tests__/RequestCover.spec.ts b/client/src/features/book-requests/__tests__/RequestCover.spec.ts
new file mode 100644
index 000000000..a710c4074
--- /dev/null
+++ b/client/src/features/book-requests/__tests__/RequestCover.spec.ts
@@ -0,0 +1,91 @@
+import { mount } from '@vue/test-utils'
+import { describe, expect, it } from 'vitest'
+import RequestCover from '../components/RequestCover.vue'
+
+describe('RequestCover', () => {
+  it('renders the cover when there is one', () => {
+    const wrapper = mount(RequestCover, { props: { src: 'https://example.test/cover.jpg', mediaKind: 'ebook' } })
+
+    expect(wrapper.find('img').exists()).toBe(true)
+    expect(wrapper.find('img').attributes('src')).toBe('https://example.test/cover.jpg')
+  })
+
+  it('falls back to the media icon when there is no cover url', () => {
+    const wrapper = mount(RequestCover, { props: { src: null, mediaKind: 'audiobook' } })
+
+    expect(wrapper.find('img').exists()).toBe(false)
+    expect(wrapper.find('svg').exists()).toBe(true)
+  })
+
+  /**
+   * The case a plain `v-if="src"` misses. Provider cover URLs point at hosts BookOrbit does not
+   * control, and a dead one used to leave a transparent gap where the cover should be.
+   */
+  it('falls back when a cover url is present but fails to load', async () => {
+    const wrapper = mount(RequestCover, { props: { src: 'https://example.test/gone.jpg', mediaKind: 'ebook' } })
+
+    await wrapper.find('img').trigger('error')
+
+    expect(wrapper.find('img').exists()).toBe(false)
+    expect(wrapper.find('svg').exists()).toBe(true)
+  })
+
+  it('retries the next cover rather than staying broken for the rest of the session', async () => {
+    const wrapper = mount(RequestCover, { props: { src: 'https://example.test/gone.jpg', mediaKind: 'ebook' } })
+    await wrapper.find('img').trigger('error')
+    expect(wrapper.find('img').exists()).toBe(false)
+
+    await wrapper.setProps({ src: 'https://example.test/other.jpg' })
+
+    expect(wrapper.find('img').exists()).toBe(true)
+  })
+
+  it('advances through ordered fallback sources when a provider cover fails', async () => {
+    const wrapper = mount(RequestCover, {
+      props: {
+        src: 'https://example.test/first.jpg',
+        fallbackSources: ['https://example.test/second.jpg', 'https://example.test/third.jpg'],
+        sourceKey: 'dune',
+        mediaKind: 'ebook',
+      },
+    })
+
+    await wrapper.find('img').trigger('error')
+    expect(wrapper.find('img').attributes('src')).toBe('https://example.test/second.jpg')
+
+    await wrapper.find('img').trigger('error')
+    expect(wrapper.find('img').attributes('src')).toBe('https://example.test/third.jpg')
+
+    await wrapper.find('img').trigger('error')
+    expect(wrapper.find('img').exists()).toBe(false)
+    expect(wrapper.emitted('sourceChange')).toEqual([
+      [{ key: 'dune', src: 'https://example.test/first.jpg' }],
+      [{ key: 'dune', src: 'https://example.test/second.jpg' }],
+      [{ key: 'dune', src: 'https://example.test/third.jpg' }],
+      [{ key: 'dune', src: null }],
+    ])
+  })
+
+  it('does not retry a failed cover when the parent recreates an unchanged fallback list', async () => {
+    const wrapper = mount(RequestCover, {
+      props: {
+        src: 'https://example.test/first.jpg',
+        fallbackSources: ['https://example.test/second.jpg'],
+        mediaKind: 'ebook',
+      },
+    })
+
+    await wrapper.find('img').trigger('error')
+    await wrapper.setProps({ fallbackSources: ['https://example.test/second.jpg'] })
+
+    expect(wrapper.find('img').attributes('src')).toBe('https://example.test/second.jpg')
+  })
+
+  it('keeps the slot out of the accessibility tree either way, since the title is right beside it', () => {
+    const withCover = mount(RequestCover, { props: { src: 'https://example.test/cover.jpg', mediaKind: 'ebook' } })
+    const withoutCover = mount(RequestCover, { props: { src: null, mediaKind: 'ebook' } })
+
+    expect(withCover.find('img').attributes('alt')).toBe('')
+    expect(withoutCover.find('div').attributes('aria-hidden')).toBe('true')
+  })
+})
diff --git a/client/src/features/book-requests/__tests__/RequestDownloadProgress.spec.ts b/client/src/features/book-requests/__tests__/RequestDownloadProgress.spec.ts
new file mode 100644
index 000000000..9ec2052bc
--- /dev/null
+++ b/client/src/features/book-requests/__tests__/RequestDownloadProgress.spec.ts
@@ -0,0 +1,178 @@
+import { mount } from '@vue/test-utils'
+import { describe, expect, it } from 'vitest'
+import type { BookRequestDownloadItem, BookRequestProgressEvent } from '@bookorbit/types'
+
+import RequestDownloadProgress from '../components/RequestDownloadProgress.vue'
+
+function download(overrides: Partial<BookRequestDownloadItem> = {}): BookRequestDownloadItem {
+  return {
+    id: 11,
+    requestId: 7,
+    downloadClientId: 5,
+    downloadClientName: 'Direct download',
+    downloadClientColor: null,
+    source: 'direct_url',
+    indexerId: null,
+    indexerName: null,
+    indexerColor: null,
+    automated: false,
+    releaseTitle: 'Pride and Prejudice',
+    releaseSizeBytes: null,
+    clientHash: 'a'.repeat(40),
+    status: 'queued',
+    progressPercent: 0,
+    downloadedBytes: 0,
+    totalBytes: null,
+    errorMessage: null,
+    grabbedAt: null,
+    completedAt: null,
+    importedAt: null,
+    releaseUnits: null,
+    createdAt: '2026-08-20T00:00:00.000Z',
+    ...overrides,
+  }
+}
+
+describe('RequestDownloadProgress', () => {
+  it('uses source-neutral copy while a direct download is queued', () => {
+    const wrapper = mount(RequestDownloadProgress, { props: { download: download(), live: null } })
+
+    expect(wrapper.text()).toContain('Queued for download')
+    expect(wrapper.text()).not.toContain('download client')
+  })
+
+  it('reports downloaded bytes even when the source supplied no total size', () => {
+    const live: BookRequestProgressEvent = {
+      requestId: 7,
+      downloadId: 11,
+      status: 'downloading',
+      progressPercent: 0,
+      downloadedBytes: 2 * 1024 * 1024,
+      totalBytes: null,
+    }
+    const wrapper = mount(RequestDownloadProgress, { props: { download: download(), live } })
+
+    expect(wrapper.text()).toContain('2 MB downloaded')
+  })
+
+  it('keeps a later persisted importing state over a stale completed event', () => {
+    const live: BookRequestProgressEvent = {
+      requestId: 7,
+      downloadId: 11,
+      status: 'completed',
+      progressPercent: 100,
+      downloadedBytes: 10,
+      totalBytes: 10,
+    }
+    const wrapper = mount(RequestDownloadProgress, { props: { download: download({ status: 'importing' }), live } })
+
+    expect(wrapper.text()).toContain('Importing into your library')
+    expect(wrapper.text()).not.toContain('Download finished')
+  })
+
+  it('ignores a live event from an earlier download attempt', () => {
+    const live: BookRequestProgressEvent = {
+      requestId: 7,
+      downloadId: 10,
+      status: 'completed',
+      progressPercent: 100,
+      downloadedBytes: 10,
+      totalBytes: 10,
+    }
+    const wrapper = mount(RequestDownloadProgress, { props: { download: download({ status: 'downloading' }), live } })
+
+    expect(wrapper.text()).toContain('Downloading')
+    expect(wrapper.text()).not.toContain('Download finished')
+  })
+
+  /**
+   * "Added to your library" says the book arrived and nothing else. Which source served it is the
+   * question that comes next, and with a failover in front of it, the answer is not the release
+   * the request started with.
+   */
+  it('names the source the release actually came from', () => {
+    const wrapper = mount(RequestDownloadProgress, {
+      props: {
+        download: download({ indexerName: 'Library Genesis', source: 'direct_url', automated: true, status: 'imported' }),
+        live: null,
+      },
+    })
+
+    expect(wrapper.text()).toContain('Library Genesis')
+    expect(wrapper.text()).toContain('Direct download')
+    expect(wrapper.text()).toContain('Grabbed automatically')
+  })
+
+  it('reuses the configured source and protocol colors for transfer facts', () => {
+    const wrapper = mount(RequestDownloadProgress, {
+      props: {
+        download: download({
+          indexerName: 'MAM',
+          indexerColor: 'orange',
+          source: 'magnet',
+          downloadClientName: 'qBittorrent',
+          downloadClientColor: 'green',
+        }),
+        live: null,
+      },
+    })
+
+    const pills = wrapper.findAll('.rounded-full.border')
+    expect(pills[0]?.classes().join(' ')).toContain('--pill-source-orange')
+    expect(pills[1]?.classes().join(' ')).toContain('--pill-torrent')
+    expect(pills[2]?.classes().join(' ')).toContain('--pill-source-green')
+  })
+
+  it('says a hand-pasted magnet came from no source rather than leaving a gap', () => {
+    const wrapper = mount(RequestDownloadProgress, {
+      props: { download: download({ indexerName: null, source: 'magnet', automated: false }), live: null },
+    })
+
+    expect(wrapper.text()).toContain('Pasted by hand')
+    expect(wrapper.text()).toContain('Picked by an approver')
+  })
+
+  it('offers an authorized recovery action beside a failed transfer', async () => {
+    const wrapper = mount(RequestDownloadProgress, {
+      props: { download: download({ status: 'failed', errorMessage: 'No seeds' }), live: null, canRetry: true },
+    })
+
+    const retry = wrapper.get('button')
+    expect(retry.text()).toBe('Try another release')
+
+    await retry.trigger('click')
+    expect(wrapper.emitted('retry')).toHaveLength(1)
+  })
+
+  it('does not offer recovery without fulfilment permission', () => {
+    const wrapper = mount(RequestDownloadProgress, {
+      props: { download: download({ status: 'failed', errorMessage: 'No seeds' }), live: null },
+    })
+
+    expect(wrapper.find('button').exists()).toBe(false)
+  })
+
+  it('offers an authorized cancellation while a download is active', async () => {
+    const wrapper = mount(RequestDownloadProgress, {
+      props: { download: download({ status: 'downloading' }), live: null, canCancel: true },
+    })
+
+    const cancel = wrapper.get('button')
+    expect(cancel.text()).toBe('Cancel download')
+
+    await cancel.trigger('click')
+    expect(wrapper.emitted('cancel')).toHaveLength(1)
+  })
+
+  it('does not offer download cancellation without permission or after the transfer finishes', () => {
+    const unauthorized = mount(RequestDownloadProgress, {
+      props: { download: download({ status: 'downloading' }), live: null },
+    })
+    const finished = mount(RequestDownloadProgress, {
+      props: { download: download({ status: 'completed' }), live: null, canCancel: true },
+    })
+
+    expect(unauthorized.find('button').exists()).toBe(false)
+    expect(finished.find('button').exists()).toBe(false)
+  })
+})
diff --git a/client/src/features/book-requests/__tests__/RequestPipeline.component.spec.ts b/client/src/features/book-requests/__tests__/RequestPipeline.component.spec.ts
new file mode 100644
index 000000000..d7f207b53
--- /dev/null
+++ b/client/src/features/book-requests/__tests__/RequestPipeline.component.spec.ts
@@ -0,0 +1,62 @@
+import { mount } from '@vue/test-utils'
+import { describe, expect, it } from 'vitest'
+import type { BookRequestDownloadItem, BookRequestItem, BookRequestProgressEvent } from '@bookorbit/types'
+import RequestPipeline from '../components/RequestPipeline.vue'
+
+type PipelineRequest = Pick<BookRequestItem, 'status' | 'download'>
+
+const DOWNLOAD = { id: 3 } as BookRequestDownloadItem
+
+function render(request: PipelineRequest, compact = false, live: BookRequestProgressEvent | null = null) {
+  return mount(RequestPipeline, { props: { request, compact, live } })
+}
+
+describe('RequestPipeline', () => {
+  it('marks the stage the request is sitting on as the current step', () => {
+    const wrapper = render({ status: 'downloading', download: DOWNLOAD })
+    const current = wrapper.findAll('li[aria-current="step"]')
+
+    expect(current).toHaveLength(1)
+    expect(wrapper.findAll('ol').at(1)?.findAll('li').at(3)?.text()).toBe('Downloading')
+  })
+
+  it('states the stage in text so colour is never the only carrier', () => {
+    expect(render({ status: 'pending', download: null }).text()).toContain('Waiting at: Approved')
+    expect(render({ status: 'available', download: null }).text()).toContain('Filed in your library')
+  })
+
+  it('names the stage a failure died on rather than only saying it failed', () => {
+    expect(render({ status: 'failed', download: null }).text()).toContain('Release found')
+    expect(render({ status: 'failed', download: DOWNLOAD }).text()).toContain('Downloading')
+  })
+
+  it('renders five segments and no labels in compact mode', () => {
+    const wrapper = render({ status: 'downloading', download: DOWNLOAD }, true)
+
+    expect(wrapper.findAll('li')).toHaveLength(5)
+    expect(wrapper.text()).toBe('')
+    expect(wrapper.find('ol').attributes('aria-label')).toContain('Downloading')
+  })
+
+  it('keeps the accessible summary on the compact bar, which has no visible text at all', () => {
+    const wrapper = render({ status: 'pending', download: null }, true)
+    expect(wrapper.find('ol').attributes('aria-label')).toBe('Waiting at: Approved')
+  })
+
+  it('moves to filing as soon as the matching transfer finishes', () => {
+    const live: BookRequestProgressEvent = {
+      requestId: 1,
+      downloadId: 3,
+      status: 'completed',
+      progressPercent: 100,
+      downloadedBytes: 10,
+      totalBytes: 10,
+    }
+    const wrapper = render({ status: 'downloading', download: { ...DOWNLOAD, status: 'downloading' } }, false, live)
+    const current = wrapper.findAll('li[aria-current="step"]')
+
+    expect(current).toHaveLength(1)
+    expect(current[0]?.attributes('class')).toContain('shrink-0')
+    expect(wrapper.text()).toContain('In progress at: Filed')
+  })
+})
diff --git a/client/src/features/book-requests/__tests__/RequestReviewPanel.spec.ts b/client/src/features/book-requests/__tests__/RequestReviewPanel.spec.ts
new file mode 100644
index 000000000..9211693da
--- /dev/null
+++ b/client/src/features/book-requests/__tests__/RequestReviewPanel.spec.ts
@@ -0,0 +1,120 @@
+import { mount } from '@vue/test-utils'
+import { RouterLinkStub } from '@vue/test-utils'
+import { describe, expect, it } from 'vitest'
+import type { BookRequestReview } from '@bookorbit/types'
+
+import RequestReviewPanel from '../components/RequestReviewPanel.vue'
+
+function review(overrides: Partial<BookRequestReview> = {}): BookRequestReview {
+  return {
+    requestId: 7,
+    bookDockFileId: 100,
+    verification: {
+      score: 65,
+      threshold: 70,
+      passed: false,
+      reason: 'below_threshold',
+      rows: [
+        { field: 'title', requested: 'Fablehaven', imported: 'Fablehaven, Book 1 (Unabridged)', verdict: 'mismatch' },
+        { field: 'authors', requested: 'Brandon Mull', imported: 'Brandon Mull', verdict: 'match' },
+        { field: 'isbn13', requested: null, imported: null, verdict: 'unknown' },
+      ],
+    },
+    files: [{ fileName: 'fablehaven-01.m4b', fileSize: 402_000_000, format: 'm4b', role: 'content' }],
+    totalSizeBytes: 402_000_000,
+    canFile: true,
+    ...overrides,
+  }
+}
+
+function render(overrides: Partial<BookRequestReview> = {}, props: { canManage?: boolean; busy?: boolean } = {}) {
+  return mount(RequestReviewPanel, {
+    props: { review: review(overrides), canManage: props.canManage ?? true, busy: props.busy ?? false },
+    global: { stubs: { RouterLink: RouterLinkStub } },
+  })
+}
+
+describe('RequestReviewPanel', () => {
+  it('states the score against the threshold that held it', () => {
+    expect(render().text()).toContain('scored 65')
+    expect(render().text()).toContain('below the 70')
+  })
+
+  /** The question the panel exists to answer: which field cost the points. */
+  it('shows both sides of every compared field', () => {
+    const text = render().text()
+
+    expect(text).toContain('Fablehaven, Book 1 (Unabridged)')
+    expect(text).toContain('Brandon Mull')
+  })
+
+  it('says a field neither side carries was not compared, rather than showing two blanks', () => {
+    const text = render().text()
+
+    expect(text).toContain('Neither the request nor the file has one')
+    expect(text).not.toContain('Not set')
+  })
+
+  it('lists what landed with its size', () => {
+    const text = render().text()
+
+    expect(text).toContain('fablehaven-01.m4b')
+    expect(text).toContain('1 file')
+  })
+
+  it('labels a file that is not the book itself', () => {
+    const text = render({
+      files: [
+        { fileName: 'part-01.m4b', fileSize: 100, format: 'm4b', role: 'content' },
+        { fileName: 'cover.jpg', fileSize: 50, format: 'jpg', role: 'cover' },
+      ],
+    }).text()
+
+    expect(text).toContain('cover.jpg')
+    expect(text).toContain('Cover')
+  })
+
+  it('files the import on request', async () => {
+    const wrapper = render()
+
+    await wrapper.get('button').trigger('click')
+
+    expect(wrapper.emitted('file')).toHaveLength(1)
+  })
+
+  it('cannot be filed when the request has nowhere to file it into', () => {
+    const wrapper = render({ canFile: false })
+
+    expect(wrapper.get('button').attributes('disabled')).toBeDefined()
+    expect(wrapper.text()).toContain('no destination library')
+  })
+
+  /** Backend-gated too, but an approve button a requester cannot use should not be there at all. */
+  it('offers no action to somebody who cannot moderate the queue', () => {
+    const wrapper = render({}, { canManage: false })
+
+    expect(wrapper.find('button').exists()).toBe(false)
+    expect(wrapper.text()).toContain('fablehaven-01.m4b')
+  })
+
+  /**
+   * The state the dev database was actually in: both pointers to the dock entry are `on delete set
+   * null`, so filing it by hand leaves the request held over a file that no longer exists.
+   */
+  it('says so when the entry it was held over has left the Book Dock', () => {
+    const wrapper = render({ bookDockFileId: null, verification: null, files: [], totalSizeBytes: null, canFile: false })
+
+    expect(wrapper.text()).toContain('no longer in the Book Dock')
+    expect(wrapper.find('dl').exists()).toBe(false)
+    expect(wrapper.find('button').exists()).toBe(false)
+    expect(wrapper.text()).not.toContain('What landed')
+  })
+
+  it('explains a hold that no score produced, and compares nothing', () => {
+    const wrapper = render({ verification: null })
+
+    expect(wrapper.text()).toContain('Import checking is off')
+    expect(wrapper.find('dl').exists()).toBe(false)
+    expect(wrapper.text()).toContain('fablehaven-01.m4b')
+  })
+})
diff --git a/client/src/features/book-requests/__tests__/RequestSearchPanel.spec.ts b/client/src/features/book-requests/__tests__/RequestSearchPanel.spec.ts
new file mode 100644
index 000000000..453f8a9e0
--- /dev/null
+++ b/client/src/features/book-requests/__tests__/RequestSearchPanel.spec.ts
@@ -0,0 +1,778 @@
+import { mount } from '@vue/test-utils'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { MetadataProviderKey, Permission } from '@bookorbit/types'
+import type { BookRequestMediaKind, MetadataCandidate, MetadataProviderInfo, ResolvedRequestDestination } from '@bookorbit/types'
+import type { Ref } from 'vue'
+import type { CandidateGroup } from '../composables/useCandidateGroups'
+
+/**
+ * Refs cannot be built in `vi.hoisted`, which runs before any import. The mock factories build
+ * them instead and hand them back through this holder, so a test can drive the medium and the
+ * library list the component is looking at.
+ */
+const state = vi.hoisted(
+  () =>
+    ({
+      hasPermission: vi.fn<(permission: string) => boolean>(),
+      defaultFor: vi.fn<(mediaKind: BookRequestMediaKind) => ResolvedRequestDestination>(),
+      submit: vi.fn<() => Promise<unknown>>(),
+      submitFreeText: vi.fn<() => Promise<unknown>>(),
+      checkFreeText: vi.fn<() => Promise<unknown>>(),
+      push: vi.fn<() => Promise<void>>(),
+      routeQuery: {} as Record<string, string>,
+      toastError: vi.fn<(message: string) => void>(),
+    }) as {
+      hasPermission: ReturnType<typeof vi.fn>
+      defaultFor: ReturnType<typeof vi.fn>
+      mediaKind: Ref<BookRequestMediaKind>
+      libraries: Ref<{ id: number; name: string; folders: { id: number; path: string }[] }[]>
+      hasSearched: Ref<boolean>
+      providers: Ref<MetadataProviderInfo[]>
+      groups: Ref<CandidateGroup[]>
+      submit: ReturnType<typeof vi.fn>
+      submitFreeText: ReturnType<typeof vi.fn>
+      checkFreeText: ReturnType<typeof vi.fn>
+      push: ReturnType<typeof vi.fn>
+      routeQuery: Record<string, string>
+      toastError: ReturnType<typeof vi.fn>
+      lastFailure: Ref<{ code: string | null; meta: Record<string, unknown> | null; message: string | null } | null>
+    },
+)
+
+vi.mock('vue-sonner', () => ({
+  toast: { success: vi.fn<(message: string) => void>(), error: state.toastError },
+}))
+
+vi.mock('@/features/auth/composables/usePermissions', () => ({
+  usePermissions: () => ({ hasPermission: state.hasPermission }),
+}))
+
+// Who is signed in decides where a submitted request sends you, so the panel needs a user.
+vi.mock('@/features/auth/composables/useAuth', async () => {
+  const { ref } = await import('vue')
+  return { useAuth: () => ({ user: ref({ id: 7, username: 'ux' }) }) }
+})
+
+vi.mock('@/features/library/composables/useLibraries', async () => {
+  const { ref } = await import('vue')
+  state.libraries = ref([])
+  return { useLibraries: () => ({ libraries: state.libraries, fetchLibraries: vi.fn<() => Promise<void>>().mockResolvedValue(undefined) }) }
+})
+
+vi.mock('vue-router', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('vue-router')>()),
+  useRouter: () => ({ push: state.push }),
+  useRoute: () => ({ query: state.routeQuery }),
+}))
+
+vi.mock('@/features/book/composables/useMetadataSearch', async () => {
+  const { ref } = await import('vue')
+  state.hasSearched = ref(false)
+  state.providers = ref([])
+  return {
+    useMetadataSearch: () => ({
+      filteredResults: ref([]),
+      coverProviderOrder: ref([]),
+      resultProviderOrder: ref([]),
+      interruptedProviders: ref([]),
+      isStreaming: ref(false),
+      hasSearched: state.hasSearched,
+      providers: state.providers,
+      loadProviders: vi.fn<() => Promise<void>>().mockResolvedValue(undefined),
+      search: vi.fn<() => void>(),
+    }),
+  }
+})
+
+vi.mock('../composables/useRequestSubmission', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../composables/useRequestSubmission')>()
+  const { ref } = await import('vue')
+  state.mediaKind = ref<BookRequestMediaKind>('ebook')
+  state.lastFailure = ref(null)
+  return {
+    ...actual,
+    useRequestSubmission: () => ({
+      lastFailure: state.lastFailure,
+      submitting: ref(null),
+      mediaKind: state.mediaKind,
+      annotate: vi.fn<() => void>(),
+      getAvailability: vi.fn<() => null>().mockReturnValue(null),
+      submit: state.submit,
+      submitFreeText: state.submitFreeText,
+      checkFreeText: state.checkFreeText,
+      candidateKey: vi.fn<() => string>().mockReturnValue('k'),
+    }),
+  }
+})
+
+vi.mock('../composables/useCandidateGroups', async () => {
+  const { ref } = await import('vue')
+  state.groups = ref([])
+  return { useCandidateGroups: () => ({ groups: state.groups }) }
+})
+
+vi.mock('../composables/useRequestDestinationDefault', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('../composables/useRequestDestinationDefault')>()
+  const { ref } = await import('vue')
+  return {
+    ...actual,
+    useRequestDestinationDefault: () => ({
+      destinations: ref({}),
+      load: vi.fn<() => Promise<boolean>>().mockResolvedValue(true),
+      defaultFor: state.defaultFor,
+      // The panel never preselects the instance default; only what the request already carries.
+      resolveDestination: () => ({ libraryId: null, folderId: null }),
+    }),
+    useRequestLanguageDefault: () => ({
+      defaultLanguage: ref(null),
+      isSaving: ref(false),
+      load: vi.fn<() => Promise<boolean>>().mockResolvedValue(true),
+      setDefault: vi.fn<() => Promise<boolean>>().mockResolvedValue(true),
+      resolveLanguage: () => null,
+    }),
+  }
+})
+
+// Static, so every mock factory above has run by the time `beforeEach` reaches for its refs.
+import RequestSearchPanel from '../components/RequestSearchPanel.vue'
+
+const NO_DEFAULT: ResolvedRequestDestination = { libraryId: null, libraryName: null, folderId: null }
+
+async function render() {
+  const wrapper = mount(RequestSearchPanel)
+  // The panel resolves its destination in an async `onMounted`.
+  await new Promise((resolve) => setTimeout(resolve, 0))
+  return wrapper
+}
+
+/** The hint the panel shows when an auto-approving requester has nowhere to put the book. */
+function blockingHint(wrapper: Awaited<ReturnType<typeof render>>): boolean {
+  return wrapper.text().includes('pick the library the book should land in')
+}
+
+beforeEach(() => {
+  state.providers.value = []
+  state.groups.value = []
+  state.routeQuery = {}
+})
+
+describe('RequestSearchPanel provider sources', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    state.mediaKind.value = 'ebook'
+    state.libraries.value = []
+    state.hasSearched.value = false
+    state.hasPermission.mockReturnValue(false)
+    state.defaultFor.mockReturnValue(NO_DEFAULT)
+    state.providers.value = [
+      { key: MetadataProviderKey.GOOGLE, label: 'Google Books', identifiable: true },
+      { key: MetadataProviderKey.AMAZON, label: 'Amazon', identifiable: true },
+      { key: MetadataProviderKey.COMICVINE, label: 'ComicVine', identifiable: true },
+    ]
+    const google: MetadataCandidate = {
+      provider: MetadataProviderKey.GOOGLE,
+      providerId: 'google-1',
+      title: 'One Dark Window',
+      isbn13: '9780441013593',
+      publishedYear: 2022,
+      language: 'en',
+    }
+    const amazon: MetadataCandidate = {
+      provider: MetadataProviderKey.AMAZON,
+      providerId: 'amazon-1',
+      title: 'One Dark Window',
+      isbn10: '0441013597',
+      publishedYear: 2022,
+      language: 'en',
+    }
+    const comicVine: MetadataCandidate = {
+      provider: MetadataProviderKey.COMICVINE,
+      providerId: 'comicvine-1',
+      title: 'One Dark Window',
+      isbn13: '9781250301697',
+      publishedYear: 2023,
+      language: 'en',
+    }
+    state.groups.value = [
+      {
+        key: 'one-dark-window',
+        candidate: google,
+        candidates: [google, amazon, comicVine],
+        isbns: ['9780441013593', '9781250301697'],
+        isbnChoices: [
+          {
+            isbn: '9780441013593',
+            candidate: google,
+            providers: [MetadataProviderKey.GOOGLE, MetadataProviderKey.AMAZON],
+            languageRank: 1,
+            agreementCount: 2,
+            providerPriority: 0,
+            providerResultRank: 0,
+            yearDistance: 0,
+          },
+          {
+            isbn: '9781250301697',
+            candidate: comicVine,
+            providers: [MetadataProviderKey.COMICVINE],
+            languageRank: 1,
+            agreementCount: 1,
+            providerPriority: 1,
+            providerResultRank: 0,
+            yearDistance: 1,
+          },
+        ],
+        recommendedIsbnChoice: {
+          isbn: '9780441013593',
+          candidate: google,
+          providers: [MetadataProviderKey.GOOGLE, MetadataProviderKey.AMAZON],
+          languageRank: 1,
+          agreementCount: 2,
+          providerPriority: 0,
+          providerResultRank: 0,
+          yearDistance: 0,
+        },
+        title: 'One Dark Window',
+        authors: ['Rachel Gillig'],
+        coverUrl: null,
+        coverUrls: [],
+        publishedYear: 2022,
+        providers: [MetadataProviderKey.GOOGLE, MetadataProviderKey.AMAZON, MetadataProviderKey.COMICVINE],
+        availability: null,
+      },
+    ]
+  })
+
+  it('shows every contributing provider as an icon or initials badge', async () => {
+    const wrapper = await render()
+    const sources = wrapper.get('[role="img"]')
+
+    expect(sources.find('img[src="/assets/provider-icons/google.svg"]').exists()).toBe(true)
+    expect(sources.find('img[src="/assets/provider-icons/amazon.svg"]').exists()).toBe(true)
+    expect(sources.attributes('aria-label')).toContain('Google Books, Amazon, ComicVine')
+    expect(sources.text()).toContain('CO')
+    expect(sources.text()).not.toContain('3 sources')
+  })
+
+  it('exposes identifier conflicts and their provider provenance on demand', async () => {
+    const wrapper = await render()
+    const identifierButton = wrapper.findAll('button').find((button) => button.text().includes('2 ISBNs'))!
+
+    await identifierButton.trigger('click')
+
+    const text = wrapper.text()
+    expect(text).toContain('Metadata sources')
+    expect(text).toContain('Choose one of 2 ISBNs to search, or search by title and author.')
+    expect(text).toContain('9780441013593')
+    expect(text).toContain('9781250301697')
+    expect(text).toContain('Google Books')
+    expect(text).toContain('Amazon')
+    expect(text).toContain('ComicVine')
+  })
+
+  it('keeps the explicit ISBN chooser bounded when a grouped work carries many identifiers', async () => {
+    state.groups.value[0]!.isbns = Array.from({ length: 9 }, (_, index) => `978000000000${index}`)
+    const wrapper = await render()
+
+    await wrapper
+      .findAll('button')
+      .find((button) => button.text().includes('9 ISBNs'))!
+      .trigger('click')
+
+    expect(wrapper.text()).toContain('Choose one of 8 ISBNs to search, or search by title and author.')
+  })
+
+  it('uses the representative metadata ISBN deterministically for the primary action', async () => {
+    state.submit.mockResolvedValue(null)
+    const wrapper = await render()
+
+    await wrapper
+      .findAll('button')
+      .find((button) => button.text() === 'Request')!
+      .trigger('click')
+
+    expect(state.submit).toHaveBeenCalledWith(
+      state.groups.value[0]!.candidate,
+      expect.objectContaining({
+        isbn10: null,
+        isbn13: '9780441013593',
+        providerKey: MetadataProviderKey.GOOGLE,
+        providerId: 'google-1',
+        metadataSources: [
+          expect.objectContaining({ providerKey: MetadataProviderKey.GOOGLE, providerId: 'google-1', isbn13: '9780441013593' }),
+          expect.objectContaining({ providerKey: MetadataProviderKey.AMAZON, providerId: 'amazon-1', isbn10: '0441013597' }),
+          expect.objectContaining({ providerKey: MetadataProviderKey.COMICVINE, providerId: 'comicvine-1', isbn13: '9781250301697' }),
+        ],
+      }),
+    )
+  })
+
+  it('sends the note and preferred formats selected in the request form', async () => {
+    state.submit.mockResolvedValue(null)
+    const wrapper = await render()
+
+    await wrapper
+      .findAll('button')
+      .find((button) => button.text().includes('More options'))!
+      .trigger('click')
+    await wrapper.get('button[aria-label="Prefer EPUB"]').trigger('click')
+    await wrapper.get('#request-note').setValue('Please use the illustrated edition')
+    await wrapper
+      .findAll('button')
+      .find((button) => button.text() === 'Request')!
+      .trigger('click')
+
+    expect(state.submit).toHaveBeenCalledWith(
+      state.groups.value[0]!.candidate,
+      expect.objectContaining({ preferredFormats: ['epub'], note: 'Please use the illustrated edition' }),
+    )
+  })
+
+  it('shows the recommended ISBN and explains the deterministic ranking', async () => {
+    state.hasPermission.mockImplementation((permission: string) => permission === Permission.BookRequestSelfFulfill)
+    state.defaultFor.mockReturnValue({ libraryId: 4, libraryName: 'Novels', folderId: null })
+    const wrapper = await render()
+
+    expect(wrapper.findAll('button').find((button) => button.text() === 'Choose release')).toBeDefined()
+
+    await wrapper.get('button[aria-label="How BookOrbit chooses the recommended ISBN"]').trigger('click')
+    await wrapper.vm.$nextTick()
+
+    expect(document.body.textContent).toContain('How the recommended search is chosen')
+    expect(document.body.textContent).toContain('ISBN 9780441013593')
+    expect(document.body.textContent).toContain('Prefer the requested language')
+
+    await wrapper.get('button[aria-label="Choose an edition to search"]').trigger('click')
+    await wrapper.vm.$nextTick()
+
+    expect(document.body.textContent).toContain('Recommended')
+  })
+
+  it('defaults a user with both fulfillment permissions to automation', async () => {
+    state.hasPermission.mockImplementation(
+      (permission: string) => permission === Permission.BookRequestAutoApprove || permission === Permission.BookRequestSelfFulfill,
+    )
+    state.defaultFor.mockReturnValue({ libraryId: 4, libraryName: 'Novels', folderId: null })
+    state.submit.mockResolvedValue({ request: { id: 31, userId: 7, status: 'approved' }, subscribed: false })
+    const wrapper = await render()
+
+    const automatic = wrapper.findAll('button').find((button) => button.text() === 'Automatic')!
+    const choose = wrapper.findAll('button').find((button) => button.text() === 'Choose a release')!
+    expect(automatic.attributes('aria-pressed')).toBe('true')
+    expect(choose.attributes('aria-pressed')).toBe('false')
+    expect(wrapper.find('button[aria-label="How BookOrbit chooses the recommended ISBN"]').exists()).toBe(false)
+
+    await wrapper
+      .findAll('button')
+      .find((button) => button.text() === 'Get automatically')!
+      .trigger('click')
+    await new Promise((resolve) => setTimeout(resolve, 0))
+
+    expect(state.submit).toHaveBeenCalledWith(state.groups.value[0]!.candidate, expect.objectContaining({ selfServe: false }))
+    expect(state.push).not.toHaveBeenCalled()
+    expect(wrapper.emitted('submitted')).toHaveLength(1)
+  })
+
+  it('lets a user with both fulfillment permissions open the release picker instead', async () => {
+    state.hasPermission.mockImplementation(
+      (permission: string) => permission === Permission.BookRequestAutoApprove || permission === Permission.BookRequestSelfFulfill,
+    )
+    state.defaultFor.mockReturnValue({ libraryId: 4, libraryName: 'Novels', folderId: null })
+    state.submit.mockResolvedValue({ request: { id: 31, userId: 7, status: 'approved' }, subscribed: false })
+    const wrapper = await render()
+
+    await wrapper
+      .findAll('button')
+      .find((button) => button.text() === 'Choose a release')!
+      .trigger('click')
+
+    expect(
+      wrapper
+        .findAll('button')
+        .find((button) => button.text() === 'Choose a release')!
+        .attributes('aria-pressed'),
+    ).toBe('true')
+    expect(wrapper.find('button[aria-label="How BookOrbit chooses the recommended ISBN"]').exists()).toBe(true)
+
+    await wrapper
+      .findAll('button')
+      .find((button) => button.text() === 'Choose release')!
+      .trigger('click')
+    await new Promise((resolve) => setTimeout(resolve, 0))
+
+    expect(state.submit).toHaveBeenCalledWith(state.groups.value[0]!.candidate, expect.objectContaining({ selfServe: true }))
+    expect(state.push).toHaveBeenCalledWith({
+      name: 'book-request-releases',
+      params: { id: 31 },
+      query: { isbn: '9780441013593' },
+    })
+  })
+
+  it('offers a one-off manual indexer search even when metadata results exist', async () => {
+    state.hasPermission.mockImplementation(
+      (permission: string) => permission === Permission.BookRequestAutoApprove || permission === Permission.BookRequestSelfFulfill,
+    )
+    state.defaultFor.mockReturnValue({ libraryId: 4, libraryName: 'Novels', folderId: null })
+    state.hasSearched.value = true
+    state.submitFreeText.mockResolvedValue({ request: { id: 32, userId: 7, status: 'approved' }, subscribed: false })
+    const wrapper = await render()
+
+    await wrapper.get('#request-title').setValue('The Ex Hex')
+    await wrapper.get('#request-author').setValue('Erin Sterling')
+    expect(
+      wrapper
+        .findAll('button')
+        .find((button) => button.text() === 'Automatic')!
+        .attributes('aria-pressed'),
+    ).toBe('true')
+
+    await wrapper
+      .findAll('button')
+      .find((button) => button.text() === 'Search indexers manually')!
+      .trigger('click')
+    await new Promise((resolve) => setTimeout(resolve, 0))
+
+    expect(state.submitFreeText).toHaveBeenCalledWith({ title: 'The Ex Hex', author: 'Erin Sterling' }, expect.objectContaining({ selfServe: true }))
+    expect(state.push).toHaveBeenCalledWith({ name: 'book-request-releases', params: { id: 32 }, query: {} })
+  })
+
+  it('lets a self-fulfilling user search the exact ISBN from a metadata row', async () => {
+    state.hasPermission.mockImplementation((permission: string) => permission === Permission.BookRequestSelfFulfill)
+    state.defaultFor.mockReturnValue({ libraryId: 4, libraryName: 'Novels', folderId: null })
+    state.submit.mockResolvedValue({ request: { id: 31, userId: 7, status: 'approved' }, subscribed: false })
+    const wrapper = await render()
+
+    await wrapper
+      .findAll('button')
+      .find((button) => button.text().includes('2 ISBNs'))!
+      .trigger('click')
+    await wrapper
+      .findAll('button')
+      .find((button) => button.text() === 'Find release')!
+      .trigger('click')
+    await new Promise((resolve) => setTimeout(resolve, 0))
+
+    expect(state.submit).toHaveBeenCalledWith(
+      expect.objectContaining({ providerId: 'google-1' }),
+      expect.objectContaining({ isbn13: '9780441013593', providerKey: MetadataProviderKey.GOOGLE, providerId: 'google-1' }),
+    )
+    expect(state.push).toHaveBeenCalledWith({
+      name: 'book-request-releases',
+      params: { id: 31 },
+      query: { isbn: '9780441013593' },
+    })
+  })
+
+  /** The picker is a route on top of the list, and closing it goes back to whatever was underneath. */
+  it('carries the list query into the picker and clears the ISBN of the last request', async () => {
+    state.routeQuery = { tab: 'all', status: 'pending', isbn: '9780000000001' }
+    state.hasPermission.mockImplementation((permission: string) => permission === Permission.BookRequestSelfFulfill)
+    state.defaultFor.mockReturnValue({ libraryId: 4, libraryName: 'Novels', folderId: null })
+    state.submit.mockResolvedValue({ request: { id: 31, userId: 7, status: 'approved' }, subscribed: false })
+    const wrapper = await render()
+
+    await wrapper
+      .findAll('button')
+      .find((button) => button.text().includes('2 ISBNs'))!
+      .trigger('click')
+    await wrapper
+      .findAll('button')
+      .find((button) => button.text() === 'Find release')!
+      .trigger('click')
+    await new Promise((resolve) => setTimeout(resolve, 0))
+
+    expect(state.push).toHaveBeenCalledWith({
+      name: 'book-request-releases',
+      params: { id: 31 },
+      query: { tab: 'all', status: 'pending', isbn: '9780441013593' },
+    })
+  })
+})
+
+describe('RequestSearchPanel destination', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    state.mediaKind.value = 'ebook'
+    state.libraries.value = [
+      { id: 4, name: 'Novels', folders: [{ id: 9, path: '/books' }] },
+      { id: 5, name: 'Audiobooks', folders: [{ id: 10, path: '/audio' }] },
+    ]
+    state.hasPermission.mockImplementation((permission: string) => permission === Permission.BookRequestAutoApprove)
+    state.defaultFor.mockReturnValue(NO_DEFAULT)
+  })
+
+  /**
+   * The regression this exists for. Nothing is preselected any more, so an auto-approving
+   * requester sits on an unpicked select by default; reading that as "no destination" disabled
+   * every Request button on any instance that had defaults configured.
+   */
+  it('lets an auto-approving requester submit on the instance default alone', async () => {
+    state.defaultFor.mockReturnValue({ libraryId: 4, libraryName: 'Novels', folderId: 9 })
+
+    const wrapper = await render()
+
+    expect(blockingHint(wrapper)).toBe(false)
+  })
+
+  it('names the instance default rather than leaving the select blank', async () => {
+    state.defaultFor.mockReturnValue({ libraryId: 4, libraryName: 'Novels', folderId: 9 })
+
+    const wrapper = await render()
+
+    expect(wrapper.get('#request-library').text()).toContain('Default (Novels)')
+  })
+
+  it('still blocks an auto-approving requester when there is no default either', async () => {
+    const wrapper = await render()
+
+    expect(blockingHint(wrapper)).toBe(true)
+  })
+
+  it('stops blocking once a library is picked by hand', async () => {
+    const wrapper = await render()
+    expect(blockingHint(wrapper)).toBe(true)
+
+    await wrapper.get('#request-library').setValue('4')
+
+    expect(blockingHint(wrapper)).toBe(false)
+  })
+
+  /** Only the auto-approving requester is stuck; everyone else has an approver to decide. */
+  it('never blocks a requester whose requests go to an approver', async () => {
+    state.hasPermission.mockReturnValue(false)
+
+    const wrapper = await render()
+
+    expect(blockingHint(wrapper)).toBe(false)
+  })
+
+  /** The default is per medium, so the answer has to follow the segmented control. */
+  it('reads the default for the medium currently selected', async () => {
+    state.defaultFor.mockImplementation((kind: BookRequestMediaKind) =>
+      kind === 'audiobook' ? { libraryId: 5, libraryName: 'Audiobooks', folderId: 10 } : NO_DEFAULT,
+    )
+
+    const wrapper = await render()
+    expect(blockingHint(wrapper)).toBe(true)
+
+    state.mediaKind.value = 'audiobook'
+    await wrapper.vm.$nextTick()
+
+    expect(blockingHint(wrapper)).toBe(false)
+    expect(wrapper.get('#request-library').text()).toContain('Default (Audiobooks)')
+  })
+})
+
+/**
+ * The escape hatch for a work no metadata provider carries. Gated twice over: only after a search
+ * that found nothing, and only for somebody who will pick the release themselves, because an
+ * approver handed a row that says nothing but a typed string cannot tell what was meant.
+ */
+describe('RequestSearchPanel free-text fallback', () => {
+  const ACTION = 'Search indexers'
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+    state.mediaKind.value = 'ebook'
+    state.libraries.value = [{ id: 4, name: 'Novels', folders: [{ id: 9, path: '/books' }] }]
+    state.defaultFor.mockReturnValue({ libraryId: 4, libraryName: 'Novels', folderId: 9 })
+    state.hasSearched.value = true
+    state.checkFreeText.mockResolvedValue(null)
+    state.hasPermission.mockImplementation((permission: string) => permission === Permission.BookRequestSelfFulfill)
+  })
+
+  /** Past the hint debounce, then let its promise resolve. */
+  async function settleHint(wrapper: Awaited<ReturnType<typeof render>>) {
+    await new Promise((resolve) => setTimeout(resolve, 400))
+    await wrapper.vm.$nextTick()
+    await new Promise((resolve) => setTimeout(resolve, 0))
+  }
+
+  async function typeTitle(wrapper: Awaited<ReturnType<typeof render>>, value = 'An Untracked Novel') {
+    await wrapper.find('#request-title').setValue(value)
+    await new Promise((resolve) => setTimeout(resolve, 0))
+    return wrapper
+  }
+
+  it('offers a direct indexer search once a provider search comes back empty', async () => {
+    const wrapper = await typeTitle(await render())
+    expect(wrapper.text()).toContain(ACTION)
+  })
+
+  it('never offers it to somebody who cannot fulfil their own requests', async () => {
+    state.hasPermission.mockReturnValue(false)
+
+    const wrapper = await typeTitle(await render())
+    expect(wrapper.text()).not.toContain(ACTION)
+  })
+
+  it('does not offer it before a search has been run', async () => {
+    state.hasSearched.value = false
+
+    const wrapper = await typeTitle(await render())
+    expect(wrapper.text()).not.toContain(ACTION)
+  })
+
+  it('says what the library already has, before anything is created', async () => {
+    state.checkFreeText.mockResolvedValue({ ownedBookId: 12, existingRequestId: null, alreadySubscribed: false })
+
+    const wrapper = await typeTitle(await render())
+    await settleHint(wrapper)
+
+    expect(wrapper.text()).toContain('Already in your library')
+    expect(state.submitFreeText).not.toHaveBeenCalled()
+  })
+
+  /**
+   * The empty state stays on screen while somebody keeps typing, so an unthrottled hint asked the
+   * server once per keystroke.
+   */
+  it('asks about the typed text once, not once per keystroke', async () => {
+    state.checkFreeText.mockResolvedValue(null)
+    const wrapper = await render()
+
+    for (const value of ['A', 'An', 'An U', 'An Untracked Novel']) {
+      await wrapper.find('#request-title').setValue(value)
+    }
+    await settleHint(wrapper)
+
+    expect(state.checkFreeText).toHaveBeenCalledTimes(1)
+    expect(state.checkFreeText).toHaveBeenLastCalledWith(expect.objectContaining({ title: 'An Untracked Novel' }))
+  })
+
+  /**
+   * The refusals this endpoint raises are copy this application wrote about rules this instance
+   * applies, so they have to arrive translated. The server sentence stays only for what nothing
+   * classified, which is what makes the generic fallback the last resort rather than the norm.
+   */
+  it('shows the translated refusal rather than the English sentence beside it', async () => {
+    state.submitFreeText.mockResolvedValue(null)
+    state.lastFailure.value = {
+      code: 'SUBMIT_SELF_SERVE_LIMIT',
+      meta: { limit: 10 },
+      message: 'Finish or cancel some downloads first: 10 can be in flight at once',
+    }
+
+    const wrapper = await typeTitle(await render())
+    await wrapper
+      .findAll('button')
+      .find((button) => button.text().includes(ACTION))!
+      .trigger('click')
+    await new Promise((resolve) => setTimeout(resolve, 0))
+
+    expect(state.toastError).toHaveBeenCalledWith('Finish or cancel some downloads first: you can have 10 in flight at once')
+    expect(state.push).not.toHaveBeenCalled()
+  })
+
+  it('falls back to its own message when the server classified nothing', async () => {
+    state.submitFreeText.mockResolvedValue(null)
+    state.lastFailure.value = null
+
+    const wrapper = await typeTitle(await render())
+    await wrapper
+      .findAll('button')
+      .find((button) => button.text().includes(ACTION))!
+      .trigger('click')
+    await new Promise((resolve) => setTimeout(resolve, 0))
+
+    expect(state.toastError).toHaveBeenCalledWith('Could not submit that request')
+  })
+
+  it('creates a self-serve request and goes straight to the picker', async () => {
+    state.submitFreeText.mockResolvedValue({ request: { id: 31, userId: 7, status: 'approved' }, subscribed: false })
+
+    const wrapper = await typeTitle(await render())
+    await wrapper
+      .findAll('button')
+      .find((button) => button.text().includes(ACTION))!
+      .trigger('click')
+    await new Promise((resolve) => setTimeout(resolve, 0))
+
+    expect(state.submitFreeText).toHaveBeenCalledWith(
+      expect.objectContaining({ title: 'An Untracked Novel' }),
+      expect.objectContaining({ selfServe: true }),
+    )
+    expect(state.push).toHaveBeenCalledWith({ name: 'book-request-releases', params: { id: 31 }, query: {} })
+  })
+
+  /** Somebody else is already fetching this work, so there is nothing of ours to pick a release for. */
+  it("stays put when the request folds into somebody else's live one", async () => {
+    state.submitFreeText.mockResolvedValue({ request: { id: 31, userId: 99, status: 'approved' }, subscribed: true })
+
+    const wrapper = await typeTitle(await render())
+    await wrapper
+      .findAll('button')
+      .find((button) => button.text().includes(ACTION))!
+      .trigger('click')
+    await new Promise((resolve) => setTimeout(resolve, 0))
+
+    expect(state.push).not.toHaveBeenCalled()
+  })
+
+  /**
+   * Choosing a release twice folds you into your *own* row, which still reports `subscribed`. Being
+   * told you joined a queue you are already at the front of is wrong; ownership decides, not the flag.
+   */
+  it('returns you to your own picker when the work folds into a request you already own', async () => {
+    state.submitFreeText.mockResolvedValue({ request: { id: 31, userId: 7, status: 'approved' }, subscribed: true })
+
+    const wrapper = await typeTitle(await render())
+    await wrapper
+      .findAll('button')
+      .find((button) => button.text().includes(ACTION))!
+      .trigger('click')
+    await new Promise((resolve) => setTimeout(resolve, 0))
+
+    expect(state.push).toHaveBeenCalledWith({ name: 'book-request-releases', params: { id: 31 }, query: {} })
+  })
+
+  /**
+   * One live request per work, so a self-fulfiller's submission cannot open a row beside somebody
+   * else's: the server hands them that row instead, and the picker is where they were going.
+   */
+  it('goes to the picker for a request the server handed over to the caller', async () => {
+    state.submitFreeText.mockResolvedValue({
+      request: { id: 31, userId: 99, fulfillerUserId: 7, status: 'approved' },
+      subscribed: true,
+    })
+
+    const wrapper = await typeTitle(await render())
+    await wrapper
+      .findAll('button')
+      .find((button) => button.text().includes(ACTION))!
+      .trigger('click')
+    await new Promise((resolve) => setTimeout(resolve, 0))
+
+    expect(state.push).toHaveBeenCalledWith({ name: 'book-request-releases', params: { id: 31 }, query: {} })
+  })
+
+  /** Somebody else took it on, so the requester it names is no longer the one driving it either. */
+  it('stays put on a request somebody else was handed', async () => {
+    state.submitFreeText.mockResolvedValue({
+      request: { id: 31, userId: 7, fulfillerUserId: 99, status: 'approved' },
+      subscribed: true,
+    })
+
+    const wrapper = await typeTitle(await render())
+    await wrapper
+      .findAll('button')
+      .find((button) => button.text().includes(ACTION))!
+      .trigger('click')
+    await new Promise((resolve) => setTimeout(resolve, 0))
+
+    expect(state.push).not.toHaveBeenCalled()
+  })
+
+  /** A settled row has no picker to return to, so folding into one is just a subscription. */
+  it('does not send you to a picker for a request that already finished', async () => {
+    state.submitFreeText.mockResolvedValue({ request: { id: 31, userId: 7, status: 'available' }, subscribed: true })
+
+    const wrapper = await typeTitle(await render())
+    await wrapper
+      .findAll('button')
+      .find((button) => button.text().includes(ACTION))!
+      .trigger('click')
+    await new Promise((resolve) => setTimeout(resolve, 0))
+
+    expect(state.push).not.toHaveBeenCalled()
+  })
+})
diff --git a/client/src/features/book-requests/__tests__/RequestSeedPanel.spec.ts b/client/src/features/book-requests/__tests__/RequestSeedPanel.spec.ts
new file mode 100644
index 000000000..abf7d4688
--- /dev/null
+++ b/client/src/features/book-requests/__tests__/RequestSeedPanel.spec.ts
@@ -0,0 +1,205 @@
+import { flushPromises, mount } from '@vue/test-utils'
+import { defineComponent } from 'vue'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { BookRequestItem, BookRequestSeedStatus } from '@bookorbit/types'
+
+const { apiMock } = vi.hoisted(() => ({ apiMock: vi.fn<(url: string, init?: RequestInit) => Promise<Response>>() }))
+
+vi.mock('@/lib/api', () => ({ api: apiMock }))
+
+import RequestSeedPanel from '../components/RequestSeedPanel.vue'
+
+/** The dialog only matters here as something that emits confirm, so it stays a stub. */
+const ConfirmDialogStub = defineComponent({
+  name: 'ConfirmDialogStub',
+  props: { open: { type: Boolean, default: false } },
+  emits: ['confirm', 'cancel'],
+  template: '<div />',
+})
+
+function response(body: string, ok = true): Response {
+  return { ok, status: ok ? 200 : 500, text: vi.fn<() => Promise<string>>().mockResolvedValue(body) } as unknown as Response
+}
+
+function seed(overrides: Partial<BookRequestSeedStatus> = {}): BookRequestSeedStatus {
+  return {
+    downloadId: 11,
+    downloadClientId: 4,
+    downloadClientName: 'qbit',
+    clientHash: 'c9e15763f722f23e98a29decdfae341b98d53056',
+    seeding: true,
+    ratio: 1.25,
+    ratioGoal: 2,
+    seedingTimeSeconds: 7200,
+    seedingTimeGoalMinutes: 4320,
+    uploadedBytes: 1024 * 1024,
+    ...overrides,
+  }
+}
+
+function request(overrides: Partial<BookRequestItem> = {}): BookRequestItem {
+  return {
+    id: 7,
+    title: 'Dune',
+    status: 'available',
+    authors: ['Frank Herbert'],
+    subscribers: [],
+    download: { id: 11, requestId: 7, source: 'torrent_file', status: 'imported', automated: false, releaseTitle: 'Dune [EPUB]' },
+    ...overrides,
+  } as BookRequestItem
+}
+
+async function mountPanel(props: Partial<{ request: BookRequestItem; busy: boolean; canManage: boolean }> = {}) {
+  const wrapper = mount(RequestSeedPanel, {
+    props: { request: request(), busy: false, canManage: true, ...props },
+    global: { stubs: { ConfirmDialog: ConfirmDialogStub } },
+  })
+  await flushPromises()
+  return wrapper
+}
+
+describe('RequestSeedPanel', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    apiMock.mockResolvedValue(response(JSON.stringify(seed())))
+  })
+
+  it('reads the seed state live when a request is opened', async () => {
+    await mountPanel()
+
+    expect(apiMock).toHaveBeenCalledWith('/api/v1/admin/book-requests/7/seed')
+  })
+
+  it('keeps the seed readout when the parent refreshes the same request', async () => {
+    const wrapper = await mountPanel()
+
+    await wrapper.setProps({ request: { ...request(), title: 'Dune Messiah' } })
+    await flushPromises()
+
+    expect(apiMock).toHaveBeenCalledTimes(1)
+    expect(wrapper.text()).toContain('1.25 of 2')
+  })
+
+  it('shows the ratio and the time against the goals the client was given', async () => {
+    const wrapper = await mountPanel()
+
+    expect(wrapper.text()).toContain('Seeding')
+    expect(wrapper.text()).toContain('1.25 of 2')
+    expect(wrapper.text()).toContain('2 h of 72 h')
+  })
+
+  /** The goals are what the client stops on, so they are drawn as fractions rather than listed. */
+  it('draws a meter for each goal the client reported', async () => {
+    const wrapper = await mountPanel()
+
+    const meters = wrapper.findAll('[data-testid="seed-meter"]')
+    expect(meters).toHaveLength(2)
+    expect(meters[0]!.find('div').attributes('style')).toContain('width: 62.5%')
+    expect(meters[1]!.find('div').attributes('style')).toContain('width: 2.777')
+  })
+
+  /** A goal the client never stated leaves nothing for the figure to be a fraction of. */
+  it('leaves a figure with no goal as a plain number', async () => {
+    apiMock.mockResolvedValue(response(JSON.stringify(seed({ ratioGoal: null, seedingTimeGoalMinutes: null }))))
+
+    const wrapper = await mountPanel()
+
+    expect(wrapper.findAll('[data-testid="seed-meter"]')).toHaveLength(0)
+    expect(wrapper.text()).toContain('1.25')
+    expect(wrapper.text()).not.toContain('1.25 of')
+  })
+
+  it('says the torrent is gone rather than reporting a seed at zero', async () => {
+    apiMock.mockResolvedValue(response(''))
+
+    const wrapper = await mountPanel()
+
+    expect(wrapper.text()).toContain('no longer has this torrent')
+    expect(wrapper.text()).not.toContain('Ratio')
+  })
+
+  it('asks nothing of the client for a request that was never grabbed', async () => {
+    await mountPanel({ request: request({ download: null }) })
+
+    expect(apiMock).not.toHaveBeenCalled()
+  })
+
+  it('does not render torrent controls or read seed state for a direct HTTP download', async () => {
+    const wrapper = await mountPanel({
+      request: request({
+        download: { id: 11, requestId: 7, source: 'direct_url', status: 'imported', automated: false } as BookRequestItem['download'],
+      }),
+    })
+
+    expect(apiMock).not.toHaveBeenCalled()
+    expect(wrapper.text()).toBe('')
+  })
+
+  it('marks a release the automation picked, so a retry is explicable', async () => {
+    const wrapper = await mountPanel({
+      request: request({
+        download: { id: 11, requestId: 7, source: 'torrent_file', status: 'imported', automated: true } as BookRequestItem['download'],
+      }),
+    })
+
+    expect(wrapper.text()).toContain('picked this release automatically')
+  })
+
+  /** Deleting the seeded copy is the opt-in half of the action, never the default. */
+  it('removes without deleting files unless the box is ticked', async () => {
+    const wrapper = await mountPanel()
+
+    await wrapper
+      .findAll('button')
+      .find((button) => button.text() === 'Remove from client')!
+      .trigger('click')
+    wrapper.getComponent(ConfirmDialogStub).vm.$emit('confirm')
+
+    expect(wrapper.emitted('remove')?.[0]?.[0]).toEqual({ request: expect.objectContaining({ id: 7 }), downloadId: 11, deleteFiles: false })
+  })
+
+  /**
+   * The parent owns the call, so the panel only learns it finished when `busy` drops. Without the
+   * re-read it goes on offering to remove a torrent the client no longer has.
+   */
+  it('re-reads the client once the removal it asked for has finished', async () => {
+    const wrapper = await mountPanel()
+
+    await wrapper
+      .findAll('button')
+      .find((button) => button.text() === 'Remove from client')!
+      .trigger('click')
+    wrapper.getComponent(ConfirmDialogStub).vm.$emit('confirm')
+
+    apiMock.mockResolvedValue(response(''))
+    await wrapper.setProps({ busy: true })
+    await wrapper.setProps({ busy: false })
+    await flushPromises()
+
+    expect(apiMock).toHaveBeenCalledTimes(2)
+    expect(wrapper.text()).toContain('no longer has this torrent')
+  })
+
+  it('leaves the seed state alone while some other action on the request is running', async () => {
+    const wrapper = await mountPanel()
+
+    await wrapper.setProps({ busy: true })
+    await wrapper.setProps({ busy: false })
+    await flushPromises()
+
+    expect(apiMock).toHaveBeenCalledTimes(1)
+  })
+
+  it('carries the delete-files choice through to the removal', async () => {
+    const wrapper = await mountPanel()
+
+    await wrapper.get('input[type="checkbox"]').setValue(true)
+    await wrapper
+      .findAll('button')
+      .find((button) => button.text() === 'Remove from client')!
+      .trigger('click')
+    wrapper.getComponent(ConfirmDialogStub).vm.$emit('confirm')
+
+    expect(wrapper.emitted('remove')?.[0]?.[0]).toMatchObject({ deleteFiles: true })
+  })
+})
diff --git a/client/src/features/book-requests/__tests__/releaseFacets.spec.ts b/client/src/features/book-requests/__tests__/releaseFacets.spec.ts
new file mode 100644
index 000000000..96569da9f
--- /dev/null
+++ b/client/src/features/book-requests/__tests__/releaseFacets.spec.ts
@@ -0,0 +1,96 @@
+// @vitest-environment node
+import { describe, expect, it } from 'vitest'
+import type { ReleaseCandidateItem } from '@bookorbit/types'
+import { facetsOf, formatKey, formatKeys, languageKey } from '../releaseFacets'
+
+function release(overrides: Partial<ReleaseCandidateItem> = {}): ReleaseCandidateItem {
+  return {
+    indexerId: 1,
+    indexerName: 'jackett',
+    guid: 'g1',
+    title: 'Dune',
+    sizeBytes: null,
+    seeders: null,
+    leechers: null,
+    format: null,
+    formats: [],
+    language: null,
+    fileCount: null,
+    freeleech: false,
+    vipOnly: false,
+    alreadyGrabbed: false,
+    publishedAt: null,
+    audio: null,
+    score: 50,
+    tier: null,
+    tierName: null,
+    reasons: [],
+    ...overrides,
+  }
+}
+
+/**
+ * The picker groups its language and format facets by resolved name rather than by the raw string
+ * the indexer sent. These lock in the collisions that made it necessary: MyAnonaMouse reports
+ * "ENG" where Project Gutenberg reports "en", and both render as English. Faceting on the raw code
+ * produced two chips reading "English", and picking either silently hid the other's releases.
+ */
+describe('release language faceting', () => {
+  it('resolves the two spellings indexers actually send to the same name', () => {
+    expect(languageKey('ENG')).toBe(languageKey('en'))
+  })
+
+  it('collapses them into one facet rather than two chips reading English', () => {
+    const releases = [{ language: 'ENG' }, { language: 'ENG' }, { language: 'en' }, { language: 'fi' }, { language: null }]
+
+    const facets = facetsOf(releases, (item) => languageKey(item.language))
+
+    expect(facets).toEqual([
+      { value: 'English', count: 3 },
+      { value: 'Finnish', count: 1 },
+    ])
+  })
+
+  it('leaves a code it cannot resolve alone rather than dropping the releases', () => {
+    expect(languageKey('zzz')).toBe('zzz')
+  })
+})
+
+describe('release format faceting', () => {
+  it('treats a format as one value regardless of the case the indexer used', () => {
+    const releases = [release({ formats: ['epub'] }), release({ formats: ['EPUB'] }), release({ formats: ['Epub'] }), release({ formats: ['pdf'] })]
+
+    expect(facetsOf(releases, formatKeys)).toEqual([
+      { value: 'EPUB', count: 3 },
+      { value: 'PDF', count: 1 },
+    ])
+  })
+
+  it('ignores a release that states no format at all', () => {
+    expect(facetsOf([release(), release({ formats: ['EPUB'] })], formatKeys)).toEqual([{ value: 'EPUB', count: 1 }])
+  })
+
+  /**
+   * The bug this exists to prevent. MyAnonaMouse publishes "azw3 epub mobi" for one book in three
+   * formats; counting it under only the first left the EPUB chip reading 1, and choosing that chip
+   * hid the very release that carried the requested EPUB.
+   */
+  it('counts a multi-format release under every format it carries', () => {
+    const releases = [release({ formats: ['epub', 'azw3', 'mobi'] }), release({ formats: ['epub'] })]
+
+    expect(facetsOf(releases, formatKeys)).toEqual([
+      { value: 'EPUB', count: 2 },
+      { value: 'AZW3', count: 1 },
+      { value: 'MOBI', count: 1 },
+    ])
+  })
+
+  it('counts a release once per format even where the indexer repeated one', () => {
+    expect(facetsOf([release({ formats: ['epub', 'EPUB'] })], formatKeys)).toEqual([{ value: 'EPUB', count: 1 }])
+  })
+
+  it('normalises a single format the same way as a list', () => {
+    expect(formatKey('epub')).toBe('EPUB')
+    expect(formatKey(null)).toBeNull()
+  })
+})
diff --git a/client/src/features/book-requests/__tests__/requestActions.spec.ts b/client/src/features/book-requests/__tests__/requestActions.spec.ts
new file mode 100644
index 000000000..3921102e7
--- /dev/null
+++ b/client/src/features/book-requests/__tests__/requestActions.spec.ts
@@ -0,0 +1,121 @@
+// @vitest-environment node
+import { describe, expect, it } from 'vitest'
+import { BOOK_REQUEST_STATUSES } from '@bookorbit/types'
+import type { BookRequestDownloadItem, BookRequestItem, BookRequestStatus } from '@bookorbit/types'
+import { canBulkActRequest, canCancelRequest, canDeleteRequest, canDismissRequest, cancelStopsATransfer } from '../requestActions'
+
+const OWNER = 4
+const STRANGER = 9
+
+function request(overrides: Partial<BookRequestItem> = {}): BookRequestItem {
+  return { id: 1, userId: OWNER, status: 'pending', dismissed: false, download: null, ...overrides } as BookRequestItem
+}
+
+function withDownload(status: BookRequestDownloadItem['status']): BookRequestItem {
+  return request({ status: 'downloading', download: { id: 7, status } as BookRequestDownloadItem })
+}
+
+describe('canCancelRequest', () => {
+  it('lets the owner stop anything that has not settled', () => {
+    const open: BookRequestStatus[] = ['pending', 'approved', 'searching', 'grabbed', 'downloading', 'importing', 'needs_review', 'failed']
+
+    for (const status of open) {
+      expect(canCancelRequest(request({ status }), OWNER, false)).toBe(true)
+    }
+  })
+
+  it.each(['rejected', 'cancelled', 'available'] as const)('offers nothing on a request that already settled as %s', (status) => {
+    expect(canCancelRequest(request({ status }), OWNER, true)).toBe(false)
+  })
+
+  it('refuses a stranger and allows a moderator', () => {
+    expect(canCancelRequest(request(), STRANGER, false)).toBe(false)
+    expect(canCancelRequest(request(), STRANGER, true)).toBe(true)
+  })
+
+  /** A signed-out render must not read as ownership of a request whose userId happens to be null. */
+  it('does not treat an unknown viewer as the owner', () => {
+    expect(canCancelRequest(request({ userId: null as unknown as number }), null, false)).toBe(false)
+  })
+
+  /**
+   * A self-fulfiller whose submission collided with this request was handed it to drive, and they
+   * are the only person who can stop the transfer they started on it.
+   */
+  it('lets the self-fulfiller who was handed the request stop it', () => {
+    const handedOver = request({ userId: OWNER, fulfillerUserId: STRANGER })
+
+    expect(canCancelRequest(handedOver, STRANGER, false, true)).toBe(true)
+  })
+
+  /** The permission can be taken away after the request was handed over; the server checks it too. */
+  it('offers nothing to a fulfiller who no longer holds the permission', () => {
+    const handedOver = request({ userId: OWNER, fulfillerUserId: STRANGER })
+
+    expect(canCancelRequest(handedOver, STRANGER, false, false)).toBe(false)
+  })
+
+  /** The requester keeps their own row: handing it over does not take it off their list. */
+  it('still lets the original requester stop a request somebody else drives', () => {
+    const handedOver = request({ userId: OWNER, fulfillerUserId: STRANGER })
+
+    expect(canCancelRequest(handedOver, OWNER, false)).toBe(true)
+  })
+})
+
+describe('canDismissRequest', () => {
+  it.each(['rejected', 'cancelled', 'available', 'failed'] as const)('hides a settled %s request', (status) => {
+    expect(canDismissRequest(request({ status }))).toBe(true)
+  })
+
+  it('refuses to hide work that is still running', () => {
+    for (const status of BOOK_REQUEST_STATUSES.filter((s) => !['rejected', 'cancelled', 'available', 'failed'].includes(s))) {
+      expect(canDismissRequest(request({ status }))).toBe(false)
+    }
+  })
+})
+
+describe('canDeleteRequest', () => {
+  it('is a moderator action on a settled request', () => {
+    expect(canDeleteRequest(request({ status: 'available' }), true)).toBe(true)
+    expect(canDeleteRequest(request({ status: 'available' }), false)).toBe(false)
+    expect(canDeleteRequest(request({ status: 'downloading' }), true)).toBe(false)
+  })
+})
+
+describe('cancelStopsATransfer', () => {
+  it.each(['queued', 'downloading', 'completed', 'importing'] as const)('warns when the client is still holding a %s attempt', (status) => {
+    expect(cancelStopsATransfer(withDownload(status))).toBe(true)
+  })
+
+  it('does not warn about a request that never reached a download client', () => {
+    expect(cancelStopsATransfer(request({ status: 'searching' }))).toBe(false)
+  })
+
+  it('does not warn once the attempt is finished with', () => {
+    expect(cancelStopsATransfer(withDownload('imported'))).toBe(false)
+    expect(cancelStopsATransfer(withDownload('failed'))).toBe(false)
+  })
+})
+
+describe('canBulkActRequest', () => {
+  it('offers a checkbox on a pending row only to someone who could approve it', () => {
+    expect(canBulkActRequest(request({ status: 'pending' }), true)).toBe(true)
+    expect(canBulkActRequest(request({ status: 'pending' }), false)).toBe(false)
+  })
+
+  it.each(['rejected', 'cancelled', 'available', 'failed'] as const)('offers a checkbox on a settled %s row to anyone', (status) => {
+    expect(canBulkActRequest(request({ status }), false)).toBe(true)
+  })
+
+  it('offers nothing on a row that is already hidden, since hiding is the action', () => {
+    expect(canBulkActRequest(request({ status: 'available', dismissed: true }), true)).toBe(false)
+  })
+
+  it.each(['approved', 'searching', 'grabbed', 'downloading', 'importing', 'needs_review'] as const)(
+    'offers nothing mid-flight at %s, where neither bulk action applies',
+    (status) => {
+      expect(canBulkActRequest(request({ status }), true)).toBe(false)
+    },
+  )
+})
diff --git a/client/src/features/book-requests/__tests__/requestOutcome.spec.ts b/client/src/features/book-requests/__tests__/requestOutcome.spec.ts
new file mode 100644
index 000000000..d3ce8d203
--- /dev/null
+++ b/client/src/features/book-requests/__tests__/requestOutcome.spec.ts
@@ -0,0 +1,96 @@
+// @vitest-environment node
+import { describe, expect, it } from 'vitest'
+import type { BookRequestDownloadItem, BookRequestItem, BookRequestProgressEvent } from '@bookorbit/types'
+import { requestOutcome } from '../requestOutcome'
+
+const TIME = 'just now'
+const formatTime = () => TIME
+
+function request(overrides: Partial<BookRequestItem> = {}): BookRequestItem {
+  return {
+    id: 1,
+    status: 'pending',
+    dismissed: false,
+    download: null,
+    targetLibraryName: null,
+    updatedAt: '2026-08-19T10:00:00.000Z',
+    ...overrides,
+  } as BookRequestItem
+}
+
+function download(status: BookRequestDownloadItem['status']): BookRequestDownloadItem {
+  return { id: 7, status } as BookRequestDownloadItem
+}
+
+describe('requestOutcome', () => {
+  it('reports a live transfer over anything the status would say', () => {
+    const row = request({ status: 'downloading', download: download('downloading') })
+
+    expect(requestOutcome(row, null, formatTime)).toEqual({ kind: 'progress', key: null })
+  })
+
+  it('keeps a later fetched download state over an older live tick', () => {
+    const row = request({ status: 'grabbed', download: download('completed') })
+    const live: BookRequestProgressEvent = {
+      requestId: 1,
+      downloadId: 7,
+      status: 'downloading',
+      progressPercent: 12,
+      downloadedBytes: 12,
+      totalBytes: 100,
+    }
+
+    expect(requestOutcome(row, live, formatTime).kind).toBe('waiting')
+  })
+
+  it('leaves the body to the caller on a failure, since the reason is the tracker prose', () => {
+    const row = request({ status: 'failed', statusReason: 'Tracker said no' })
+
+    expect(requestOutcome(row, null, formatTime)).toEqual({ kind: 'failure', key: null })
+  })
+
+  it('names the library a finished request landed in', () => {
+    const row = request({ status: 'available', targetLibraryName: 'Novels' })
+
+    expect(requestOutcome(row, null, formatTime)).toEqual({
+      kind: 'settled',
+      key: 'filedIn',
+      params: { library: 'Novels', time: TIME },
+    })
+  })
+
+  it('falls back to the bare time when a finished request has no library on it', () => {
+    const row = request({ status: 'available' })
+
+    expect(requestOutcome(row, null, formatTime)).toEqual({ kind: 'settled', key: 'filed', params: { time: TIME } })
+  })
+
+  it.each([
+    ['rejected', 'rejected'],
+    ['cancelled', 'cancelled'],
+  ] as const)('reports %s as settled', (status, key) => {
+    expect(requestOutcome(request({ status }), null, formatTime)).toEqual({ kind: 'settled', key, params: { time: TIME } })
+  })
+
+  it.each([
+    ['pending', 'awaitingApproval'],
+    ['needs_review', 'awaitingReview'],
+  ] as const)('reports %s as waiting on a person', (status, key) => {
+    expect(requestOutcome(request({ status }), null, formatTime)).toEqual({ kind: 'waiting', key })
+  })
+
+  it.each([
+    ['approved', 'atStage.release'],
+    ['searching', 'atStage.release'],
+    ['grabbed', 'atStage.downloading'],
+    ['importing', 'atStage.filed'],
+  ] as const)('names the stage %s is sitting on when nothing is transferring', (status, key) => {
+    expect(requestOutcome(request({ status }), null, formatTime)).toEqual({ kind: 'waiting', key })
+  })
+
+  it('does not claim progress for a download that already finished transferring', () => {
+    const row = request({ status: 'importing', download: download('completed') })
+
+    expect(requestOutcome(row, null, formatTime).kind).toBe('waiting')
+  })
+})
diff --git a/client/src/features/book-requests/__tests__/requestPipelineState.spec.ts b/client/src/features/book-requests/__tests__/requestPipelineState.spec.ts
new file mode 100644
index 000000000..7563de332
--- /dev/null
+++ b/client/src/features/book-requests/__tests__/requestPipelineState.spec.ts
@@ -0,0 +1,99 @@
+// @vitest-environment node
+import { describe, expect, it } from 'vitest'
+import { BOOK_REQUEST_STATUSES } from '@bookorbit/types'
+import type { BookRequestDownloadItem, BookRequestItem, BookRequestProgressEvent } from '@bookorbit/types'
+import { REQUEST_PIPELINE_STEPS, requestPipelineState, requestPresentationStatus, requestStepState } from '../requestPipeline'
+
+type PipelineInput = Pick<BookRequestItem, 'status' | 'download'>
+
+const DOWNLOAD = { id: 7 } as BookRequestDownloadItem
+
+function progress(downloadId: number, status: BookRequestProgressEvent['status']): BookRequestProgressEvent {
+  return { requestId: 1, downloadId, status, progressPercent: 100, downloadedBytes: 10, totalBytes: 10 }
+}
+
+function at(status: BookRequestItem['status'], download: BookRequestItem['download'] = null): PipelineInput {
+  return { status, download }
+}
+
+describe('requestPipelineState', () => {
+  it('resolves a stage for every status the server can send', () => {
+    const resolved = BOOK_REQUEST_STATUSES.map((status) => ({ status, state: requestPipelineState(at(status)) }))
+
+    for (const { state } of resolved) {
+      expect(state.currentIndex).toBeGreaterThanOrEqual(0)
+      expect(state.currentIndex).toBeLessThan(REQUEST_PIPELINE_STEPS.length)
+    }
+    expect(resolved).toHaveLength(BOOK_REQUEST_STATUSES.length)
+  })
+
+  it('collapses the two statuses that mean "looking for a release" onto one stage', () => {
+    expect(requestPipelineState(at('approved')).currentIndex).toBe(requestPipelineState(at('searching')).currentIndex)
+  })
+
+  it('collapses the two statuses that mean "the client has it" onto one stage', () => {
+    expect(requestPipelineState(at('grabbed')).currentIndex).toBe(requestPipelineState(at('downloading')).currentIndex)
+  })
+
+  it('separates a failure in transfer from a failure to find anything to transfer', () => {
+    const inTransfer = requestPipelineState(at('failed', DOWNLOAD))
+    const neverFound = requestPipelineState(at('failed'))
+
+    expect(REQUEST_PIPELINE_STEPS[inTransfer.currentIndex]).toBe('downloading')
+    expect(REQUEST_PIPELINE_STEPS[neverFound.currentIndex]).toBe('release')
+    expect(inTransfer.tone).toBe('failed')
+    expect(inTransfer.halted).toBe(true)
+  })
+
+  it('places a cancellation where the request had actually reached', () => {
+    expect(REQUEST_PIPELINE_STEPS[requestPipelineState(at('cancelled')).currentIndex]).toBe('approved')
+    expect(REQUEST_PIPELINE_STEPS[requestPipelineState(at('cancelled', DOWNLOAD)).currentIndex]).toBe('downloading')
+  })
+
+  it('marks a pending request as waiting on someone rather than in progress', () => {
+    expect(requestPipelineState(at('pending')).tone).toBe('waiting')
+    expect(requestPipelineState(at('needs_review')).tone).toBe('waiting')
+    expect(requestPipelineState(at('downloading')).tone).toBe('progress')
+  })
+
+  it('halts only the statuses that never move again', () => {
+    const halted = BOOK_REQUEST_STATUSES.filter((status) => requestPipelineState(at(status)).halted)
+    expect([...halted].sort()).toEqual(['cancelled', 'failed', 'rejected'])
+  })
+
+  it('moves a completed live transfer to filing while the request row catches up', () => {
+    const state = requestPipelineState(at('downloading', { ...DOWNLOAD, status: 'downloading' }), progress(7, 'completed'))
+
+    expect(REQUEST_PIPELINE_STEPS[state.currentIndex]).toBe('filed')
+    expect(state.tone).toBe('progress')
+  })
+
+  it('ignores live progress from an earlier download attempt', () => {
+    const row = at('downloading', { ...DOWNLOAD, status: 'downloading' })
+
+    expect(requestPresentationStatus(row, progress(6, 'completed'))).toBe('downloading')
+  })
+
+  it('does not regress a persisted terminal request with stale live progress', () => {
+    const row = at('available', { ...DOWNLOAD, status: 'imported' })
+
+    expect(requestPresentationStatus(row, progress(7, 'downloading'))).toBe('available')
+  })
+})
+
+describe('requestStepState', () => {
+  it('fills every step once the book is filed', () => {
+    const state = requestPipelineState(at('available'))
+    expect(REQUEST_PIPELINE_STEPS.map((_, index) => requestStepState(state, index))).toEqual(['done', 'done', 'done', 'done', 'done'])
+  })
+
+  it('lights the current step and leaves the rest hollow', () => {
+    const state = requestPipelineState(at('downloading'))
+    expect(REQUEST_PIPELINE_STEPS.map((_, index) => requestStepState(state, index))).toEqual(['done', 'done', 'done', 'current', 'upcoming'])
+  })
+
+  it('lights the step a failure died on rather than the end of the line', () => {
+    const state = requestPipelineState(at('failed'))
+    expect(REQUEST_PIPELINE_STEPS.map((_, index) => requestStepState(state, index))).toEqual(['done', 'done', 'current', 'upcoming', 'upcoming'])
+  })
+})
diff --git a/client/src/features/book-requests/__tests__/sourceColors.spec.ts b/client/src/features/book-requests/__tests__/sourceColors.spec.ts
new file mode 100644
index 000000000..79d2c5c3b
--- /dev/null
+++ b/client/src/features/book-requests/__tests__/sourceColors.spec.ts
@@ -0,0 +1,36 @@
+// @vitest-environment node
+import { describe, expect, it } from 'vitest'
+import { INDEXER_COLORS } from '@bookorbit/types'
+import { isIndexerColor, protocolChipClass, sourceChipClass, sourceDotClass } from '../sourceColors'
+
+describe('sourceColors', () => {
+  it('gives every colour in the palette its own token', () => {
+    const tokens = INDEXER_COLORS.map((color) => sourceChipClass(color))
+
+    expect(new Set(tokens).size).toBe(INDEXER_COLORS.length)
+  })
+
+  /** The state every source starts in, and the one the picker showed before colours existed. */
+  it('leaves an unassigned source neutral', () => {
+    expect(sourceChipClass(null)).toContain('text-muted-foreground')
+    expect(sourceDotClass(null)).not.toContain('--pill-source')
+  })
+
+  /**
+   * A row written by a newer build can name a hue this one has never heard of. Falling through to
+   * neutral keeps that source readable; indexing the map blindly would have produced `undefined`
+   * as a class and a chip with no border at all.
+   */
+  it('falls back to neutral for a colour it does not know', () => {
+    expect(isIndexerColor('chartreuse')).toBe(false)
+    expect(sourceChipClass('chartreuse' as never)).toBe(sourceChipClass(null))
+  })
+
+  it('keeps the two protocol hues out of the palette an operator can assign', () => {
+    const assignable = INDEXER_COLORS.map((color) => sourceChipClass(color)).join(' ')
+
+    expect(assignable).not.toContain('--pill-torrent')
+    expect(assignable).not.toContain('--pill-direct')
+    expect(protocolChipClass(true)).not.toBe(protocolChipClass(false))
+  })
+})
diff --git a/client/src/features/book-requests/__tests__/useBookRequestDetail.spec.ts b/client/src/features/book-requests/__tests__/useBookRequestDetail.spec.ts
new file mode 100644
index 000000000..0396a8b20
--- /dev/null
+++ b/client/src/features/book-requests/__tests__/useBookRequestDetail.spec.ts
@@ -0,0 +1,106 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { BookRequestItem } from '@bookorbit/types'
+
+const { apiMock } = vi.hoisted(() => ({ apiMock: vi.fn<(url: string) => Promise<Response>>() }))
+
+vi.mock('@/lib/api', () => ({ api: apiMock }))
+
+import { useBookRequestDetail } from '../composables/useBookRequestDetail'
+
+function request(title: string): BookRequestItem {
+  return { id: 7, title } as BookRequestItem
+}
+
+function deferredResponse() {
+  let resolve!: (response: Response) => void
+  const promise = new Promise<Response>((settle) => {
+    resolve = settle
+  })
+  return { promise, resolve }
+}
+
+function response(body: BookRequestItem, ok = true): Response {
+  return { ok, status: ok ? 200 : 500, json: vi.fn<() => Promise<BookRequestItem>>().mockResolvedValue(body) } as unknown as Response
+}
+
+describe('useBookRequestDetail', () => {
+  it('keeps an existing request mounted during a background refresh', async () => {
+    const pending = deferredResponse()
+    apiMock.mockReturnValueOnce(pending.promise)
+    const detail = useBookRequestDetail()
+    detail.setRequest(request('Before'))
+
+    const refresh = detail.fetchRequest(7, { background: true })
+
+    expect(detail.loading.value).toBe(false)
+    expect(detail.request.value?.title).toBe('Before')
+
+    pending.resolve(response(request('After')))
+    await refresh
+
+    expect(detail.request.value?.title).toBe('After')
+    expect(detail.error.value).toBeNull()
+  })
+
+  it('uses the blocking loading state when navigating to a different request', async () => {
+    const pending = deferredResponse()
+    apiMock.mockReturnValueOnce(pending.promise)
+    const detail = useBookRequestDetail()
+    detail.setRequest(request('Request seven'))
+
+    const refresh = detail.fetchRequest(8, { background: true })
+
+    expect(detail.loading.value).toBe(true)
+
+    pending.resolve(response({ ...request('Request eight'), id: 8 }))
+    await refresh
+
+    expect(detail.loading.value).toBe(false)
+    expect(detail.request.value?.id).toBe(8)
+  })
+
+  /**
+   * The drawer is a function of the URL, and stepping through the queue asks for the next request
+   * before the answer about the previous one has arrived.
+   */
+  it('does not answer the request now open with the one open a moment ago', async () => {
+    const older = deferredResponse()
+    apiMock.mockReturnValueOnce(older.promise)
+    apiMock.mockResolvedValueOnce(response({ ...request('Request eight'), id: 8 }))
+    const detail = useBookRequestDetail()
+
+    const stale = detail.fetchRequest(7)
+    await detail.fetchRequest(8)
+    older.resolve(response(request('Request seven')))
+    await stale
+
+    expect(detail.request.value?.id).toBe(8)
+    expect(detail.loading.value).toBe(false)
+  })
+
+  /** An action answers with the row it wrote, which is newer than any refresh already in flight. */
+  it('does not let a refresh already in flight undo what an action just wrote', async () => {
+    const older = deferredResponse()
+    apiMock.mockReturnValueOnce(older.promise)
+    const detail = useBookRequestDetail()
+    detail.setRequest(request('Before'))
+
+    const refresh = detail.fetchRequest(7, { background: true })
+    detail.setRequest(request('Approved'))
+    older.resolve(response(request('Before')))
+    await refresh
+
+    expect(detail.request.value?.title).toBe('Approved')
+  })
+
+  it('preserves the displayed request when a background refresh fails transiently', async () => {
+    apiMock.mockResolvedValueOnce(response(request('Unused'), false))
+    const detail = useBookRequestDetail()
+    detail.setRequest(request('Still visible'))
+
+    await detail.fetchRequest(7, { background: true })
+
+    expect(detail.request.value?.title).toBe('Still visible')
+    expect(detail.error.value).toBeNull()
+  })
+})
diff --git a/client/src/features/book-requests/__tests__/useBookRequestProgress.spec.ts b/client/src/features/book-requests/__tests__/useBookRequestProgress.spec.ts
new file mode 100644
index 000000000..fc2a962b7
--- /dev/null
+++ b/client/src/features/book-requests/__tests__/useBookRequestProgress.spec.ts
@@ -0,0 +1,212 @@
+import { mount } from '@vue/test-utils'
+import { computed, defineComponent, nextTick, watchEffect } from 'vue'
+import { describe, expect, it, vi } from 'vitest'
+import type { BookRequestDownloadStatus, BookRequestItem, BookRequestProgressEvent } from '@bookorbit/types'
+
+const { socketHandlers, socketMock } = vi.hoisted(() => {
+  const socketHandlers = new Map<string, (payload: never) => void>()
+  const socketMock = {
+    on: vi.fn<(event: string, handler: (payload: never) => void) => void>((event, handler) => {
+      socketHandlers.set(event, handler)
+    }),
+    disconnect: vi.fn<() => void>(),
+  }
+  return { socketHandlers, socketMock }
+})
+
+vi.mock('@/lib/socket', () => ({ createAuthenticatedSocket: vi.fn<() => typeof socketMock>(() => socketMock) }))
+
+import { useBookRequestProgress } from '../composables/useBookRequestProgress'
+
+function progress(requestId: number): BookRequestProgressEvent {
+  return {
+    requestId,
+    downloadId: requestId * 10,
+    status: 'downloading',
+    progressPercent: 25,
+    downloadedBytes: 25,
+    totalBytes: 100,
+  }
+}
+
+function settledRow(requestId: number, status: BookRequestDownloadStatus, downloadId = requestId * 10): Pick<BookRequestItem, 'id' | 'download'> {
+  return { id: requestId, download: { id: downloadId, status } as BookRequestItem['download'] }
+}
+
+/** Mounts a component that hands the composable straight back, so a test can drive it directly. */
+function mountProgress() {
+  let api!: ReturnType<typeof useBookRequestProgress>
+  const wrapper = mount(
+    defineComponent({
+      setup() {
+        api = useBookRequestProgress()
+        return {}
+      },
+      template: '<div />',
+    }),
+  )
+  return { api, wrapper }
+}
+
+describe('useBookRequestProgress', () => {
+  it('does not invalidate a request-specific consumer for another request tick', async () => {
+    let renders = 0
+    const wrapper = mount(
+      defineComponent({
+        setup() {
+          const { progressByRequest } = useBookRequestProgress()
+          const current = computed(() => progressByRequest.value[7])
+          watchEffect(() => {
+            void current.value
+            renders++
+          })
+          return {}
+        },
+        template: '<div />',
+      }),
+    )
+
+    expect(renders).toBe(1)
+
+    socketHandlers.get('book-requests:progress')?.(progress(8) as never)
+    await nextTick()
+    expect(renders).toBe(1)
+
+    socketHandlers.get('book-requests:progress')?.(progress(7) as never)
+    await nextTick()
+    expect(renders).toBe(2)
+
+    wrapper.unmount()
+  })
+
+  it('drops a tick once the fetched row shows the same attempt has settled', async () => {
+    const { api, wrapper } = mountProgress()
+
+    socketHandlers.get('book-requests:progress')?.(progress(7) as never)
+    await nextTick()
+    expect(api.progressByRequest.value[7]).toBeDefined()
+
+    api.pruneSettledProgress([settledRow(7, 'imported')])
+    expect(api.progressByRequest.value[7]).toBeUndefined()
+
+    wrapper.unmount()
+  })
+
+  /** A fetch that started before a fresh grab describes the previous attempt, not the live one. */
+  it('keeps a tick that belongs to a newer attempt than the fetched row', async () => {
+    const { api, wrapper } = mountProgress()
+
+    socketHandlers.get('book-requests:progress')?.(progress(7) as never)
+    await nextTick()
+
+    api.pruneSettledProgress([settledRow(7, 'failed', 999)])
+    expect(api.progressByRequest.value[7]).toBeDefined()
+
+    api.pruneSettledProgress([settledRow(7, 'downloading')])
+    expect(api.progressByRequest.value[7]).toBeDefined()
+
+    wrapper.unmount()
+  })
+
+  it('forgets a request the moment a terminal tick arrives for it', async () => {
+    const { api, wrapper } = mountProgress()
+
+    socketHandlers.get('book-requests:progress')?.(progress(7) as never)
+    await nextTick()
+
+    socketHandlers.get('book-requests:progress')?.({ ...progress(7), status: 'failed' } as never)
+    await nextTick()
+    expect(api.progressByRequest.value[7]).toBeUndefined()
+
+    wrapper.unmount()
+  })
+
+  /**
+   * The server replays nothing, so every event that landed while the socket was down is gone. A
+   * laptop that slept or a server restarted mid-transfer leaves rows reading "downloading 97%"
+   * until somebody changes a filter or reloads, which for an approver with a pinned tab is the
+   * ordinary case rather than an edge one.
+   */
+  describe('after a dropped connection', () => {
+    function mountListener() {
+      const listener = vi.fn<() => void>()
+      const wrapper = mount(
+        defineComponent({
+          setup() {
+            useBookRequestProgress().onRequestsChanged(listener)
+            return {}
+          },
+          template: '<div />',
+        }),
+      )
+      return { listener, wrapper }
+    }
+
+    it('refetches when the socket comes back', () => {
+      const { listener, wrapper } = mountListener()
+
+      socketHandlers.get('disconnect')?.(undefined as never)
+      socketHandlers.get('connect')?.(undefined as never)
+
+      expect(listener).toHaveBeenCalledTimes(1)
+
+      wrapper.unmount()
+    })
+
+    /** Every page fetches on mount, so answering the first connect would only fetch everything twice. */
+    it('does not refetch on the first connect', () => {
+      const { listener, wrapper } = mountListener()
+
+      socketHandlers.get('connect')?.(undefined as never)
+
+      expect(listener).not.toHaveBeenCalled()
+
+      wrapper.unmount()
+    })
+
+    it('refetches once per drop rather than once per connect event', () => {
+      const { listener, wrapper } = mountListener()
+
+      socketHandlers.get('disconnect')?.(undefined as never)
+      socketHandlers.get('connect')?.(undefined as never)
+      socketHandlers.get('connect')?.(undefined as never)
+
+      expect(listener).toHaveBeenCalledTimes(1)
+
+      wrapper.unmount()
+    })
+
+    it('refetches when the first connection succeeds after an earlier attempt failed', () => {
+      const { listener, wrapper } = mountListener()
+
+      socketHandlers.get('connect_error')?.(new Error('server unavailable') as never)
+      socketHandlers.get('connect')?.(undefined as never)
+
+      expect(listener).toHaveBeenCalledTimes(1)
+
+      wrapper.unmount()
+    })
+  })
+
+  it('stops calling a change listener once its scope is gone', () => {
+    const listener = vi.fn<() => void>()
+    let api!: ReturnType<typeof useBookRequestProgress>
+    const wrapper = mount(
+      defineComponent({
+        setup() {
+          api = useBookRequestProgress()
+          api.onRequestsChanged(listener)
+          return {}
+        },
+        template: '<div />',
+      }),
+    )
+
+    socketHandlers.get('book-requests:changed')?.(undefined as never)
+    expect(listener).toHaveBeenCalledTimes(1)
+
+    wrapper.unmount()
+    socketHandlers.get('book-requests:changed')?.(undefined as never)
+    expect(listener).toHaveBeenCalledTimes(1)
+  })
+})
diff --git a/client/src/features/book-requests/__tests__/useBookRequestSummary.spec.ts b/client/src/features/book-requests/__tests__/useBookRequestSummary.spec.ts
new file mode 100644
index 000000000..30bbedf79
--- /dev/null
+++ b/client/src/features/book-requests/__tests__/useBookRequestSummary.spec.ts
@@ -0,0 +1,65 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { BookRequestSummary } from '@bookorbit/types'
+
+const apiMock = vi.hoisted(() => vi.fn<(input: RequestInfo | URL, init?: RequestInit) => Promise<Response>>())
+
+vi.mock('@/lib/api', () => ({ api: apiMock }))
+
+const SUMMARY: BookRequestSummary = { pending: 2, active: 5, mine: 3, mineTotal: 1234, allTotal: 12000 }
+
+function response(data?: unknown, ok = true): Response {
+  return { ok, json: async () => data } as Response
+}
+
+async function loadComposable() {
+  return import('../composables/useBookRequestSummary')
+}
+
+describe('useBookRequestSummary', () => {
+  beforeEach(() => {
+    vi.resetModules()
+    apiMock.mockReset()
+  })
+
+  it('fetches the shared summary once', async () => {
+    apiMock.mockResolvedValue(response(SUMMARY))
+    const { useBookRequestSummary } = await loadComposable()
+    const { summary, fetchSummary } = useBookRequestSummary()
+
+    await fetchSummary()
+    await fetchSummary()
+
+    expect(summary.value).toEqual(SUMMARY)
+    expect(apiMock).toHaveBeenCalledExactlyOnceWith('/api/v1/book-requests/summary')
+  })
+
+  it('refreshes the summary after a request changes', async () => {
+    apiMock.mockResolvedValueOnce(response(SUMMARY)).mockResolvedValueOnce(response({ ...SUMMARY, active: 4 }))
+    const { useBookRequestSummary } = await loadComposable()
+    const { summary, fetchSummary, refreshSummary } = useBookRequestSummary()
+
+    await fetchSummary()
+    await refreshSummary()
+
+    expect(summary.value?.active).toBe(4)
+    expect(apiMock).toHaveBeenCalledTimes(2)
+  })
+
+  it('drops a response that lands after the session resets', async () => {
+    const { resetBookRequestSummary, useBookRequestSummary } = await loadComposable()
+    const { summary, fetchSummary } = useBookRequestSummary()
+    let resolveResponse: ((res: Response) => void) | undefined
+    apiMock.mockReturnValueOnce(
+      new Promise<Response>((resolve) => {
+        resolveResponse = resolve
+      }),
+    )
+
+    const pending = fetchSummary()
+    resetBookRequestSummary()
+    resolveResponse?.(response(SUMMARY))
+    await pending
+
+    expect(summary.value).toBeNull()
+  })
+})
diff --git a/client/src/features/book-requests/__tests__/useBookRequests.spec.ts b/client/src/features/book-requests/__tests__/useBookRequests.spec.ts
new file mode 100644
index 000000000..3272298bf
--- /dev/null
+++ b/client/src/features/book-requests/__tests__/useBookRequests.spec.ts
@@ -0,0 +1,232 @@
+// @vitest-environment node
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const apiMock = vi.hoisted(() => vi.fn<(...args: [RequestInfo | URL, RequestInit?]) => Promise<unknown>>())
+
+vi.mock('@/lib/api', () => ({ api: apiMock }))
+
+function response(body: unknown, ok = true): Pick<Response, 'json' | 'ok'> {
+  return {
+    ok,
+    json: vi.fn<() => Promise<unknown>>().mockResolvedValue(body),
+  }
+}
+
+async function freshRequests(scope: 'mine' | 'all') {
+  vi.resetModules()
+  const { useBookRequests } = await import('../composables/useBookRequests')
+  return useBookRequests(scope)
+}
+
+describe('useBookRequests filters', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('sends requester, media kind, and every selected status to the paginated endpoint', async () => {
+    apiMock.mockResolvedValue(response({ items: [], total: 0 }))
+    const requests = await freshRequests('all')
+    requests.requesterUserId.value = 42
+    requests.mediaKind.value = 'audiobook'
+    requests.status.value = 'needs_review'
+
+    await requests.fetchRequests()
+
+    const url = String(apiMock.mock.calls[0]?.[0])
+    const params = new URLSearchParams(url.split('?')[1])
+    expect(params.get('requesterUserId')).toBe('42')
+    expect(params.get('mediaKind')).toBe('audiobook')
+    expect(params.get('status')).toBe('needs_review')
+  })
+
+  it('loads requester options once for the all-requests scope', async () => {
+    const options = [{ userId: 42, username: 'reader', name: 'Reader' }]
+    apiMock.mockResolvedValue(response(options))
+    const requests = await freshRequests('all')
+
+    await requests.fetchRequesterOptions()
+    await requests.fetchRequesterOptions()
+
+    expect(apiMock).toHaveBeenCalledExactlyOnceWith('/api/v1/admin/book-requests/requesters')
+    expect(requests.requesterOptions.value).toEqual(options)
+  })
+
+  it('does not load requester options for the caller-scoped list', async () => {
+    const requests = await freshRequests('mine')
+
+    await requests.fetchRequesterOptions()
+
+    expect(apiMock).not.toHaveBeenCalled()
+  })
+})
+
+/**
+ * Filters, sorts, pages and every change broadcast all ask the same endpoint again, so several
+ * answers are routinely in flight at once and they do not come back in the order they were asked.
+ */
+describe('useBookRequests out-of-order answers', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  /** Resolved by hand, so a test can decide which answer arrives second. */
+  function deferredResponse(body: unknown, ok = true) {
+    let release: () => void = () => {}
+    const pending = new Promise((resolve) => {
+      release = () => resolve(response(body, ok))
+    })
+    return { pending, release: () => release() }
+  }
+
+  it('does not let a slow answer to an older filter overwrite a newer one', async () => {
+    const requests = await freshRequests('mine')
+    const stale = deferredResponse({ items: [{ id: 1 }], total: 1 })
+    apiMock.mockImplementationOnce(() => stale.pending)
+    apiMock.mockImplementationOnce(() => Promise.resolve(response({ items: [{ id: 2 }], total: 1 })))
+
+    const older = requests.fetchRequests()
+    requests.status.value = 'pending'
+    await requests.applyFilters()
+    stale.release()
+    await older
+
+    expect(requests.items.value).toEqual([{ id: 2 }])
+    expect(requests.total.value).toBe(1)
+  })
+
+  it('leaves the spinner to whichever fetch is newest', async () => {
+    const requests = await freshRequests('mine')
+    const older = deferredResponse({ items: [], total: 0 })
+    const newer = deferredResponse({ items: [], total: 0 })
+    apiMock.mockImplementationOnce(() => older.pending)
+    apiMock.mockImplementationOnce(() => newer.pending)
+
+    const first = requests.fetchRequests()
+    const second = requests.fetchRequests()
+    older.release()
+    await first
+
+    expect(requests.loading.value).toBe(true)
+
+    newer.release()
+    await second
+    expect(requests.loading.value).toBe(false)
+  })
+
+  /** A page that has just loaded fine must not turn into an error because an older ask failed. */
+  it('does not report a stale failure over a newer success', async () => {
+    const requests = await freshRequests('mine')
+    const older = deferredResponse(null, false)
+    apiMock.mockImplementationOnce(() => older.pending)
+    apiMock.mockImplementationOnce(() => Promise.resolve(response({ items: [{ id: 2 }], total: 1 })))
+
+    const first = requests.fetchRequests()
+    await requests.fetchRequests()
+    older.release()
+    await first
+
+    expect(requests.error.value).toBeNull()
+    expect(requests.items.value).toEqual([{ id: 2 }])
+  })
+})
+
+/**
+ * Two rows are acted on at once whenever the queue is being worked through, and every piece of
+ * feedback used to be shared: one `pendingId`, one `lastReason`, one `lastErrorCode`.
+ */
+describe('useBookRequestActions with more than one row in flight', () => {
+  async function freshActions(canManage = true) {
+    vi.resetModules()
+    const { useBookRequestActions } = await import('../composables/useBookRequests')
+    return useBookRequestActions(() => canManage)
+  }
+
+  function deferred(body: unknown, ok = true) {
+    let release: () => void = () => {}
+    const pending = new Promise((resolve) => {
+      release = () => resolve(response(body, ok))
+    })
+    return { pending, release: () => release() }
+  }
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('keeps a row busy while its own action is in flight', async () => {
+    const actions = await freshActions()
+    const slow = deferred({ id: 1 })
+    apiMock.mockImplementationOnce(() => slow.pending)
+
+    const running = actions.cancel(1)
+    expect(actions.isPending(1)).toBe(true)
+    expect(actions.isPending(2)).toBe(false)
+
+    slow.release()
+    await running
+    expect(actions.isPending(1)).toBe(false)
+  })
+
+  it('cancels only the named download through the requester-scoped route', async () => {
+    const actions = await freshActions()
+    apiMock.mockResolvedValue(response({ id: 1, status: 'approved' }))
+
+    await actions.cancelDownload(1, 11)
+
+    expect(apiMock).toHaveBeenCalledExactlyOnceWith('/api/v1/book-requests/1/downloads/11/cancel', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: '{}',
+    })
+  })
+
+  /**
+   * The single id described only the last action started, so finishing row B re-enabled row A's
+   * buttons while A's own call was still running.
+   */
+  it('does not un-busy the first row when a second row finishes first', async () => {
+    const actions = await freshActions()
+    const slow = deferred({ id: 1 })
+    apiMock.mockImplementationOnce(() => slow.pending)
+    apiMock.mockImplementationOnce(() => Promise.resolve(response({ id: 2 })))
+
+    const first = actions.cancel(1)
+    await actions.cancel(2)
+
+    expect(actions.isPending(1)).toBe(true)
+    slow.release()
+    await first
+    expect(actions.isPending(1)).toBe(false)
+  })
+
+  /** One row's refusal must not reach the other row's toast. */
+  it('returns each refusal to the call it belongs to', async () => {
+    const actions = await freshActions()
+    const slow = deferred({ message: 'the tracker refused this release' }, false)
+    apiMock.mockImplementationOnce(() => slow.pending)
+    apiMock.mockImplementationOnce(() => Promise.resolve(response({ message: 'that request is already cancelled' }, false)))
+
+    const first = actions.cancel(1)
+    const second = await actions.cancel(2)
+    slow.release()
+
+    expect((await first).reason).toBe('the tracker refused this release')
+    expect(second.reason).toBe('that request is already cancelled')
+  })
+
+  it('carries the grab failure code back with the grab it classified', async () => {
+    const actions = await freshActions()
+    apiMock.mockResolvedValue(response({ message: 'the tracker answered 406', errorCode: 'GRAB_SOURCE_REFUSED' }, false))
+
+    const outcome = await actions.grab(1, { indexerId: 9, releaseGuid: 'g1' })
+
+    expect(outcome).toMatchObject({ item: null, errorCode: 'GRAB_SOURCE_REFUSED', reason: 'the tracker answered 406' })
+  })
+
+  it('reports a deletion refusal on the call rather than on the composable', async () => {
+    const actions = await freshActions()
+    apiMock.mockResolvedValue(response({ message: 'remove the download from its client first' }, false))
+
+    await expect(actions.remove(1)).resolves.toEqual({ ok: false, reason: 'remove the download from its client first' })
+  })
+})
diff --git a/client/src/features/book-requests/__tests__/useCandidateGroups.spec.ts b/client/src/features/book-requests/__tests__/useCandidateGroups.spec.ts
new file mode 100644
index 000000000..132b9ae1f
--- /dev/null
+++ b/client/src/features/book-requests/__tests__/useCandidateGroups.spec.ts
@@ -0,0 +1,259 @@
+// @vitest-environment node
+import { describe, expect, it } from 'vitest'
+import { ref } from 'vue'
+import { MetadataProviderKey, type BookRequestAvailability, type BookRequestMediaKind, type MetadataCandidate } from '@bookorbit/types'
+
+import { useCandidateGroups } from '../composables/useCandidateGroups'
+
+function candidate(overrides: Partial<MetadataCandidate> & Pick<MetadataCandidate, 'provider' | 'providerId'>): MetadataCandidate {
+  return { title: 'Dune', authors: ['Frank Herbert'], ...overrides } as MetadataCandidate
+}
+
+function groupsFor(
+  results: MetadataCandidate[],
+  availability: Record<string, BookRequestAvailability> = {},
+  kind: BookRequestMediaKind = 'ebook',
+  coverProviderOrder: MetadataProviderKey[] = [],
+  requestedLanguage: string | null = null,
+  resultProviderOrder: MetadataProviderKey[] = [],
+) {
+  const { groups } = useCandidateGroups(
+    ref(results),
+    ref(kind),
+    (item) => availability[`${item.provider}:${item.providerId}`] ?? null,
+    ref(coverProviderOrder),
+    ref(requestedLanguage),
+    ref(resultProviderOrder),
+  )
+  return groups.value
+}
+
+describe('useCandidateGroups', () => {
+  it('collapses the same work carried by several providers into one row', () => {
+    const groups = groupsFor([
+      candidate({ provider: MetadataProviderKey.GOODREADS, providerId: 'gr1', publishedYear: 1975 }),
+      candidate({ provider: MetadataProviderKey.AMAZON, providerId: 'az1' }),
+      candidate({ provider: MetadataProviderKey.OPEN_LIBRARY, providerId: 'ol1', publishedYear: 1965 }),
+    ])
+
+    expect(groups).toHaveLength(1)
+    expect(groups[0]!.providers).toEqual([MetadataProviderKey.GOODREADS, MetadataProviderKey.AMAZON, MetadataProviderKey.OPEN_LIBRARY])
+  })
+
+  it('separates works that share a title but not an author', () => {
+    const groups = groupsFor([
+      candidate({ provider: MetadataProviderKey.GOODREADS, providerId: 'gr1' }),
+      candidate({ provider: MetadataProviderKey.AMAZON, providerId: 'az1', authors: ['Brian Herbert', 'Kevin J. Anderson'] }),
+    ])
+
+    expect(groups).toHaveLength(2)
+  })
+
+  it('ignores punctuation, case, and accents the way the server dedupe does', () => {
+    const groups = groupsFor([
+      candidate({ provider: MetadataProviderKey.GOODREADS, providerId: 'gr1', title: 'Les Misérables', authors: ['Victor Hugo'] }),
+      candidate({ provider: MetadataProviderKey.AMAZON, providerId: 'az1', title: 'les miserables!', authors: ['victor hugo'] }),
+    ])
+
+    expect(groups).toHaveLength(1)
+  })
+
+  it('requests the most complete record in the group rather than the first one seen', () => {
+    const complete = candidate({ provider: MetadataProviderKey.AMAZON, providerId: 'az1', coverUrl: 'cover.jpg', isbn13: '9780441013593' })
+    const groups = groupsFor([candidate({ provider: MetadataProviderKey.GOODREADS, providerId: 'gr1' }), complete])
+
+    expect(groups[0]!.candidate.providerId).toBe('az1')
+    expect(groups[0]!.coverUrl).toBe('cover.jpg')
+  })
+
+  it('folds equivalent ISBN-10 and ISBN-13 values into one work identifier', () => {
+    const groups = groupsFor([
+      candidate({ provider: MetadataProviderKey.GOODREADS, providerId: 'gr1', isbn10: '0441013597' }),
+      candidate({ provider: MetadataProviderKey.GOOGLE, providerId: 'g1', isbn13: '9780441013593' }),
+    ])
+
+    expect(groups[0]!.isbns).toEqual(['9780441013593'])
+    expect(groups[0]!.candidates).toHaveLength(2)
+  })
+
+  it('retains conflicting provider ISBNs instead of silently choosing one', () => {
+    const groups = groupsFor([
+      candidate({ provider: MetadataProviderKey.GOODREADS, providerId: 'gr1', isbn13: '9780441013593' }),
+      candidate({ provider: MetadataProviderKey.GOOGLE, providerId: 'g1', isbn13: '9781250301697' }),
+    ])
+
+    expect(groups[0]!.isbns).toEqual(['9780441013593', '9781250301697'])
+  })
+
+  it('prefers the requested language before provider agreement', () => {
+    const groups = groupsFor(
+      [
+        candidate({ provider: MetadataProviderKey.GOOGLE, providerId: 'english', isbn13: '9781250827999', language: 'en' }),
+        candidate({ provider: MetadataProviderKey.GOODREADS, providerId: 'german-1', isbn13: '9781761620003', language: 'de' }),
+        candidate({ provider: MetadataProviderKey.AMAZON, providerId: 'german-2', isbn13: '9781761620003', language: 'German' }),
+      ],
+      {},
+      'ebook',
+      [],
+      'English',
+      [MetadataProviderKey.GOODREADS, MetadataProviderKey.AMAZON, MetadataProviderKey.GOOGLE],
+    )
+
+    expect(groups[0]!.recommendedIsbnChoice?.isbn).toBe('9781250827999')
+  })
+
+  it('prefers an unknown language over a known mismatch', () => {
+    const groups = groupsFor(
+      [
+        candidate({ provider: MetadataProviderKey.GOOGLE, providerId: 'unknown', isbn13: '9781250827999' }),
+        candidate({ provider: MetadataProviderKey.GOODREADS, providerId: 'german', isbn13: '9781761620003', language: 'de' }),
+      ],
+      {},
+      'ebook',
+      [],
+      'en',
+      [MetadataProviderKey.GOODREADS, MetadataProviderKey.GOOGLE],
+    )
+
+    expect(groups[0]!.recommendedIsbnChoice?.isbn).toBe('9781250827999')
+  })
+
+  it('prefers an ISBN confirmed by more independent providers', () => {
+    const groups = groupsFor(
+      [
+        candidate({ provider: MetadataProviderKey.GOOGLE, providerId: 'single', isbn13: '9781250827999', language: 'en' }),
+        candidate({ provider: MetadataProviderKey.GOODREADS, providerId: 'agreed-1', isbn13: '9781761620003', language: 'en' }),
+        candidate({ provider: MetadataProviderKey.AMAZON, providerId: 'agreed-2', isbn13: '9781761620003', language: 'en' }),
+      ],
+      {},
+      'ebook',
+      [],
+      'en',
+      [MetadataProviderKey.GOOGLE, MetadataProviderKey.GOODREADS, MetadataProviderKey.AMAZON],
+    )
+
+    expect(groups[0]!.recommendedIsbnChoice).toMatchObject({ isbn: '9781761620003', agreementCount: 2 })
+  })
+
+  it('uses stable provider priority regardless of provider arrival order', () => {
+    const google = candidate({ provider: MetadataProviderKey.GOOGLE, providerId: 'google', isbn13: '9781250827999', language: 'en' })
+    const goodreads = candidate({ provider: MetadataProviderKey.GOODREADS, providerId: 'goodreads', isbn13: '9781761620003', language: 'en' })
+    const providerOrder = [MetadataProviderKey.GOOGLE, MetadataProviderKey.GOODREADS]
+
+    const googleFirst = groupsFor([google, goodreads], {}, 'ebook', [], 'en', providerOrder)
+    const goodreadsFirst = groupsFor([goodreads, google], {}, 'ebook', [], 'en', providerOrder)
+
+    expect(googleFirst[0]!.recommendedIsbnChoice?.isbn).toBe('9781250827999')
+    expect(goodreadsFirst[0]!.recommendedIsbnChoice?.isbn).toBe('9781250827999')
+  })
+
+  it("uses a provider's own result position when earlier evidence ties", () => {
+    const groups = groupsFor(
+      [
+        candidate({ provider: MetadataProviderKey.GOOGLE, providerId: 'rank-1', isbn13: '9781250827999', language: 'en' }),
+        candidate({ provider: MetadataProviderKey.GOOGLE, providerId: 'rank-2', isbn13: '9781761620003', language: 'en' }),
+      ],
+      {},
+      'ebook',
+      [],
+      'en',
+      [MetadataProviderKey.GOOGLE],
+    )
+
+    expect(groups[0]!.recommendedIsbnChoice).toMatchObject({ isbn: '9781250827999', providerResultRank: 0 })
+  })
+
+  it('uses edition year and then ISBN as stable final tie-breakers', () => {
+    const yearWinner = groupsFor([
+      candidate({ provider: MetadataProviderKey.GOOGLE, providerId: 'newer', isbn13: '9781761620003', language: 'en', publishedYear: 2026 }),
+      candidate({ provider: MetadataProviderKey.GOODREADS, providerId: 'original', isbn13: '9781250827999', language: 'en', publishedYear: 2025 }),
+    ])
+    const isbnWinner = groupsFor([
+      candidate({ provider: MetadataProviderKey.GOOGLE, providerId: 'larger', isbn13: '9781761620003', language: 'en', publishedYear: 2025 }),
+      candidate({ provider: MetadataProviderKey.GOODREADS, providerId: 'smaller', isbn13: '9781250827999', language: 'en', publishedYear: 2025 }),
+    ])
+
+    expect(yearWinner[0]!.recommendedIsbnChoice?.isbn).toBe('9781250827999')
+    expect(isbnWinner[0]!.recommendedIsbnChoice?.isbn).toBe('9781250827999')
+  })
+
+  it('uses the configured cover order without changing the selected metadata record', () => {
+    const amazon = candidate({ provider: MetadataProviderKey.AMAZON, providerId: 'az1', coverUrl: 'amazon.jpg' })
+    const google = candidate({
+      provider: MetadataProviderKey.GOOGLE,
+      providerId: 'g1',
+      coverUrl: 'google.jpg',
+      isbn13: '9780441013593',
+      publishedYear: 1965,
+    })
+    const groups = groupsFor([google, amazon], {}, 'ebook', [MetadataProviderKey.AMAZON, MetadataProviderKey.GOOGLE])
+
+    expect(groups[0]!.candidate.providerId).toBe('g1')
+    expect(groups[0]!.coverUrl).toBe('amazon.jpg')
+    expect(groups[0]!.coverUrls).toEqual(['amazon.jpg', 'google.jpg'])
+  })
+
+  it('deduplicates fallback cover urls while preserving provider priority', () => {
+    const groups = groupsFor(
+      [
+        candidate({ provider: MetadataProviderKey.GOOGLE, providerId: 'g1', coverUrl: 'shared.jpg' }),
+        candidate({ provider: MetadataProviderKey.AMAZON, providerId: 'az1', coverUrl: 'shared.jpg' }),
+        candidate({ provider: MetadataProviderKey.OPEN_LIBRARY, providerId: 'ol1', coverUrl: 'open-library.jpg' }),
+      ],
+      {},
+      'ebook',
+      [MetadataProviderKey.AMAZON, MetadataProviderKey.GOOGLE, MetadataProviderKey.OPEN_LIBRARY],
+    )
+
+    expect(groups[0]!.coverUrls).toEqual(['shared.jpg', 'open-library.jpg'])
+  })
+
+  it('dates the work by its earliest edition', () => {
+    const groups = groupsFor([
+      candidate({ provider: MetadataProviderKey.GOODREADS, providerId: 'gr1', publishedYear: 2005 }),
+      candidate({ provider: MetadataProviderKey.AMAZON, providerId: 'az1', publishedYear: 1965 }),
+      candidate({ provider: MetadataProviderKey.OPEN_LIBRARY, providerId: 'ol1' }),
+    ])
+
+    expect(groups[0]!.publishedYear).toBe(1965)
+  })
+
+  it('carries a claim found on one record across the whole group', () => {
+    const groups = groupsFor(
+      [
+        candidate({ provider: MetadataProviderKey.GOODREADS, providerId: 'gr1' }),
+        candidate({ provider: MetadataProviderKey.AMAZON, providerId: 'az1' }),
+      ],
+      { 'amazon:az1': { ownedBookId: null, existingRequestId: 12, existingRequestStatus: 'pending', alreadySubscribed: true } },
+    )
+
+    expect(groups[0]!.availability).toEqual({
+      ownedBookId: null,
+      existingRequestId: 12,
+      existingRequestStatus: 'pending',
+      alreadySubscribed: true,
+    })
+  })
+
+  it('leaves availability unknown until some record in the group has been answered for', () => {
+    const groups = groupsFor([candidate({ provider: MetadataProviderKey.GOODREADS, providerId: 'gr1' })])
+
+    expect(groups[0]!.availability).toBeNull()
+  })
+
+  it('drops a record with no title, which would otherwise render as a blank row', () => {
+    const groups = groupsFor([
+      candidate({ provider: MetadataProviderKey.GOODREADS, providerId: 'gr1', title: undefined }),
+      candidate({ provider: MetadataProviderKey.AMAZON, providerId: 'az1' }),
+    ])
+
+    expect(groups).toHaveLength(1)
+    expect(groups[0]!.providers).toEqual([MetadataProviderKey.AMAZON])
+  })
+
+  it('keeps the same work apart across media, since a request is per medium', () => {
+    const results = [candidate({ provider: MetadataProviderKey.GOODREADS, providerId: 'gr1' })]
+
+    expect(groupsFor(results, {}, 'ebook')[0]!.key).not.toBe(groupsFor(results, {}, 'audiobook')[0]!.key)
+  })
+})
diff --git a/client/src/features/book-requests/__tests__/useCoalescedRefresh.spec.ts b/client/src/features/book-requests/__tests__/useCoalescedRefresh.spec.ts
new file mode 100644
index 000000000..94b109815
--- /dev/null
+++ b/client/src/features/book-requests/__tests__/useCoalescedRefresh.spec.ts
@@ -0,0 +1,87 @@
+// @vitest-environment node
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { effectScope } from 'vue'
+
+import { useCoalescedRefresh } from '../composables/useCoalescedRefresh'
+
+/**
+ * The server emits a change event per transition from eleven places, and every connected page
+ * answers each one with a list fetch and a summary whose five counts include two subqueries. A
+ * request moving from approved through to available is several transitions in a couple of seconds.
+ */
+describe('useCoalescedRefresh', () => {
+  const WINDOW_MS = 400
+
+  beforeEach(() => {
+    vi.useFakeTimers()
+  })
+
+  afterEach(() => {
+    vi.useRealTimers()
+  })
+
+  function coalesced(refresh: () => void) {
+    const scope = effectScope()
+    const trigger = scope.run(() => useCoalescedRefresh(refresh, WINDOW_MS))!
+    return { trigger, scope }
+  }
+
+  it('answers a burst of broadcasts once', async () => {
+    const refresh = vi.fn<() => void>()
+    const { trigger } = coalesced(refresh)
+
+    for (let i = 0; i < 20; i++) trigger()
+    await vi.advanceTimersByTimeAsync(WINDOW_MS)
+
+    expect(refresh).toHaveBeenCalledTimes(1)
+  })
+
+  /** A single change is the common case, and waiting out a window to show it would be a delay. */
+  it('answers a lone broadcast without waiting out the window', async () => {
+    const refresh = vi.fn<() => void>()
+    const { trigger } = coalesced(refresh)
+
+    trigger()
+    await vi.advanceTimersByTimeAsync(0)
+
+    expect(refresh).toHaveBeenCalledTimes(1)
+  })
+
+  /** Whatever changed last still has to be read, so the burst ends in a refresh rather than before it. */
+  it('refreshes again for a broadcast that arrives inside the window', async () => {
+    const refresh = vi.fn<() => void>()
+    const { trigger } = coalesced(refresh)
+
+    trigger()
+    await vi.advanceTimersByTimeAsync(0)
+    trigger()
+    await vi.advanceTimersByTimeAsync(WINDOW_MS)
+
+    expect(refresh).toHaveBeenCalledTimes(2)
+  })
+
+  it('holds a sustained stream to one refresh per window', async () => {
+    const refresh = vi.fn<() => void>()
+    const { trigger } = coalesced(refresh)
+
+    // One broadcast every hundred milliseconds for four windows.
+    for (let i = 0; i < 16; i++) {
+      trigger()
+      await vi.advanceTimersByTimeAsync(100)
+    }
+
+    expect(refresh.mock.calls.length).toBeLessThanOrEqual(5)
+    expect(refresh.mock.calls.length).toBeGreaterThan(0)
+  })
+
+  it('does not refresh a page that has gone away', async () => {
+    const refresh = vi.fn<() => void>()
+    const { trigger, scope } = coalesced(refresh)
+
+    trigger()
+    scope.stop()
+    await vi.advanceTimersByTimeAsync(WINDOW_MS)
+
+    expect(refresh).not.toHaveBeenCalled()
+  })
+})
diff --git a/client/src/features/book-requests/__tests__/useFulfilmentPicker.spec.ts b/client/src/features/book-requests/__tests__/useFulfilmentPicker.spec.ts
new file mode 100644
index 000000000..55d8ef467
--- /dev/null
+++ b/client/src/features/book-requests/__tests__/useFulfilmentPicker.spec.ts
@@ -0,0 +1,98 @@
+// @vitest-environment node
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { apiMock } = vi.hoisted(() => ({ apiMock: vi.fn<(url: string, init?: RequestInit) => Promise<Response>>() }))
+vi.mock('@/lib/api', () => ({ api: apiMock }))
+
+import { useFulfilmentPicker } from '../composables/useFulfilmentPicker'
+
+function ok(body: unknown): Response {
+  return { ok: true, status: 200, json: async () => body } as Response
+}
+
+/** The composable debounces, so every search assertion has to let the timer run. */
+async function settle(ms = 400) {
+  await vi.advanceTimersByTimeAsync(ms)
+}
+
+describe('useFulfilmentPicker', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    vi.useFakeTimers()
+  })
+
+  it('builds the payload the fulfil endpoint takes, never a raw id on screen', () => {
+    const picker = useFulfilmentPicker()
+
+    expect(picker.toPayload()).toBeNull()
+
+    picker.select({ source: 'book', id: 128 })
+    expect(picker.toPayload()).toEqual({ matchedBookId: 128 })
+
+    picker.setSource('dockFile')
+    picker.select({ source: 'dockFile', id: 42 })
+    expect(picker.toPayload()).toEqual({ bookDockFileId: 42 })
+  })
+
+  it('drops the selection when the source changes, because a book id is not a dock file id', () => {
+    const picker = useFulfilmentPicker()
+
+    picker.select({ source: 'book', id: 128 })
+    picker.setSource('dockFile')
+
+    expect(picker.selected.value).toBeNull()
+    expect(picker.toPayload()).toBeNull()
+  })
+
+  it('toggles a selected row off when it is picked again', () => {
+    const picker = useFulfilmentPicker()
+
+    picker.select({ source: 'book', id: 128 })
+    expect(picker.isSelected({ source: 'book', id: 128 })).toBe(true)
+
+    picker.select({ source: 'book', id: 128 })
+    expect(picker.selected.value).toBeNull()
+  })
+
+  it('searches the library for books and the dock for files', async () => {
+    apiMock.mockResolvedValue(ok({ items: [{ id: 1, title: 'Watchers' }], total: 1, page: 0, size: 6 }))
+    const picker = useFulfilmentPicker()
+
+    picker.search('watchers')
+    await settle()
+    expect(apiMock.mock.calls[0]?.[0]).toBe('/api/v1/books/query')
+    expect(picker.books.value).toHaveLength(1)
+
+    apiMock.mockResolvedValue(ok({ items: [{ id: 9, fileName: 'watchers.epub' }], total: 1, page: 1, size: 6 }))
+    picker.setSource('dockFile')
+    await settle()
+    expect(apiMock.mock.calls[1]?.[0]).toContain('/api/v1/book-dock/files?')
+    expect(picker.dockFiles.value).toHaveLength(1)
+  })
+
+  it('clears results for an emptied box without spending a request on it', async () => {
+    apiMock.mockResolvedValue(ok({ items: [{ id: 1, title: 'Watchers' }], total: 1, page: 0, size: 6 }))
+    const picker = useFulfilmentPicker()
+
+    picker.search('watchers')
+    await settle()
+    expect(picker.books.value).toHaveLength(1)
+
+    picker.search('   ')
+    await settle()
+    expect(picker.books.value).toEqual([])
+    expect(apiMock).toHaveBeenCalledTimes(1)
+  })
+
+  it('keeps only the last search when a fast typist outruns the debounce', async () => {
+    apiMock.mockResolvedValue(ok({ items: [], total: 0, page: 0, size: 6 }))
+    const picker = useFulfilmentPicker()
+
+    picker.search('w')
+    picker.search('wa')
+    picker.search('wat')
+    await settle()
+
+    expect(apiMock).toHaveBeenCalledTimes(1)
+  })
+})
diff --git a/client/src/features/book-requests/__tests__/useReleaseFilters.spec.ts b/client/src/features/book-requests/__tests__/useReleaseFilters.spec.ts
new file mode 100644
index 000000000..86aecc51e
--- /dev/null
+++ b/client/src/features/book-requests/__tests__/useReleaseFilters.spec.ts
@@ -0,0 +1,145 @@
+// @vitest-environment node
+import { describe, expect, it } from 'vitest'
+import { ref } from 'vue'
+import type { ReleaseCandidateItem } from '@bookorbit/types'
+
+import { useReleaseFilters } from '../composables/useReleaseFilters'
+
+function release(overrides: Partial<ReleaseCandidateItem> = {}): ReleaseCandidateItem {
+  return {
+    indexerId: 1,
+    indexerName: 'jackett',
+    guid: 'g1',
+    title: 'Dune',
+    sizeBytes: null,
+    seeders: null,
+    leechers: null,
+    format: null,
+    formats: [],
+    language: null,
+    fileCount: null,
+    freeleech: false,
+    vipOnly: false,
+    alreadyGrabbed: false,
+    publishedAt: null,
+    audio: null,
+    score: 50,
+    tier: null,
+    tierName: null,
+    reasons: [],
+    ...overrides,
+  }
+}
+
+function guids(list: readonly ReleaseCandidateItem[]): string[] {
+  return list.map((entry) => entry.guid)
+}
+
+describe('useReleaseFilters', () => {
+  it('shows everything until a filter is chosen', () => {
+    const filters = useReleaseFilters(ref([release({ guid: 'a' }), release({ guid: 'b' })]))
+
+    expect(filters.hasFilter.value).toBe(false)
+    expect(guids(filters.visibleReleases.value)).toEqual(['a', 'b'])
+  })
+
+  /** A profile ranks releases before any explicit ordering does; sorting reorders within a tier. */
+  it('keeps tier ahead of the sorted axis', () => {
+    const filters = useReleaseFilters(
+      ref([release({ guid: 'untiered-huge', tier: null, sizeBytes: 900 }), release({ guid: 'tiered-small', tier: 1, sizeBytes: 100 })]),
+    )
+
+    filters.selectSort('size')
+
+    expect(guids(filters.visibleReleases.value)).toEqual(['tiered-small', 'untiered-huge'])
+  })
+
+  it('sorts an axis a release states nothing on to the bottom', () => {
+    const filters = useReleaseFilters(ref([release({ guid: 'silent', seeders: null }), release({ guid: 'seeded', seeders: 3 })]))
+
+    filters.selectSort('seeders')
+
+    expect(guids(filters.visibleReleases.value)).toEqual(['seeded', 'silent'])
+  })
+
+  it('offers no sort axis that nothing in the list varies on', () => {
+    const filters = useReleaseFilters(ref([release({ seeders: null, sizeBytes: null, publishedAt: null, audio: null })]))
+
+    expect(filters.availableSortKeys.value).toEqual(['score'])
+  })
+
+  /** A second click on the active chip is how the filter is taken off again. */
+  it('toggles a chip off when it is picked twice', () => {
+    const filters = useReleaseFilters(ref([release({ guid: 'a', formats: ['epub'] }), release({ guid: 'b', formats: ['mobi'] })]))
+
+    filters.selectFormat('EPUB')
+    expect(guids(filters.visibleReleases.value)).toEqual(['a'])
+
+    filters.selectFormat('EPUB')
+    expect(filters.hasFilter.value).toBe(false)
+    expect(guids(filters.visibleReleases.value)).toEqual(['a', 'b'])
+  })
+
+  /**
+   * The reason facets are counted against every filter but their own: a chip that counted itself
+   * would drop to one option the moment it was used, and there would be no way back to the others.
+   */
+  it('counts a facet against the other filters but not against itself', () => {
+    const filters = useReleaseFilters(
+      ref([
+        release({ guid: 'a', formats: ['epub'], language: 'en' }),
+        release({ guid: 'b', formats: ['mobi'], language: 'en' }),
+        release({ guid: 'c', formats: ['epub'], language: 'fr' }),
+      ]),
+    )
+
+    filters.selectFormat('EPUB')
+
+    expect(filters.formatFacets.value.map((facet) => facet.value).sort()).toEqual(['EPUB', 'MOBI'])
+    expect(filters.languageFacets.value.map((facet) => facet.count)).toEqual([1, 1])
+  })
+
+  it('offers a bitrate floor only where it would separate the list', () => {
+    const filters = useReleaseFilters(
+      ref([
+        release({
+          guid: 'low',
+          audio: { bitrateKbps: 64, bitrateMode: null, channels: null, samplingRateHz: null, durationSeconds: null, chapterCount: null },
+        }),
+        release({
+          guid: 'high',
+          audio: { bitrateKbps: 128, bitrateMode: null, channels: null, samplingRateHz: null, durationSeconds: null, chapterCount: null },
+        }),
+      ]),
+    )
+
+    // 64 would keep both rows and 128 keeps one, so only the step that narrows anything is offered.
+    expect(filters.bitrateFacets.value.map((facet) => facet.step)).toEqual([96, 128])
+  })
+
+  it('marks a best match only in unfiltered score order', () => {
+    const filters = useReleaseFilters(ref([release({ guid: 'a', formats: ['epub'] }), release({ guid: 'b', formats: ['epub'] })]))
+
+    expect(filters.marksBest.value).toBe(true)
+
+    filters.selectFormat('EPUB')
+    expect(filters.marksBest.value).toBe(false)
+  })
+
+  it('counts how many others tied with the release it hoisted', () => {
+    const filters = useReleaseFilters(ref([release({ guid: 'a', score: 70 }), release({ guid: 'b', score: 70 }), release({ guid: 'c', score: 40 })]))
+
+    expect(filters.tiedWithBest.value).toBe(1)
+  })
+
+  it('puts every chip back and returns to score order on reset', () => {
+    const filters = useReleaseFilters(ref([release({ guid: 'a', formats: ['epub'], sizeBytes: 10 })]))
+
+    filters.selectFormat('EPUB')
+    filters.selectSort('size')
+    filters.resetFilters()
+
+    expect(filters.hasFilter.value).toBe(false)
+    expect(filters.sortKey.value).toBe('score')
+  })
+})
diff --git a/client/src/features/book-requests/__tests__/useReleaseGrab.spec.ts b/client/src/features/book-requests/__tests__/useReleaseGrab.spec.ts
new file mode 100644
index 000000000..36f11f6be
--- /dev/null
+++ b/client/src/features/book-requests/__tests__/useReleaseGrab.spec.ts
@@ -0,0 +1,157 @@
+// @vitest-environment node
+import { ref } from 'vue'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { BookRequestItem, ReleaseCandidateItem, ReleaseFileInspection } from '@bookorbit/types'
+
+const { toastMock } = vi.hoisted(() => ({
+  toastMock: { error: vi.fn<(title: string, options?: unknown) => void>(), success: vi.fn<(title: string) => void>() },
+}))
+vi.mock('vue-sonner', () => ({ toast: toastMock }))
+vi.mock('vue-i18n', () => ({ useI18n: () => ({ t: (key: string) => key }) }))
+vi.mock('vue-router', () => ({ useRoute: () => ({ query: {} }), useRouter: () => ({ push: vi.fn<() => void>() }) }))
+
+import { useReleaseGrab, type ReleaseGrabOutcome } from '../composables/useReleaseGrab'
+
+const request = { id: 7, status: 'approved' } as BookRequestItem
+
+function release(overrides: Partial<ReleaseCandidateItem> = {}): ReleaseCandidateItem {
+  return { indexerId: 9, guid: 'g1', vipOnly: false, ...overrides } as ReleaseCandidateItem
+}
+
+const inspection = { status: 'ready' } as ReleaseFileInspection
+
+function deferred<T>() {
+  let release: (value: T) => void = () => {}
+  const pending = new Promise<T>((resolve) => (release = resolve))
+  return { pending, release: (value: T) => release(value) }
+}
+
+function makeGrab(
+  overrides: {
+    grab?: ReturnType<typeof vi.fn>
+    inspectRelease?: ReturnType<typeof vi.fn>
+  } = {},
+) {
+  const grab = overrides.grab ?? vi.fn<() => Promise<ReleaseGrabOutcome>>().mockResolvedValue({ item: request, reason: null, errorCode: null })
+  const inspectRelease = overrides.inspectRelease ?? vi.fn<() => Promise<ReleaseFileInspection | null>>().mockResolvedValue(inspection)
+  const setRequest = vi.fn<(value: BookRequestItem) => void>()
+  const setFilesExpanded = vi.fn<(release: ReleaseCandidateItem, expanded: boolean) => void>()
+
+  return {
+    ...useReleaseGrab({
+      request: ref(request),
+      requestId: ref(7),
+      grab: grab as never,
+      setRequest,
+      inspectRelease: inspectRelease as never,
+      setFilesExpanded,
+      seedsBack: () => true,
+    }),
+    grab,
+    inspectRelease,
+    setRequest,
+    setFilesExpanded,
+  }
+}
+
+describe('useReleaseGrab', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('inspects a release and sends it', async () => {
+    const picker = makeGrab()
+
+    await picker.handleGrab(release())
+
+    expect(picker.grab).toHaveBeenCalledWith(7, { indexerId: 9, releaseGuid: 'g1' })
+    expect(picker.setRequest).toHaveBeenCalledWith(request)
+  })
+
+  /**
+   * Inspecting a release is a tracker round trip of up to twenty-five seconds, and only the
+   * inspecting row was disabled for it. A second Send inside that window ran its own inspection
+   * and went on to its own grab, so two releases were sent for one request.
+   */
+  it('refuses a second release while the first is still being inspected', async () => {
+    const slow = deferred<ReleaseFileInspection>()
+    const picker = makeGrab({
+      inspectRelease: vi.fn<() => Promise<ReleaseFileInspection | null>>().mockReturnValueOnce(slow.pending).mockResolvedValue(inspection),
+    })
+
+    const first = picker.handleGrab(release())
+    await picker.handleGrab(release({ guid: 'g2' }))
+
+    expect(picker.inspectRelease).toHaveBeenCalledTimes(1)
+    slow.release(inspection)
+    await first
+    expect(picker.grab).toHaveBeenCalledTimes(1)
+    expect(picker.grab).toHaveBeenCalledWith(7, { indexerId: 9, releaseGuid: 'g1' })
+  })
+
+  it('refuses a second release while the first is on its way to the client', async () => {
+    const slow = deferred<ReleaseGrabOutcome>()
+    const grab = vi.fn<() => Promise<ReleaseGrabOutcome>>().mockReturnValueOnce(slow.pending)
+    const picker = makeGrab({ grab })
+
+    const first = picker.handleGrab(release())
+    await Promise.resolve()
+    await picker.handleGrab(release({ guid: 'g2' }))
+
+    expect(grab).toHaveBeenCalledTimes(1)
+    slow.release({ item: request, reason: null, errorCode: null })
+    await first
+  })
+
+  /** The manual magnet dialog reaches the same guard, so it cannot race a picked release either. */
+  it('refuses a hand-pasted magnet while a picked release is in flight', async () => {
+    const slow = deferred<ReleaseGrabOutcome>()
+    const grab = vi.fn<() => Promise<ReleaseGrabOutcome>>().mockReturnValueOnce(slow.pending)
+    const picker = makeGrab({ grab })
+
+    const first = picker.handleGrab(release())
+    await Promise.resolve()
+    await picker.submitGrab({ magnet: 'magnet:?xt=urn:btih:abc' })
+
+    expect(grab).toHaveBeenCalledTimes(1)
+    slow.release({ item: request, reason: null, errorCode: null })
+    await first
+  })
+
+  it('lets the next release be sent once the first has settled', async () => {
+    const picker = makeGrab({
+      grab: vi.fn<() => Promise<ReleaseGrabOutcome>>().mockResolvedValue({ item: null, reason: 'the tracker answered 406', errorCode: null }),
+    })
+
+    await picker.handleGrab(release())
+    await picker.handleGrab(release({ guid: 'g2' }))
+
+    expect(picker.grab).toHaveBeenCalledTimes(2)
+    expect(picker.grabbing.value).toBe(false)
+  })
+
+  /** A blocked inspection opens the row's file list instead, and frees the picker for another try. */
+  it('releases the flag when the inspection blocks the grab', async () => {
+    const picker = makeGrab({ inspectRelease: vi.fn<() => Promise<ReleaseFileInspection | null>>().mockResolvedValue(null) })
+
+    await picker.handleGrab(release())
+
+    expect(picker.grab).not.toHaveBeenCalled()
+    expect(picker.setFilesExpanded).toHaveBeenCalledWith(expect.objectContaining({ guid: 'g1' }), true)
+    expect(picker.grabbing.value).toBe(false)
+  })
+
+  /** The refusal comes back with the call, so it can never describe some other release's grab. */
+  it('remembers a source-wide refusal from the outcome it arrived on', async () => {
+    const picker = makeGrab({
+      grab: vi
+        .fn<() => Promise<ReleaseGrabOutcome>>()
+        .mockResolvedValue({ item: null, reason: 'the tracker answered 406', errorCode: 'GRAB_SOURCE_REFUSED' }),
+    })
+
+    await picker.handleGrab(release())
+
+    expect(picker.isRefused(release({ guid: 'g2' }))).toBe(true)
+    expect(toastMock.error).toHaveBeenCalledWith('bookRequests.errors.grabFailed', { description: 'the tracker answered 406' })
+  })
+})
diff --git a/client/src/features/book-requests/__tests__/useReleasePicker.spec.ts b/client/src/features/book-requests/__tests__/useReleasePicker.spec.ts
new file mode 100644
index 000000000..406653f3c
--- /dev/null
+++ b/client/src/features/book-requests/__tests__/useReleasePicker.spec.ts
@@ -0,0 +1,359 @@
+// @vitest-environment node
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { ReleaseCandidateItem, ReleaseFileInspection } from '@bookorbit/types'
+
+const { apiMock } = vi.hoisted(() => ({ apiMock: vi.fn<(url: string, init?: RequestInit) => Promise<Response>>() }))
+vi.mock('@/lib/api', () => ({ api: apiMock }))
+
+import { TITLE_AUTHOR_SEARCH_KEY, useReleasePicker } from '../composables/useReleasePicker'
+
+function ok(body: unknown): Response {
+  return { ok: true, status: 200, json: async () => body } as Response
+}
+
+const release = { indexerId: 9, guid: 'release-guid' } as ReleaseCandidateItem
+
+function searchResult(
+  overrides: {
+    activeIsbn?: string | null
+    releases?: ReleaseCandidateItem[]
+    uncoveredIndexerCount?: number
+    enabledIndexerCount?: number
+    configuredIndexerCount?: number
+  } = {},
+) {
+  return {
+    releases: overrides.releases ?? [],
+    criteria: {
+      title: 'Dune',
+      authors: ['Frank Herbert'],
+      isbn10: null,
+      isbn13: null,
+      activeIsbn: overrides.activeIsbn ?? null,
+      isbns: [],
+      mediaKind: 'ebook',
+      language: null,
+      preferredFormats: ['epub'],
+    },
+    indexers: [],
+    uncoveredIndexerCount: overrides.uncoveredIndexerCount ?? 0,
+    enabledIndexerCount: overrides.enabledIndexerCount ?? 1,
+    configuredIndexerCount: overrides.configuredIndexerCount ?? 1,
+    profileActive: false,
+    cached: false,
+  }
+}
+const inspection: ReleaseFileInspection = {
+  source: 'torrent_file',
+  status: 'ready',
+  files: [{ path: 'book.epub', sizeBytes: 1024, bookFile: true }],
+  totalFiles: 1,
+  primaryFileCount: 1,
+  truncated: false,
+  units: [{ mediaKind: 'ebook', title: 'Book', contentFileCount: 1, totalFileCount: 1, sizeBytes: 1024 }],
+  unitCount: 1,
+  ignoredFileCount: 0,
+  containerCount: 0,
+}
+
+describe('useReleasePicker', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    apiMock.mockResolvedValue(ok(inspection))
+  })
+
+  /**
+   * A source that does not carry the requested medium is never searched, so it arrives as a count
+   * rather than as a failed indexer. The picker needs it to tell "nothing you have configured
+   * carries this" apart from "the search found nothing".
+   */
+  it('carries the count of sources that were never searched for this medium', async () => {
+    apiMock.mockResolvedValue(
+      ok({
+        releases: [],
+        criteria: {
+          title: 'Dune',
+          authors: ['Frank Herbert'],
+          isbn10: null,
+          isbn13: null,
+          activeIsbn: null,
+          isbns: [],
+          mediaKind: 'ebook',
+          language: null,
+          preferredFormats: ['epub'],
+        },
+        indexers: [],
+        uncoveredIndexerCount: 2,
+        cached: false,
+      }),
+    )
+    const picker = useReleasePicker(() => true)
+
+    await picker.fetchReleases(42)
+
+    expect(picker.uncoveredIndexerCount.value).toBe(2)
+    expect(picker.indexers.value).toEqual([])
+    expect(picker.criteria.value?.authors).toEqual(['Frank Herbert'])
+  })
+
+  /**
+   * Both counts, because zero enabled sources and zero configured sources need opposite fixes and
+   * the search result is the only place the picker can learn either: the indexer list is admin-only.
+   */
+  it('carries how many sources were enabled and how many exist at all', async () => {
+    apiMock.mockResolvedValue(ok(searchResult({ enabledIndexerCount: 0, configuredIndexerCount: 3 })))
+    const picker = useReleasePicker(() => true)
+
+    await picker.fetchReleases(42)
+
+    expect(picker.enabledIndexerCount.value).toBe(0)
+    expect(picker.configuredIndexerCount.value).toBe(3)
+  })
+
+  it('posts explicit manual search fields to the scoped fulfillment endpoint', async () => {
+    apiMock.mockResolvedValue(
+      ok({
+        releases: [],
+        criteria: {
+          title: 'Dune Messiah',
+          authors: ['Frank Herbert'],
+          isbn10: null,
+          isbn13: '9780593098233',
+          activeIsbn: '9780593098233',
+          isbns: ['9780593098233'],
+          mediaKind: 'ebook',
+          language: null,
+          preferredFormats: ['azw3'],
+        },
+        indexers: [],
+        uncoveredIndexerCount: 0,
+        profileActive: false,
+        cached: false,
+      }),
+    )
+    const picker = useReleasePicker(() => true)
+    const overrides = {
+      title: 'Dune Messiah',
+      authors: ['Frank Herbert'],
+      isbn: '9780593098233',
+      language: null,
+      preferredFormats: ['azw3'],
+    }
+
+    await expect(picker.fetchReleases(42, { overrides })).resolves.toBe(true)
+
+    expect(apiMock).toHaveBeenCalledWith('/api/v1/admin/book-requests/42/releases/search', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(overrides),
+    })
+    expect(picker.criteria.value?.isbns).toEqual(['9780593098233'])
+  })
+
+  it('forgets the uncovered count and everything it searched when the picker is reset', async () => {
+    apiMock.mockResolvedValue(ok(searchResult({ uncoveredIndexerCount: 2 })))
+    const picker = useReleasePicker(() => true)
+    await picker.fetchReleases(42)
+
+    picker.reset()
+
+    expect(picker.uncoveredIndexerCount.value).toBe(0)
+    expect(picker.enabledIndexerCount.value).toBe(0)
+    expect(picker.configuredIndexerCount.value).toBe(0)
+    expect(picker.criteria.value).toBeNull()
+    expect(picker.attempts.value.size).toBe(0)
+  })
+
+  /**
+   * Alternate ISBNs on one request almost always share a provider label, so "Google Books" four
+   * times separates nothing. What each key returned is the only thing that does.
+   */
+  it('remembers how many releases every key it searched came back with', async () => {
+    const picker = useReleasePicker(() => true)
+
+    apiMock.mockResolvedValue(ok(searchResult({ activeIsbn: '9781234567897', releases: [release, release] })))
+    await picker.fetchReleases(42)
+    apiMock.mockResolvedValue(ok(searchResult({ activeIsbn: '9781250301697' })))
+    await picker.fetchReleases(42, { overrides: { isbn: '9781250301697' } })
+
+    expect(picker.attempts.value.get('9781234567897')).toBe(2)
+    expect(picker.attempts.value.get('9781250301697')).toBe(0)
+  })
+
+  it('keys a title and author search by name, since it has no ISBN to be keyed by', async () => {
+    apiMock.mockResolvedValue(ok(searchResult({ activeIsbn: null, releases: [release] })))
+    const picker = useReleasePicker(() => true)
+
+    await picker.fetchReleases(42, { overrides: { isbn: null } })
+
+    expect(picker.attempts.value.get(TITLE_AUTHOR_SEARCH_KEY)).toBe(1)
+  })
+
+  it('inspects only the selected release without sending source URLs to the browser', async () => {
+    const picker = useReleasePicker(() => true)
+
+    await expect(picker.inspectRelease(42, release)).resolves.toEqual(inspection)
+
+    expect(apiMock).toHaveBeenCalledWith('/api/v1/admin/book-requests/42/releases/inspect', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ indexerId: 9, releaseGuid: 'release-guid' }),
+    })
+    expect(picker.inspections.value.get('9:release-guid')).toEqual(inspection)
+  })
+
+  it('reuses an inspection until search results are refreshed', async () => {
+    const picker = useReleasePicker(() => true)
+
+    await picker.inspectRelease(42, release)
+    await picker.inspectRelease(42, release)
+
+    expect(apiMock).toHaveBeenCalledTimes(1)
+  })
+
+  it('shares one request when inspection is requested twice at the same time', async () => {
+    let resolveInspection!: (response: Response) => void
+    apiMock.mockReturnValue(
+      new Promise<Response>((resolve) => {
+        resolveInspection = resolve
+      }),
+    )
+    const picker = useReleasePicker(() => true)
+
+    const first = picker.inspectRelease(42, release)
+    const second = picker.inspectRelease(42, release)
+    resolveInspection(ok(inspection))
+
+    await expect(first).resolves.toEqual(inspection)
+    await expect(second).resolves.toEqual(inspection)
+    expect(apiMock).toHaveBeenCalledTimes(1)
+  })
+
+  it('discards an inspection that finishes after search results refresh', async () => {
+    let resolveInspection!: (response: Response) => void
+    apiMock.mockImplementation((url) => {
+      if (url.endsWith('/releases/inspect')) {
+        return new Promise<Response>((resolve) => {
+          resolveInspection = resolve
+        })
+      }
+      return Promise.resolve(ok({ releases: [], indexers: [], cached: false }))
+    })
+    const picker = useReleasePicker(() => true)
+
+    const staleInspection = picker.inspectRelease(42, release)
+    await picker.fetchReleases(42, { refresh: true })
+    resolveInspection(ok(inspection))
+
+    await expect(staleInspection).resolves.toBeNull()
+    expect(picker.inspections.value.size).toBe(0)
+  })
+
+  it('records a failed inspection and does not invent a manifest', async () => {
+    apiMock.mockResolvedValue({ ok: false, status: 502, json: async () => null } as unknown as Response)
+    const picker = useReleasePicker(() => true)
+
+    await expect(picker.inspectRelease(42, release)).resolves.toBeNull()
+
+    expect(picker.inspections.value.size).toBe(0)
+    expect(picker.inspectionFailed.value.has('9:release-guid')).toBe(true)
+  })
+
+  /**
+   * The tracker's own sentence is the useful half of a refusal, and it used to be dropped on the
+   * floor in favour of "could not read this release's file list".
+   */
+  it('keeps the reason a refusal came with', async () => {
+    apiMock.mockResolvedValue({
+      ok: false,
+      status: 400,
+      json: async () => ({ message: 'VIP torrent and you are not VIP or higher' }),
+    } as unknown as Response)
+    const picker = useReleasePicker(() => true)
+
+    await picker.inspectRelease(42, release)
+
+    expect(picker.inspectionFailed.value.get('9:release-guid')).toBe('VIP torrent and you are not VIP or higher')
+  })
+
+  it('joins a list of validation messages into one reason', async () => {
+    apiMock.mockResolvedValue({ ok: false, status: 400, json: async () => ({ message: ['first', 'second'] }) } as unknown as Response)
+    const picker = useReleasePicker(() => true)
+
+    await picker.inspectRelease(42, release)
+
+    expect(picker.inspectionFailed.value.get('9:release-guid')).toBe('first. second')
+  })
+
+  /** A transport failure has no sentence to pass on, and must not read as one. */
+  it('records no reason when the request never reached the server', async () => {
+    apiMock.mockRejectedValue(new Error('offline'))
+    const picker = useReleasePicker(() => true)
+
+    await picker.inspectRelease(42, release)
+
+    expect(picker.inspectionFailed.value.has('9:release-guid')).toBe(true)
+    expect(picker.inspectionFailed.value.get('9:release-guid')).toBeNull()
+  })
+
+  it('clears a previous reason when the same release is inspected again', async () => {
+    apiMock.mockResolvedValue({ ok: false, status: 400, json: async () => ({ message: 'refused' }) } as unknown as Response)
+    const picker = useReleasePicker(() => true)
+    await picker.inspectRelease(42, release)
+
+    apiMock.mockResolvedValue(ok(inspection))
+    picker.reset()
+    await picker.inspectRelease(42, release)
+
+    expect(picker.inspectionFailed.value.has('9:release-guid')).toBe(false)
+  })
+})
+
+/**
+ * A cross-indexer search can take the better part of a minute, which is long enough for the
+ * approver to search again with different terms, or to leave for another request entirely.
+ */
+describe('useReleasePicker out-of-order searches', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  function deferred() {
+    let release: (body: unknown) => void = () => {}
+    const pending = new Promise<Response>((resolve) => {
+      release = (body: unknown) => resolve(ok(body))
+    })
+    return { pending, release }
+  }
+
+  it('does not let an older search overwrite the results of a newer one', async () => {
+    const picker = useReleasePicker(() => true)
+    const older = deferred()
+    const newest = [{ indexerId: 1, guid: 'newest' } as ReleaseCandidateItem]
+    apiMock.mockImplementationOnce(() => older.pending)
+    apiMock.mockResolvedValueOnce(ok(searchResult({ releases: newest })))
+
+    const stale = picker.fetchReleases(7)
+    await picker.fetchReleases(7, { refresh: true })
+    older.release(searchResult({ releases: [{ indexerId: 2, guid: 'stale' } as ReleaseCandidateItem] }))
+
+    await expect(stale).resolves.toBe(false)
+    expect(picker.releases.value).toEqual(newest)
+    expect(picker.loading.value).toBe(false)
+  })
+
+  /** Closing the picker resets it, and an answer arriving afterwards is about a request nobody has open. */
+  it('does not repopulate a picker that has been reset', async () => {
+    const picker = useReleasePicker(() => true)
+    const older = deferred()
+    apiMock.mockImplementationOnce(() => older.pending)
+
+    const stale = picker.fetchReleases(7)
+    picker.reset()
+    older.release(searchResult({ releases: [{ indexerId: 2, guid: 'stale' } as ReleaseCandidateItem] }))
+    await stale
+
+    expect(picker.releases.value).toEqual([])
+    expect(picker.searched.value).toBe(false)
+  })
+})
diff --git a/client/src/features/book-requests/__tests__/useRequestDestinationDefault.spec.ts b/client/src/features/book-requests/__tests__/useRequestDestinationDefault.spec.ts
new file mode 100644
index 000000000..ef7881e01
--- /dev/null
+++ b/client/src/features/book-requests/__tests__/useRequestDestinationDefault.spec.ts
@@ -0,0 +1,229 @@
+// @vitest-environment node
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const apiMock = vi.hoisted(() => vi.fn<(...args: [RequestInfo | URL, RequestInit?]) => Promise<unknown>>())
+
+vi.mock('@/lib/api', () => ({ api: apiMock }))
+
+function response(body: unknown, ok = true): Pick<Response, 'json' | 'ok'> {
+  return {
+    ok,
+    json: vi.fn<() => Promise<unknown>>().mockResolvedValue(body),
+  }
+}
+
+async function freshComposable() {
+  vi.resetModules()
+  const { useRequestDestinationDefault } = await import('../composables/useRequestDestinationDefault')
+  return useRequestDestinationDefault()
+}
+
+/** The two halves read different endpoints now, so a test that touches both needs both handles. */
+async function freshBoth() {
+  vi.resetModules()
+  const module = await import('../composables/useRequestDestinationDefault')
+  return {
+    destination: module.useRequestDestinationDefault(),
+    language: module.useRequestLanguageDefault(),
+    requestLanguageOptions: module.requestLanguageOptions,
+  }
+}
+
+const LIBRARIES = [
+  { id: 4, folders: [{ id: 8 }, { id: 9 }] },
+  { id: 5, folders: [{ id: 10 }] },
+]
+
+const NO_DEFAULTS = {
+  ebook: { libraryId: null, libraryName: null, folderId: null },
+  audiobook: { libraryId: null, libraryName: null, folderId: null },
+  comic: { libraryId: null, libraryName: null, folderId: null },
+}
+
+describe('useRequestDestinationDefault', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('loads the instance default for each medium', async () => {
+    apiMock.mockResolvedValueOnce(
+      response({
+        ...NO_DEFAULTS,
+        ebook: { libraryId: 4, libraryName: 'Novels', folderId: 9 },
+        audiobook: { libraryId: 5, libraryName: 'Audiobooks', folderId: 10 },
+      }),
+    )
+    const preferences = await freshComposable()
+
+    await expect(preferences.load()).resolves.toBe(true)
+
+    expect(apiMock).toHaveBeenCalledWith('/api/v1/book-requests/default-destinations')
+    expect(preferences.defaultFor('ebook')).toEqual({ libraryId: 4, libraryName: 'Novels', folderId: 9 })
+    expect(preferences.defaultFor('audiobook')).toEqual({ libraryId: 5, libraryName: 'Audiobooks', folderId: 10 })
+    expect(preferences.defaultFor('comic')).toEqual({ libraryId: null, libraryName: null, folderId: null })
+  })
+
+  it('reads a malformed body as no default rather than a half-made destination', async () => {
+    apiMock.mockResolvedValueOnce(response({ ebook: { libraryId: 'four', libraryName: 7 } }))
+    const preferences = await freshComposable()
+
+    await preferences.load()
+
+    expect(preferences.defaultFor('ebook')).toEqual({ libraryId: null, libraryName: null, folderId: null })
+  })
+
+  it('fetches once and serves later loads from cache', async () => {
+    apiMock.mockResolvedValueOnce(response(NO_DEFAULTS))
+    const preferences = await freshComposable()
+
+    await preferences.load()
+    await expect(preferences.load()).resolves.toBe(true)
+
+    expect(apiMock).toHaveBeenCalledTimes(1)
+  })
+
+  /**
+   * The instance default can name a library this user cannot browse, so it must never become the
+   * value of a select they are expected to read and change. The form shows it as the placeholder
+   * and the server applies it; putting it in here would show a destination they cannot verify.
+   */
+  it('never preselects the instance default', async () => {
+    apiMock.mockResolvedValueOnce(response({ ...NO_DEFAULTS, ebook: { libraryId: 99, libraryName: 'Staff only', folderId: 1 } }))
+    const preferences = await freshComposable()
+    await preferences.load()
+
+    expect(preferences.resolveDestination(LIBRARIES)).toEqual({ libraryId: null, folderId: null })
+  })
+
+  it('keeps a destination the request already carries', async () => {
+    apiMock.mockResolvedValueOnce(response(NO_DEFAULTS))
+    const preferences = await freshComposable()
+    await preferences.load()
+
+    expect(preferences.resolveDestination(LIBRARIES, { libraryId: 5, folderId: 10 })).toEqual({ libraryId: 5, folderId: 10 })
+  })
+
+  it('falls back to the first folder when the request names only a library', async () => {
+    apiMock.mockResolvedValueOnce(response(NO_DEFAULTS))
+    const preferences = await freshComposable()
+    await preferences.load()
+
+    expect(preferences.resolveDestination(LIBRARIES, { libraryId: 5, folderId: null })).toEqual({ libraryId: 5, folderId: 10 })
+  })
+
+  it('preselects the only library there is, unless the caller says not to', async () => {
+    apiMock.mockResolvedValueOnce(response(NO_DEFAULTS))
+    const preferences = await freshComposable()
+    await preferences.load()
+
+    expect(preferences.resolveDestination([LIBRARIES[1]!])).toEqual({ libraryId: 5, folderId: 10 })
+    expect(preferences.resolveDestination([LIBRARIES[1]!], undefined, false)).toEqual({ libraryId: null, folderId: null })
+  })
+})
+
+describe('useRequestLanguageDefault', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('loads the pinned language', async () => {
+    apiMock.mockResolvedValueOnce(response({ settings: { defaultLanguage: 'de' } }))
+    const { language } = await freshBoth()
+
+    await language.load()
+
+    expect(language.defaultLanguage.value).toBe('de')
+  })
+
+  /** A row stored before this field existed must not read as a corrupt preference. */
+  it('treats a preference saved without a language as no language', async () => {
+    apiMock.mockResolvedValueOnce(response({ settings: {} }))
+    const { language } = await freshBoth()
+
+    await language.load()
+
+    expect(language.defaultLanguage.value).toBeNull()
+  })
+
+  /**
+   * Rows written while destinations lived here still exist. The server drops those fields, but a
+   * response that still carried them must not make the language unreadable either.
+   */
+  it('ignores destination fields left over in a stored row', async () => {
+    apiMock.mockResolvedValueOnce(response({ settings: { defaultLibraryId: 4, defaultFolderId: 9, defaultLanguage: 'de' } }))
+    const { language } = await freshBoth()
+
+    await language.load()
+
+    expect(language.defaultLanguage.value).toBe('de')
+  })
+
+  it('prefers the pinned language over the interface language', async () => {
+    apiMock.mockResolvedValueOnce(response({ settings: { defaultLanguage: 'it' } }))
+    const { language } = await freshBoth()
+    await language.load()
+
+    expect(language.resolveLanguage('en')).toBe('it')
+  })
+
+  it('falls back to the interface language, subtag and all', async () => {
+    apiMock.mockResolvedValueOnce(response({ settings: { defaultLanguage: null } }))
+    const { language } = await freshBoth()
+    await language.load()
+
+    expect(language.resolveLanguage('en-US')).toBe('en')
+    expect(language.resolveLanguage('pt-BR')).toBe('pt')
+    expect(language.resolveLanguage(null)).toBeNull()
+  })
+
+  /**
+   * Mirrors the matcher rather than inventing a narrower rule of its own. Being stricter here is how
+   * a language the matcher handles perfectly well would be dropped from the request instead.
+   */
+  it('resolves anything that yields a subtag, and nothing that does not', async () => {
+    apiMock.mockResolvedValueOnce(response({ settings: { defaultLanguage: null } }))
+    const { language } = await freshBoth()
+    await language.load()
+
+    expect(language.resolveLanguage('spa')).toBe('es')
+    expect(language.resolveLanguage('ne')).toBe('ne')
+    expect(language.resolveLanguage('!!')).toBeNull()
+    expect(language.resolveLanguage('')).toBeNull()
+  })
+
+  it('saves the pinned language on its own', async () => {
+    apiMock.mockResolvedValueOnce(response({ settings: { defaultLanguage: null } }))
+    const { language } = await freshBoth()
+    await language.load()
+
+    apiMock.mockResolvedValueOnce(response({}, true))
+    await language.setDefault('fr')
+
+    const [url, init] = apiMock.mock.calls[1] as [string, RequestInit]
+    expect(url).toBe('/api/v1/user-preferences/book-requests')
+    expect(JSON.parse(String(init.body))).toEqual({ settings: { defaultLanguage: 'fr' } })
+    expect(language.defaultLanguage.value).toBe('fr')
+  })
+
+  it('keeps the pinned language when saving fails', async () => {
+    apiMock.mockResolvedValueOnce(response({ settings: { defaultLanguage: 'fr' } }))
+    const { language } = await freshBoth()
+    await language.load()
+
+    apiMock.mockResolvedValueOnce(response({}, false))
+    await expect(language.setDefault('de')).resolves.toBe(false)
+
+    expect(language.defaultLanguage.value).toBe('fr')
+  })
+
+  it('offers only languages a release can be matched against, named and sorted for the reader', async () => {
+    const { requestLanguageOptions } = await freshBoth()
+    const options = requestLanguageOptions('en')
+
+    const names = options.map((option) => option.name)
+
+    expect(options.some((option) => option.code === 'es')).toBe(true)
+    expect(names.every((name) => name.length > 0)).toBe(true)
+    expect(names).toEqual([...names].sort((a, b) => a.localeCompare(b, 'en')))
+  })
+})
diff --git a/client/src/features/book-requests/__tests__/useRequestSubmission.spec.ts b/client/src/features/book-requests/__tests__/useRequestSubmission.spec.ts
new file mode 100644
index 000000000..17d74261e
--- /dev/null
+++ b/client/src/features/book-requests/__tests__/useRequestSubmission.spec.ts
@@ -0,0 +1,191 @@
+// @vitest-environment node
+import { effectScope } from 'vue'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { MetadataProviderKey, type MetadataCandidate } from '@bookorbit/types'
+
+import { submitFailureText, useRequestSubmission } from '../composables/useRequestSubmission'
+
+const api = vi.hoisted(() => vi.fn<(input: string, init?: RequestInit) => Promise<Response>>())
+
+vi.mock('@/lib/api', () => ({ api }))
+
+describe('useRequestSubmission', () => {
+  beforeEach(() => {
+    api.mockReset()
+  })
+
+  it('submits the usable grouped cover without changing the selected provider identity', async () => {
+    api
+      .mockResolvedValueOnce({
+        ok: true,
+        json: async () => ({ request: { id: 12, status: 'pending' }, subscribed: false }),
+      } as Response)
+      .mockResolvedValueOnce({ ok: true, json: async () => ({ limit: null, remaining: null }) } as Response)
+    const candidate: MetadataCandidate = {
+      provider: MetadataProviderKey.GOOGLE,
+      providerId: 'google-id',
+      title: 'Dune',
+      authors: ['Frank Herbert'],
+      coverUrl: 'https://google.test/broken.jpg',
+    }
+    const scope = effectScope()
+    const state = scope.run(() => useRequestSubmission())!
+
+    await state.submit(candidate, { coverUrl: 'https://amazon.test/usable.jpg' })
+    scope.stop()
+
+    const request = api.mock.calls[0]!
+    expect(request[0]).toBe('/api/v1/book-requests')
+    expect(JSON.parse(request[1]!.body as string)).toEqual(
+      expect.objectContaining({
+        providerKey: MetadataProviderKey.GOOGLE,
+        providerId: 'google-id',
+        coverUrl: 'https://amazon.test/usable.jpg',
+      }),
+    )
+  })
+
+  it('submits grouped provenance without inventing one winning provider or ISBN', async () => {
+    api.mockResolvedValueOnce({
+      ok: true,
+      json: async () => ({ request: { id: 12, status: 'pending' }, subscribed: false }),
+    } as Response)
+    const candidate: MetadataCandidate = {
+      provider: MetadataProviderKey.GOOGLE,
+      providerId: 'google-id',
+      title: 'Dune',
+      isbn13: '9780441013593',
+    }
+    const metadataSources = [
+      {
+        providerKey: MetadataProviderKey.GOOGLE,
+        providerId: 'google-id',
+        providerLabel: 'Google Books',
+        isbn10: null,
+        isbn13: '9780441013593',
+      },
+      {
+        providerKey: MetadataProviderKey.AMAZON,
+        providerId: 'amazon-id',
+        providerLabel: 'Amazon',
+        isbn10: null,
+        isbn13: '9781250301697',
+      },
+    ]
+    const scope = effectScope()
+    const state = scope.run(() => useRequestSubmission())!
+
+    await state.submit(candidate, { isbn10: null, isbn13: null, providerKey: null, providerId: null, metadataSources })
+    scope.stop()
+
+    const payload = JSON.parse(api.mock.calls[0]![1]!.body as string)
+    expect(payload).toEqual(expect.objectContaining({ isbn10: null, isbn13: null, providerKey: null, providerId: null, metadataSources }))
+  })
+
+  it('drops a provider cover whose URL is not HTTP', async () => {
+    api.mockResolvedValueOnce({
+      ok: true,
+      json: async () => ({ request: { id: 12, status: 'pending' }, subscribed: false }),
+    } as Response)
+    const candidate: MetadataCandidate = {
+      provider: MetadataProviderKey.GOOGLE,
+      providerId: 'google-id',
+      title: 'Dune',
+      coverUrl: 'data:image/png;base64,AAAA',
+    }
+    const scope = effectScope()
+    const state = scope.run(() => useRequestSubmission())!
+
+    await state.submit(candidate, {})
+    scope.stop()
+
+    expect(JSON.parse(api.mock.calls[0]![1]!.body as string)).toMatchObject({ coverUrl: null })
+  })
+})
+
+/**
+ * Every refusal the submit endpoint raises is application copy about a rule this instance applies,
+ * so it has to reach the reader in their own language. English prose in a toast is what the codes
+ * exist to replace, and the prose stays only for what nothing classified.
+ */
+describe('submit refusals', () => {
+  const t = (key: string, named: Record<string, unknown>) => `${key} ${JSON.stringify(named)}`
+
+  function refusal(body: unknown) {
+    return { ok: false, json: async () => body } as Response
+  }
+
+  async function submitAgainst(body: unknown) {
+    api.mockResolvedValueOnce(refusal(body))
+    const scope = effectScope()
+    const state = scope.run(() => useRequestSubmission())!
+    await state.submitFreeText({ title: 'Dune' }, {})
+    scope.stop()
+    return state.lastFailure.value
+  }
+
+  beforeEach(() => {
+    api.mockReset()
+  })
+
+  it('reads the code and its parameters off the refusal', async () => {
+    const failure = await submitAgainst({
+      message: 'Finish or cancel some downloads first: 10 can be in flight at once',
+      errorCode: 'SUBMIT_SELF_SERVE_LIMIT',
+      errorMeta: { limit: 10 },
+    })
+
+    expect(failure).toEqual({
+      code: 'SUBMIT_SELF_SERVE_LIMIT',
+      meta: { limit: 10 },
+      message: 'Finish or cancel some downloads first: 10 can be in flight at once',
+    })
+    expect(submitFailureText(failure, t)).toBe('bookRequests.submitError.SUBMIT_SELF_SERVE_LIMIT {"limit":10}')
+  })
+
+  /** A code this build does not know is not a code; showing the sentence beats showing its name. */
+  it('falls back to the server sentence for an unrecognised code', async () => {
+    const failure = await submitAgainst({ message: 'Something else entirely', errorCode: 'SUBMIT_FROM_THE_FUTURE' })
+
+    expect(failure?.code).toBeNull()
+    expect(submitFailureText(failure, t)).toBe('Something else entirely')
+  })
+
+  /** A validation error carries an array of field messages and no code at all. */
+  it('falls back to the first validation message', async () => {
+    const failure = await submitAgainst({ message: ['title should not be empty', 'mediaKind must be one of'] })
+
+    expect(submitFailureText(failure, t)).toBe('title should not be empty')
+  })
+
+  it('says nothing it cannot read, leaving the caller its own fallback', async () => {
+    const failure = await submitAgainst({})
+
+    expect(submitFailureText(failure, t)).toBeNull()
+    expect(submitFailureText(null, t)).toBeNull()
+  })
+
+  /**
+   * A network failure never reached the server, so there is no classified refusal to read. Without
+   * a catch the promise rejected out of the caller: the button un-disabled and the person was told
+   * nothing at all had happened.
+   */
+  it.each([
+    [
+      'a candidate',
+      (state: ReturnType<typeof useRequestSubmission>) =>
+        state.submit({ provider: MetadataProviderKey.GOOGLE, providerId: 'g1', title: 'Dune' } as MetadataCandidate, {}),
+    ],
+    ['free text', (state: ReturnType<typeof useRequestSubmission>) => state.submitFreeText({ title: 'Dune' }, {})],
+  ])('reports a network failure submitting %s rather than rejecting', async (_label, submit) => {
+    api.mockRejectedValueOnce(new Error('Failed to fetch'))
+    const scope = effectScope()
+    const state = scope.run(() => useRequestSubmission())!
+
+    await expect(submit(state)).resolves.toBeNull()
+
+    expect(state.lastFailure.value).toEqual({ code: null, meta: null, message: null })
+    expect(state.submitting.value).toBeNull()
+    scope.stop()
+  })
+})
diff --git a/client/src/features/book-requests/components/GrabReleaseDialog.vue b/client/src/features/book-requests/components/GrabReleaseDialog.vue
new file mode 100644
index 000000000..130675090
--- /dev/null
+++ b/client/src/features/book-requests/components/GrabReleaseDialog.vue
@@ -0,0 +1,171 @@
+<script setup lang="ts">
+import { computed, ref, watch } from 'vue'
+import { useI18n } from 'vue-i18n'
+import { toast } from 'vue-sonner'
+import { DialogContent, DialogDescription, DialogOverlay, DialogPortal, DialogRoot, DialogTitle } from 'reka-ui'
+import { MAX_TORRENT_FILE_BYTES } from '@bookorbit/types'
+import type { BookRequestItem, DownloadClientSummary, GrabBookRequestPayload } from '@bookorbit/types'
+import { Button } from '@/components/ui/button'
+import { formatBytes } from '@/lib/formatting'
+
+const props = defineProps<{
+  request: BookRequestItem | null
+  clients: DownloadClientSummary[]
+  busy: boolean
+}>()
+
+const emit = defineEmits<{
+  close: []
+  grab: [payload: { request: BookRequestItem; body: GrabBookRequestPayload }]
+}>()
+
+const { t } = useI18n()
+
+const magnet = ref('')
+const torrentFileBase64 = ref('')
+const torrentFileName = ref('')
+const downloadClientId = ref<number | null>(null)
+
+const isOpen = computed(() => props.request !== null)
+const canSubmit = computed(() => Boolean(magnet.value.trim()) !== Boolean(torrentFileBase64.value))
+
+watch(
+  () => props.request?.id,
+  () => {
+    magnet.value = ''
+    torrentFileBase64.value = ''
+    torrentFileName.value = ''
+    downloadClientId.value = props.clients[0]?.id ?? null
+  },
+)
+
+function handleOpenChange(open: boolean) {
+  if (!open && !props.busy) emit('close')
+}
+
+function handleClose() {
+  emit('close')
+}
+
+/**
+ * Read as base64 so the grab stays one JSON endpoint; .torrent files are only a few kilobytes.
+ *
+ * Bounded first, and by the same limit the server enforces: whatever the picker was pointed at,
+ * this is a plain file input, and a video dropped into it used to be read whole into a string one
+ * character at a time before anything looked at its size.
+ */
+async function handleFileChange(event: Event) {
+  const input = event.target as HTMLInputElement
+  const file = input.files?.[0]
+  torrentFileBase64.value = ''
+  torrentFileName.value = ''
+  if (!file) return
+
+  if (file.size > MAX_TORRENT_FILE_BYTES) {
+    input.value = ''
+    toast.error(t('bookRequests.grab.errors.fileTooLarge', { limit: formatBytes(MAX_TORRENT_FILE_BYTES) }))
+    return
+  }
+
+  try {
+    torrentFileBase64.value = await readAsBase64(file)
+  } catch {
+    input.value = ''
+    toast.error(t('bookRequests.grab.errors.fileUnreadable'))
+    return
+  }
+  torrentFileName.value = file.name
+  magnet.value = ''
+}
+
+/**
+ * `FileReader` hands back a data URL the browser encoded natively; the alternative is building the
+ * binary string in script, which is a character of garbage collection per byte of file.
+ */
+function readAsBase64(file: File): Promise<string> {
+  return new Promise((resolve, reject) => {
+    const reader = new FileReader()
+    reader.onerror = () => reject(reader.error ?? new Error('unreadable'))
+    reader.onload = () => {
+      const result = typeof reader.result === 'string' ? reader.result : ''
+      const comma = result.indexOf(',')
+      if (comma === -1) reject(new Error('unreadable'))
+      else resolve(result.slice(comma + 1))
+    }
+    reader.readAsDataURL(file)
+  })
+}
+
+function handleSubmit() {
+  if (!props.request) return
+  if (!canSubmit.value) {
+    toast.error(t('bookRequests.grab.errors.pickOne'))
+    return
+  }
+
+  emit('grab', {
+    request: props.request,
+    body: {
+      ...(magnet.value.trim() ? { magnet: magnet.value.trim() } : {}),
+      ...(torrentFileBase64.value ? { torrentFileBase64: torrentFileBase64.value, torrentFileName: torrentFileName.value } : {}),
+      ...(downloadClientId.value !== null ? { downloadClientId: downloadClientId.value } : {}),
+    },
+  })
+}
+</script>
+
+<template>
+  <DialogRoot :open="isOpen" @update:open="handleOpenChange">
+    <DialogPortal>
+      <DialogOverlay class="fixed inset-0 z-50 bg-foreground/50" />
+      <DialogContent
+        aria-modal="true"
+        class="fixed left-1/2 top-1/2 z-50 max-h-[calc(100dvh-2rem)] w-[calc(100%-2rem)] max-w-lg -translate-x-1/2 -translate-y-1/2 overflow-y-auto rounded-lg border border-border bg-card p-6 shadow-xl focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
+      >
+        <DialogTitle class="text-lg font-semibold text-foreground">{{ t('bookRequests.grab.title') }}</DialogTitle>
+        <DialogDescription class="mt-1 text-sm text-muted-foreground">
+          {{ t('bookRequests.grab.subtitle', { title: request?.title ?? '' }) }}
+        </DialogDescription>
+        <p class="mt-2 text-xs text-muted-foreground">{{ t('bookRequests.grab.singleFileNote') }}</p>
+
+        <div class="mt-4 space-y-3">
+          <div>
+            <label for="grab-magnet" class="settings-label">{{ t('bookRequests.grab.magnet') }}</label>
+            <input id="grab-magnet" v-model="magnet" type="text" class="settings-input" placeholder="magnet:?xt=urn:btih:..." />
+          </div>
+
+          <div>
+            <label for="grab-torrent-file" class="settings-label">{{ t('bookRequests.grab.torrentFile') }}</label>
+            <input
+              id="grab-torrent-file"
+              type="file"
+              accept=".torrent,application/x-bittorrent"
+              class="settings-input pt-1.5"
+              @change="handleFileChange"
+            />
+            <p v-if="torrentFileName" class="settings-hint">{{ torrentFileName }}</p>
+          </div>
+
+          <div v-if="clients.length > 1">
+            <label for="grab-client" class="settings-label">{{ t('bookRequests.grab.client') }}</label>
+            <select id="grab-client" v-model="downloadClientId" class="settings-input">
+              <option v-for="client in clients" :key="client.id" :value="client.id">{{ client.name }}</option>
+            </select>
+          </div>
+
+          <!--
+            An empty list is not a reason to block the send: the server picks its highest-priority
+            enabled client when none is named, and it answers with a usable message when there is
+            none at all. Blocking here used to lock out an approver who simply cannot read the list.
+          -->
+          <p v-if="clients.length === 0" role="status" class="settings-hint">{{ t('bookRequests.grab.noClientList') }}</p>
+        </div>
+
+        <div class="mt-6 flex flex-wrap justify-end gap-2">
+          <Button variant="outline" size="sm" :disabled="busy" @click="handleClose">{{ t('common.cancel') }}</Button>
+          <Button size="sm" :disabled="busy" @click="handleSubmit">{{ t('bookRequests.grab.submit') }}</Button>
+        </div>
+      </DialogContent>
+    </DialogPortal>
+  </DialogRoot>
+</template>
diff --git a/client/src/features/book-requests/components/NoRequestSourcesNotice.vue b/client/src/features/book-requests/components/NoRequestSourcesNotice.vue
new file mode 100644
index 000000000..3777b3143
--- /dev/null
+++ b/client/src/features/book-requests/components/NoRequestSourcesNotice.vue
@@ -0,0 +1,50 @@
+<script setup lang="ts">
+import { computed } from 'vue'
+import { useI18n } from 'vue-i18n'
+import { ArrowUpRight, TriangleAlert } from '@lucide/vue'
+import { Permission } from '@bookorbit/types'
+import { usePermissions } from '@/features/auth/composables/usePermissions'
+
+/**
+ * Said wherever a request is filed or waited on, because nothing else on those screens can say it:
+ * a request with no source to search looks exactly like one waiting its turn.
+ *
+ * Shown to requesters as well as operators, with the fix swapped for who to ask. A requester
+ * watching their own row sit at "pending" for a week is the person most owed the explanation, and
+ * the one least able to find it.
+ */
+const props = defineProps<{
+  /** True when no indexer row exists at all, rather than when every one of them is switched off. */
+  nothingConfigured: boolean
+}>()
+
+const { t } = useI18n()
+const { hasPermission } = usePermissions()
+
+/** Settings > System > Requests is gated on managing settings, not on managing requests. */
+const canFixSources = computed(() => hasPermission(Permission.ManageAppSettings))
+
+const title = computed(() => t(props.nothingConfigured ? 'bookRequests.sources.noneConfigured' : 'bookRequests.sources.allDisabled'))
+const message = computed(() => {
+  if (!canFixSources.value) return t('bookRequests.sources.askAdmin')
+  return t(props.nothingConfigured ? 'bookRequests.sources.noneConfiguredHint' : 'bookRequests.sources.allDisabledHint')
+})
+</script>
+
+<template>
+  <div role="status" class="flex flex-wrap items-center gap-x-3 gap-y-2 rounded-lg border border-warning/40 bg-warning/10 px-3.5 py-3 text-sm">
+    <TriangleAlert :size="16" class="shrink-0 text-warning" aria-hidden="true" />
+    <p class="min-w-56 flex-1 text-foreground">
+      <span class="font-medium">{{ title }}</span>
+      <span class="text-muted-foreground"> {{ message }}</span>
+    </p>
+    <RouterLink
+      v-if="canFixSources"
+      :to="{ name: 'settings-admin-requests' }"
+      class="inline-flex shrink-0 items-center gap-0.5 font-medium text-foreground underline-offset-2 hover:underline"
+    >
+      {{ t(props.nothingConfigured ? 'bookRequests.sources.addSource' : 'bookRequests.sources.reviewSources') }}
+      <ArrowUpRight :size="14" aria-hidden="true" />
+    </RouterLink>
+  </div>
+</template>
diff --git a/client/src/features/book-requests/components/ReleaseFileInspectionPanel.vue b/client/src/features/book-requests/components/ReleaseFileInspectionPanel.vue
new file mode 100644
index 000000000..a197f7b52
--- /dev/null
+++ b/client/src/features/book-requests/components/ReleaseFileInspectionPanel.vue
@@ -0,0 +1,166 @@
+<script setup lang="ts">
+import { computed } from 'vue'
+import { AudioLines, BookOpen, FileCheck2, FileWarning, Images, Loader2 } from '@lucide/vue'
+import { useI18n } from 'vue-i18n'
+import { releaseInspectionBlocksGrab } from '@bookorbit/types'
+import type { ReleaseFileInspection, ReleaseUnitSummary } from '@bookorbit/types'
+import { formatBytes } from '@/lib/formatting'
+
+const props = withDefaults(
+  defineProps<{
+    inspection: ReleaseFileInspection | null
+    loading: boolean
+    failed: boolean
+    /** What the tracker or the server said, where either said anything worth repeating. */
+    failureReason?: string | null
+  }>(),
+  { failureReason: null },
+)
+
+const { t } = useI18n()
+
+const blocked = computed(() => releaseInspectionBlocksGrab(props.inspection?.status))
+
+/** Only worth listing when it says something the file list does not: several books, or one in parts. */
+const showsUnits = computed(() => {
+  const inspection = props.inspection
+  return inspection !== null && (inspection.unitCount > 1 || (inspection.units[0]?.contentFileCount ?? 0) > 1)
+})
+
+/**
+ * Which of the two classes of file to mark, or neither where the list is all one class.
+ *
+ * Always marking the book files states the same thing at several times the volume: a release of
+ * three formats and a cover said "Book file" three times over, and the one row that mattered was
+ * the one saying nothing. The smaller group is marked, so the badge is always the exception.
+ */
+const marksFiles = computed<'book' | 'extra' | null>(() => {
+  const files = props.inspection?.files ?? []
+  const books = files.filter((file) => file.bookFile).length
+  const extras = files.length - books
+  if (books === 0 || extras === 0) return null
+  return books <= extras ? 'book' : 'extra'
+})
+
+const UNIT_ICONS = { ebook: BookOpen, audiobook: AudioLines, comic: Images } as const
+
+function summary(): string {
+  const inspection = props.inspection
+  if (!inspection) return ''
+
+  switch (inspection.status) {
+    case 'ready': {
+      const parts = inspection.units[0]?.contentFileCount ?? 1
+      return parts > 1
+        ? t('bookRequests.releases.manifest.multiPartBook', { count: parts })
+        : t('bookRequests.releases.manifest.ready', { count: inspection.totalFiles ?? inspection.files.length })
+    }
+    case 'no_supported_file':
+      return t('bookRequests.releases.manifest.noSupported')
+    case 'contents_unknown':
+      return t('bookRequests.releases.manifest.contentsUnknown')
+    case 'multiple_supported_files':
+      return t('bookRequests.releases.manifest.multipleBooks', { count: inspection.unitCount })
+    case 'metadata_unavailable':
+      return t('bookRequests.releases.manifest.metadataUnavailable')
+  }
+}
+
+function unitLabel(unit: ReleaseUnitSummary): string {
+  return unit.title ?? t('bookRequests.releases.manifest.untitledUnit')
+}
+
+/** The separator every other detail line in the picker uses, so one panel does not read differently. */
+const DETAIL_SEPARATOR = ' · '
+
+function unitDetail(unit: ReleaseUnitSummary): string {
+  const parts = [
+    t(`bookRequests.releases.manifest.mediaKind.${unit.mediaKind}`),
+    t('bookRequests.releases.manifest.unitFiles', { count: unit.contentFileCount }),
+    ...(unit.sizeBytes === null ? [] : [formatBytes(unit.sizeBytes)]),
+  ]
+  return parts.join(DETAIL_SEPARATOR)
+}
+
+function fileSize(sizeBytes: number | null): string | null {
+  return sizeBytes === null ? null : formatBytes(sizeBytes)
+}
+</script>
+
+<template>
+  <div class="mt-3 rounded-lg border border-border bg-background/60 p-3">
+    <p v-if="loading" role="status" class="flex items-center gap-2 text-xs text-muted-foreground">
+      <Loader2 class="size-3.5 animate-spin" aria-hidden="true" />
+      {{ t('bookRequests.releases.inspectingFiles') }}
+    </p>
+
+    <p v-else-if="failed" role="alert" class="flex items-start gap-2 text-xs text-destructive">
+      <FileWarning class="mt-0.5 size-3.5 shrink-0" aria-hidden="true" />
+      <span>
+        <!-- The tracker's own sentence where there is one: "VIP torrent and you are not VIP or
+             higher" says what to do next, where the generic line says only that something broke. -->
+        <span class="block">{{ props.failureReason ?? t('bookRequests.releases.inspectionFailed') }}</span>
+        <span class="mt-0.5 block text-muted-foreground">{{ t('bookRequests.releases.inspectionFailedHint') }}</span>
+      </span>
+    </p>
+
+    <template v-else-if="inspection">
+      <p :role="blocked ? 'alert' : 'status'" class="flex items-start gap-2 text-xs" :class="blocked ? 'text-destructive' : 'text-muted-foreground'">
+        <FileWarning v-if="blocked" class="mt-0.5 size-3.5 shrink-0" aria-hidden="true" />
+        <FileCheck2 v-else class="mt-0.5 size-3.5 shrink-0" aria-hidden="true" />
+        <span>{{ summary() }}</span>
+      </p>
+
+      <ul v-if="showsUnits" class="mt-2 space-y-1.5">
+        <li
+          v-for="(unit, unitIndex) in inspection.units"
+          :key="`${unitIndex}:${unit.title ?? ''}`"
+          class="flex min-w-0 items-start gap-2 rounded-md border border-border bg-card px-2.5 py-2 text-xs"
+        >
+          <component :is="UNIT_ICONS[unit.mediaKind]" class="mt-0.5 size-3.5 shrink-0 text-muted-foreground" aria-hidden="true" />
+          <span class="min-w-0 flex-1">
+            <span class="block break-words text-foreground">{{ unitLabel(unit) }}</span>
+            <span class="block text-muted-foreground">{{ unitDetail(unit) }}</span>
+          </span>
+        </li>
+      </ul>
+
+      <p v-if="showsUnits && inspection.unitCount > inspection.units.length" class="mt-2 text-xs text-muted-foreground">
+        {{ t('bookRequests.releases.manifest.unitsTruncated', { shown: inspection.units.length, total: inspection.unitCount }) }}
+      </p>
+
+      <ul v-if="inspection.files.length" class="mt-2 divide-y divide-border overflow-hidden rounded-md border border-border bg-card">
+        <li
+          v-for="(file, fileIndex) in inspection.files"
+          :key="`${fileIndex}:${file.path}`"
+          class="flex min-w-0 items-start gap-2 px-2.5 py-2 text-xs"
+        >
+          <span class="min-w-0 flex-1 break-all text-foreground">{{ file.path }}</span>
+          <span
+            v-if="marksFiles === 'book' && file.bookFile"
+            class="shrink-0 rounded-full border border-success/40 bg-success/10 px-1.5 py-px font-medium text-success"
+          >
+            {{ t('bookRequests.releases.manifest.bookFile') }}
+          </span>
+          <span
+            v-else-if="marksFiles === 'extra' && !file.bookFile"
+            class="shrink-0 rounded-full border border-border px-1.5 py-px text-muted-foreground"
+          >
+            {{ t('bookRequests.releases.manifest.extraFile') }}
+          </span>
+          <span v-if="fileSize(file.sizeBytes)" class="shrink-0 text-muted-foreground tabular-nums">{{ fileSize(file.sizeBytes) }}</span>
+        </li>
+      </ul>
+
+      <p v-if="inspection.truncated" class="mt-2 text-xs text-muted-foreground">
+        {{
+          t('bookRequests.releases.manifest.truncated', { shown: inspection.files.length, total: inspection.totalFiles ?? inspection.files.length })
+        }}
+      </p>
+
+      <p v-if="inspection.ignoredFileCount > 0" class="mt-2 text-xs text-muted-foreground">
+        {{ t('bookRequests.releases.manifest.ignored', { count: inspection.ignoredFileCount }) }}
+      </p>
+    </template>
+  </div>
+</template>
diff --git a/client/src/features/book-requests/components/ReleasePickerPanel.vue b/client/src/features/book-requests/components/ReleasePickerPanel.vue
new file mode 100644
index 000000000..b1537ac3e
--- /dev/null
+++ b/client/src/features/book-requests/components/ReleasePickerPanel.vue
@@ -0,0 +1,1284 @@
+<script setup lang="ts">
+import { computed, onMounted, ref, watch } from 'vue'
+import { useI18n } from 'vue-i18n'
+import { useRoute, useRouter } from 'vue-router'
+import {
+  ArrowUpRight,
+  ChevronDown,
+  ChevronUp,
+  CircleCheck,
+  CircleMinus,
+  Download,
+  Eye,
+  EyeOff,
+  Globe,
+  Loader2,
+  Magnet,
+  Pencil,
+  Plus,
+  RefreshCw,
+  Search,
+  SearchX,
+  TriangleAlert,
+  Zap,
+} from '@lucide/vue'
+import { Permission, releaseInspectionBlocksGrab } from '@bookorbit/types'
+import type { IndexerSearchFailure, ReleaseCandidateItem, ReleaseFileInspection, ReleaseSearchCriteria } from '@bookorbit/types'
+import { Button } from '@/components/ui/button'
+import { formatColorVar } from '@/features/book/lib/format-colors'
+import { formatDate, formatLanguageName } from '@/i18n/formatters'
+import { formatBytes } from '@/lib/formatting'
+import GrabReleaseDialog from './GrabReleaseDialog.vue'
+import ReleaseFileInspectionPanel from './ReleaseFileInspectionPanel.vue'
+import RequestCover from './RequestCover.vue'
+import RequestDrawerToolbar from './RequestDrawerToolbar.vue'
+import RequestEmptyState from './RequestEmptyState.vue'
+import EntityNotFound from '@/components/EntityNotFound.vue'
+import { formatKey, formatKeys, languageKey } from '../releaseFacets'
+import { requestFailureText } from '../requestOutcome'
+import { protocolChipClass, sourceChipClass } from '../sourceColors'
+import { useBookRequestActions } from '../composables/useBookRequests'
+import { useBookRequestDetail } from '../composables/useBookRequestDetail'
+import { useDownloadClientSummaries } from '../composables/useDownloadClients'
+import { useReleaseFacetGroups } from '../composables/useReleaseFacetGroups'
+import { useReleaseFilters } from '../composables/useReleaseFilters'
+import { useReleaseGrab } from '../composables/useReleaseGrab'
+import { useReleasePicker } from '../composables/useReleasePicker'
+import { useReleaseSearchEditor } from '../composables/useReleaseSearchEditor'
+import { usePermissions } from '@/features/auth/composables/usePermissions'
+
+const { t } = useI18n()
+const route = useRoute()
+const router = useRouter()
+
+const { hasPermission } = usePermissions()
+/** See `RequestDetailPanel`: an accessor, declared before the composables that read it. */
+const canManage = () => hasPermission(Permission.ManageBookRequests)
+
+const {
+  releases,
+  criteria,
+  indexers,
+  uncoveredIndexerCount,
+  enabledIndexerCount,
+  configuredIndexerCount,
+  profileActive,
+  cached,
+  loading,
+  loadFailed,
+  searched,
+  attempts,
+  inspections,
+  inspecting,
+  inspectionFailed,
+  fetchReleases,
+  inspectRelease,
+  reset,
+} = useReleasePicker(canManage)
+const { request, loading: requestLoading, error: requestError, fetchRequest, setRequest } = useBookRequestDetail()
+const { clients, fetchClients } = useDownloadClientSummaries(canManage)
+const actions = useBookRequestActions(canManage)
+
+/** Near-universal for spoken audio, so stating it on every row would be noise, not information. */
+const COMMON_SAMPLING_RATE_HZ = 44100
+/** How many clean sources are listed one by one before they collapse into their total. */
+const MAX_LISTED_SOURCES = 4
+
+const requestId = computed(() => Number(route.params.id))
+
+const filters = useReleaseFilters(releases)
+const { visibleReleases, hasFilter, showFacets, marksBest, tiedWithBest, clearFilters, resetFilters } = filters
+
+const expandedFiles = ref(new Set<string>())
+/**
+ * Null until the approver says otherwise: a search that found nothing opens the panel on its way
+ * out, one that worked leaves it shut. Their choice then holds for the rest of the visit, so a
+ * re-search never changes the panel's height under the pointer that started it.
+ */
+const searchPanelChoice = ref<boolean | null>(null)
+const showEachSource = ref(false)
+
+const {
+  searchEditing,
+  searchTitle,
+  searchAuthors,
+  searchIsbnOptions,
+  selectedSearchIsbn,
+  customSearchIsbn,
+  searchLanguage,
+  searchFormats,
+  searchEditError,
+  alternativeIsbns,
+  titleAuthorAttempt,
+  activeKeyText,
+  criteriaOverrides,
+  canonicalizeTypedIsbn,
+  toggleSearchEditor,
+  resetSearchEditor,
+  selectSearchIsbn,
+  selectTitleAuthorSearch,
+  addCustomSearchIsbn,
+  handleCustomSearchSubmit,
+  isbnKeyLabel,
+  runAlternativeIsbnSearch,
+  runTitleAuthorSearch,
+  resetSearchEditorState,
+} = useReleaseSearchEditor({ request, criteria, attempts, requestId, fetchReleases, beforeSearch: startFreshSearch })
+
+const { manualOpen, grabbing, openManual, closeManual, forgetRefusals, handleGrab, handleManualGrab, isRefused, refusalText } = useReleaseGrab({
+  request,
+  requestId,
+  grab: actions.grab,
+  setRequest,
+  inspectRelease,
+  setFilesExpanded,
+  seedsBack,
+})
+
+/**
+ * Every Send is off while one release is on its way, not only the row being inspected. The
+ * inspection is a tracker round trip, and until it answers no grab has been called for this
+ * request, so `actions` has nothing to be busy about yet.
+ */
+const busy = computed(() => grabbing.value || actions.isPending(request.value?.id))
+/** A retry is the same picker; only the framing changes, so the approver knows why it reopened. */
+const isRetry = computed(() => request.value?.status === 'failed')
+const failureText = computed(() => (request.value ? requestFailureText(request.value, (key, named) => t(key, named)) : null))
+const authorLine = computed(() => request.value?.authors.join(', ') ?? '')
+const localOnlyCriteriaFacts = computed(() => (criteria.value ? localOnlyFacts(criteria.value) : []))
+/**
+ * Adding a source or switching one back on happens under Settings > System > Requests, which is
+ * gated on managing settings. Gating this on managing requests pointed some approvers at a page
+ * the router would not open for them.
+ */
+const canFixSources = computed(() => hasPermission(Permission.ManageAppSettings))
+/**
+ * One line per searched source, saying what it was asked and what it gave back. The query alone
+ * was the old panel: it repeated the ISBN already stated above it, and stayed silent about the
+ * count, the rows the hard filters dropped, and the session that had expired.
+ */
+const sourceRows = computed<SourceRow[]>(() =>
+  indexers.value.map((indexer) => ({
+    id: indexer.indexerId,
+    name: indexer.indexerName,
+    query: indexer.query?.value ?? null,
+    echoesKey: indexer.query
+      ? indexer.query.kind === 'isbn'
+        ? indexer.query.value === criteria.value?.activeIsbn
+        : !criteria.value?.activeIsbn
+      : false,
+    isbnQuery: indexer.query?.kind === 'isbn',
+    ok: indexer.ok,
+    count: indexer.count,
+    filtered: indexer.filtered,
+    failure: indexer.failure ?? null,
+  })),
+)
+const failedSourceRows = computed(() => sourceRows.value.filter((row) => !row.ok))
+const cleanSourceRows = computed(() => sourceRows.value.filter((row) => row.ok))
+/**
+ * Past a handful of sources the transcript is what pushes the releases off the screen, so the ones
+ * with nothing to explain collapse into their total. Failures never collapse: they are the reason
+ * the list is worth reading at all.
+ */
+const sourcesCondensed = computed(() => !showEachSource.value && cleanSourceRows.value.length > MAX_LISTED_SOURCES)
+const listedSourceRows = computed(() => (sourcesCondensed.value ? failedSourceRows.value : sourceRows.value))
+const condensedReleaseCount = computed(() => cleanSourceRows.value.reduce((total, row) => total + row.count, 0))
+/** Nothing was searched at all, because nothing configured carries this medium. */
+const nothingCoversMedium = computed(() => indexers.value.length === 0 && uncoveredIndexerCount.value > 0)
+/**
+ * Nothing was searched because nothing is switched on. This is not a result about the book, and
+ * the panel used to report it as one: "Nothing found for 9781932382082" says the ISBN was tried
+ * and came back empty, when no request was ever made and the ISBN had nothing to do with it.
+ */
+const noSourcesEnabled = computed(() => searched.value && enabledIndexerCount.value === 0)
+/** Whether the fix is adding a source or switching one back on. Kept apart: one is a toggle. */
+const noSourcesConfigured = computed(() => noSourcesEnabled.value && configuredIndexerCount.value === 0)
+const noSourcesTitle = computed(() =>
+  t(noSourcesConfigured.value ? 'bookRequests.releases.noSourcesConfigured' : 'bookRequests.releases.noSourcesEnabled'),
+)
+const noSourcesHint = computed(() => {
+  if (!canFixSources.value) return t('bookRequests.releases.noSourcesAskAdmin')
+  return t(noSourcesConfigured.value ? 'bookRequests.releases.noSourcesConfiguredHint' : 'bookRequests.releases.noSourcesEnabledHint')
+})
+/**
+ * A profile is configured for this medium and not one release fell into any of its tiers. Worth
+ * saying outright, because the list looks completely normal: the rows are all still here, nothing
+ * is marked, and the only visible symptom is that the automation quietly grabs none of them.
+ */
+const nothingMatchedProfile = computed(
+  () => profileActive.value && releases.value.length > 0 && releases.value.every((release) => release.tier === null),
+)
+/**
+ * A search that ran and found nothing is stated by the panel itself, which is also where the next
+ * key to try lives. Repeating it below the list only put the explanation further from the fix.
+ */
+const searchFoundNothing = computed(
+  () => searched.value && !loading.value && releases.value.length === 0 && !nothingCoversMedium.value && !noSourcesEnabled.value,
+)
+const searchPanelOpen = computed(() => searchPanelChoice.value ?? searchFoundNothing.value)
+
+type CriteriaFact = { key: string; label: string; value: string }
+type SourceRow = {
+  id: number
+  name: string
+  /** The exact string sent, or null where no installed adapter matched this source. */
+  query: string | null
+  /** Whether it was handed the key stated above the list, so the row can say so in words. */
+  echoesKey: boolean
+  isbnQuery: boolean
+  ok: boolean
+  count: number
+  filtered: number
+  failure: IndexerSearchFailure | null
+}
+
+function localOnlyFacts(value: ReleaseSearchCriteria): CriteriaFact[] {
+  return [
+    {
+      key: 'mediaKind',
+      label: t('bookRequests.releases.criteria.mediaKind'),
+      value: t(`bookRequests.mediaKind.${value.mediaKind}`),
+    },
+    ...(value.language ? [{ key: 'language', label: t('bookRequests.releases.criteria.language'), value: formatLanguageName(value.language) }] : []),
+    ...(value.authors.length > 1
+      ? [{ key: 'additionalAuthors', label: t('bookRequests.releases.criteria.additionalAuthors'), value: value.authors.slice(1).join(', ') }]
+      : []),
+    ...(value.preferredFormats.length
+      ? [
+          {
+            key: 'formats',
+            label: t('bookRequests.releases.criteria.formats'),
+            value: value.preferredFormats.map((format) => format.toUpperCase()).join(', '),
+          },
+        ]
+      : []),
+  ]
+}
+
+/**
+ * A value every release shares tells the approver nothing about which one to pick, so it is
+ * stated once above the list and dropped from the rows. Searching Project Gutenberg for one book
+ * returns eight EPUBs, all freeleech, all from the same indexer: four of the old nine columns
+ * were constant, and the two that actually differed were the two being crushed for space.
+ */
+function sharedValue<T>(read: (release: ReleaseCandidateItem) => T | null): T | null {
+  const [head] = releases.value
+  if (!head) return null
+  const first = read(head)
+  if (first === null) return null
+  return releases.value.every((release) => read(release) === first) ? first : null
+}
+
+/** Keyed by source because the assigned colour belongs to the configured source, not a release. */
+const colorByIndexer = computed(() => new Map(indexers.value.map((indexer) => [indexer.indexerId, indexer.color])))
+const sharedLanguage = computed(() => sharedValue((release) => languageKey(release.language)))
+/**
+ * Only where every release is that one format and nothing else. A release carrying three formats
+ * has no single one to be summarised by, and hoisting its first into "all EPUB" would state
+ * something about the other two that is not true.
+ */
+const sharedFormat = computed(() => sharedValue((release) => (release.formats.length === 1 ? formatKey(release.format) : null)))
+const sharedIndexerId = computed(() => sharedValue((release) => release.indexerId))
+const sharedIndexer = computed(() => sharedValue((release) => release.indexerName))
+const sharedIndexerClass = computed(() => sourceChipClass(colorByIndexer.value.get(sharedIndexerId.value ?? -1)))
+const allFreeleech = computed(() => releases.value.length > 0 && releases.value.every((release) => release.freeleech))
+
+const summaryFacts = computed(() => {
+  const facts: string[] = []
+  if (allFreeleech.value) facts.push(t('bookRequests.releases.allFreeleech'))
+  if (sharedLanguage.value) facts.push(t('bookRequests.releases.allLanguage', { language: sharedLanguage.value }))
+  if (sharedFormat.value) facts.push(t('bookRequests.releases.allFormat', { format: sharedFormat.value }))
+  return facts
+})
+
+/**
+ * Whether each searched source joins a swarm at all, which is a property of the adapter and not
+ * of any one release. Without it the panel could only guess from the list, and a single tracker
+ * reporting seeders made every Library Genesis row read "seeders unknown" - which was not the
+ * source omitting a count, but a plain HTTP library that has no swarm to count.
+ */
+const swarmByIndexer = computed(() => new Map(indexers.value.map((indexer) => [indexer.indexerId, indexer.seedsBack])))
+
+const { facetGroups } = useReleaseFacetGroups(filters, colorByIndexer, allFreeleech)
+
+/** Only what separates this release from the others; the rest is already in the summary line. */
+const expandedScores = ref(new Set<string>())
+
+/**
+ * One fact in a row's metadata run. `parts` because a format fact is several values at once and
+ * the requested one among them is emphasised, while every other fact is a single string.
+ */
+interface MetaFact {
+  key: string
+  parts: Array<{ text: string; emphasis: boolean }>
+  /** Aligns digits between rows, for the facts that are numbers rather than names. */
+  numeric?: boolean
+}
+
+onMounted(async () => {
+  await Promise.all([fetchRequest(requestId.value), fetchClients()])
+  if (Number.isInteger(requestId.value)) void fetchInitialReleases(requestId.value)
+})
+
+watch(requestId, (id) => {
+  if (!Number.isInteger(id)) return
+  reset()
+  resetSearchEditorState()
+  searchPanelChoice.value = null
+  showEachSource.value = false
+  expandedFiles.value = new Set()
+  resetFilters()
+  void fetchRequest(id)
+  void fetchInitialReleases(id)
+})
+
+function releaseKey(release: ReleaseCandidateItem): string {
+  return `${release.indexerId}:${release.guid}`
+}
+
+/** Rank has to be legible before the number is read, so the score carries a band. */
+function scoreClass(score: number): string {
+  if (score >= 70) return 'text-success'
+  if (score >= 55) return 'text-info'
+  if (score >= 40) return 'text-warning'
+  return 'text-muted-foreground'
+}
+
+/** The band has to read before the number does, so the score carries a tinted surface too. */
+function scoreSurfaceClass(score: number): string {
+  if (score >= 70) return 'border-success/45 bg-success/10'
+  if (score >= 55) return 'border-info/45 bg-info/10'
+  if (score >= 40) return 'border-warning/45 bg-warning/10'
+  return 'border-border bg-muted'
+}
+
+function isBest(index: number): boolean {
+  return marksBest.value && index === 0
+}
+
+function isExpanded(release: ReleaseCandidateItem): boolean {
+  return expandedScores.value.has(releaseKey(release))
+}
+
+function filesAreExpanded(release: ReleaseCandidateItem): boolean {
+  return expandedFiles.value.has(releaseKey(release))
+}
+
+function inspectionFor(release: ReleaseCandidateItem): ReleaseFileInspection | null {
+  return inspections.value.get(releaseKey(release)) ?? null
+}
+
+function isInspecting(release: ReleaseCandidateItem): boolean {
+  return inspecting.value.has(releaseKey(release))
+}
+
+function inspectionHasFailed(release: ReleaseCandidateItem): boolean {
+  return inspectionFailed.value.has(releaseKey(release))
+}
+
+/** What the tracker said, where it said anything. Null falls back to the generic copy. */
+function inspectionFailureReason(release: ReleaseCandidateItem): string | null {
+  return inspectionFailed.value.get(releaseKey(release)) ?? null
+}
+
+function inspectionBlocksSend(release: ReleaseCandidateItem): boolean {
+  return releaseInspectionBlocksGrab(inspectionFor(release)?.status)
+}
+
+function setFilesExpanded(release: ReleaseCandidateItem, expanded: boolean): void {
+  const key = releaseKey(release)
+  const next = new Set(expandedFiles.value)
+  if (expanded) next.add(key)
+  else next.delete(key)
+  expandedFiles.value = next
+}
+
+async function toggleFiles(release: ReleaseCandidateItem): Promise<void> {
+  if (filesAreExpanded(release)) {
+    setFilesExpanded(release, false)
+    return
+  }
+
+  setFilesExpanded(release, true)
+  await inspectRelease(requestId.value, release)
+}
+
+function toggleWhy(release: ReleaseCandidateItem) {
+  const key = releaseKey(release)
+  const next = new Set(expandedScores.value)
+  if (!next.delete(key)) next.add(key)
+  expandedScores.value = next
+}
+
+/**
+ * A swarm source always states its position, "unknown" included: on a tracker that really is the
+ * release omitting a count, and worth the approver's attention. A source that serves the file
+ * itself says nothing, because there is nothing there to be unknown about.
+ */
+function showsSeeders(release: ReleaseCandidateItem): boolean {
+  return seedsBack(release)
+}
+
+/** Falls back to the release's own evidence only if the status list somehow omits its indexer. */
+function seedsBack(release: ReleaseCandidateItem): boolean {
+  return swarmByIndexer.value.get(release.indexerId) ?? release.seeders !== null
+}
+
+function indexerChipClass(release: ReleaseCandidateItem): string {
+  return sourceChipClass(colorByIndexer.value.get(release.indexerId))
+}
+
+/**
+ * The chip's own colour, from a per-theme token rather than a fixed hex: the palette this replaced
+ * was one set of values for both themes, and the brightest of them was around 1.9:1 on a light
+ * surface. The tint and the border are mixed toward transparent, which is alpha on a fill and a
+ * border rather than on the text.
+ */
+function formatFacetStyle(value: string, active: boolean): Record<string, string> {
+  const color = formatColorVar(value)
+  return {
+    color,
+    borderColor: active ? color : `color-mix(in oklch, ${color} 40%, transparent)`,
+    backgroundColor: `color-mix(in oklch, ${color} ${active ? '20%' : '10%'}, transparent)`,
+  }
+}
+
+/**
+ * The audio line, built only from what the indexer actually stated. Sampling rate joins it only
+ * when it departs from the usual 44.1 kHz, which is the only time it tells the reader anything.
+ */
+function audioParts(release: ReleaseCandidateItem): string[] {
+  const audio = release.audio
+  if (!audio) return []
+
+  const parts: string[] = []
+  if (audio.bitrateKbps !== null) {
+    parts.push(audio.bitrateMode ? `${audio.bitrateKbps}k ${audio.bitrateMode}` : `${audio.bitrateKbps}k`)
+  }
+  if (audio.channels !== null) parts.push(t(`bookRequests.releases.channels.${audio.channels === 1 ? 'mono' : 'stereo'}`))
+  if (audio.samplingRateHz !== null && audio.samplingRateHz !== COMMON_SAMPLING_RATE_HZ) {
+    parts.push(`${Math.round(audio.samplingRateHz / 100) / 10} kHz`)
+  }
+  if (audio.durationSeconds !== null) parts.push(formatDuration(audio.durationSeconds))
+  if (audio.chapterCount !== null) parts.push(t('bookRequests.releases.chapterCountPlural', { count: audio.chapterCount }))
+  return parts
+}
+
+function formatDuration(seconds: number): string {
+  const hours = Math.floor(seconds / 3600)
+  const minutes = Math.round((seconds % 3600) / 60)
+  return hours > 0 ? t('bookRequests.releases.durationHm', { hours, minutes }) : t('bookRequests.releases.durationM', { minutes })
+}
+
+/**
+ * What actually separates one release from another. A signal every release shares, such as the
+ * same title match, costs a line of attention and settles nothing, so only penalties stay inline.
+ */
+function penalties(release: ReleaseCandidateItem): ReleaseCandidateItem['reasons'] {
+  return release.reasons.filter((reason) => reason.points < 0)
+}
+
+function credits(release: ReleaseCandidateItem): ReleaseCandidateItem['reasons'] {
+  return release.reasons.filter((reason) => reason.points > 0)
+}
+
+function reasonText(reason: ReleaseCandidateItem['reasons'][number]): string {
+  return t(`bookRequests.releases.reasons.${reason.code}`, { detail: reason.detail ?? '' })
+}
+
+function reasonPoints(points: number): string {
+  return points > 0 ? `+${points}` : String(points)
+}
+
+/**
+ * The row's facts as one ordered run, so the template can separate them instead of relying on a
+ * gap between six spans of identical muted text to say where one fact ends and the next begins.
+ *
+ * Facts already stated once above the list are dropped here rather than repeated per row.
+ */
+function metaFacts(release: ReleaseCandidateItem): MetaFact[] {
+  const facts: MetaFact[] = []
+  if (release.language && !sharedLanguage.value) {
+    facts.push({ key: 'language', parts: [{ text: formatLanguageName(release.language), emphasis: true }] })
+  }
+  if (release.formats.length > 0 && !sharedFormat.value) {
+    facts.push({ key: 'format', parts: formatKeys(release).map((value) => ({ text: value, emphasis: isPreferredFormat(value) })) })
+  }
+  if (release.sizeBytes) facts.push({ key: 'size', numeric: true, parts: [{ text: formatBytes(release.sizeBytes), emphasis: false }] })
+  if (release.fileCount !== null) {
+    facts.push({
+      key: 'files',
+      numeric: true,
+      // A single file is the shape an approver hunting an audiobook is usually after, so it carries
+      // the emphasis rather than being one more grey number in the run.
+      parts: [{ text: t('bookRequests.releases.fileCount', { count: release.fileCount }), emphasis: release.fileCount === 1 }],
+    })
+  }
+  if (showsSeeders(release)) facts.push({ key: 'seeders', numeric: true, parts: [{ text: seederText(release), emphasis: false }] })
+  if (release.publishedAt) {
+    facts.push({ key: 'added', numeric: true, parts: [{ text: formatDate(new Date(release.publishedAt)), emphasis: false }] })
+  }
+  return facts
+}
+
+/**
+ * A release carrying three formats is labelled with all three, so the one the request asked for
+ * has to be findable among them. It leads the list already; this is what says why it leads.
+ */
+function isPreferredFormat(value: string): boolean {
+  return (criteria.value?.preferredFormats ?? []).some((preferred) => preferred.toUpperCase() === value)
+}
+
+function seederText(release: ReleaseCandidateItem): string {
+  return release.seeders === null
+    ? t('bookRequests.releases.seederCountUnknown')
+    : t('bookRequests.releases.seederCountPlural', { count: release.seeders })
+}
+
+/** Back is one level, not the whole drawer: the request this picker was opened for is behind it. */
+function goBack() {
+  void router.push({ name: 'book-request-detail', params: { id: requestId.value }, query: route.query })
+}
+
+/** What a new list invalidates: the rows opened against the old one, and what it was refused. */
+function startFreshSearch(): void {
+  expandedFiles.value = new Set()
+  forgetRefusals()
+}
+
+function handleRefresh() {
+  startFreshSearch()
+  if (!Number.isInteger(requestId.value)) return
+  if (criteria.value) void fetchReleases(requestId.value, { overrides: criteriaOverrides(criteria.value) })
+  else void fetchReleases(requestId.value, { refresh: true })
+}
+
+function fetchInitialReleases(id: number): void {
+  const routeIsbn = typeof route.query.isbn === 'string' ? canonicalizeTypedIsbn(route.query.isbn) : null
+  if (routeIsbn) {
+    void fetchReleases(id, { overrides: { isbn: routeIsbn } })
+    return
+  }
+  if (route.query.search === 'title-author') {
+    void fetchReleases(id, { overrides: { isbn: null } })
+    return
+  }
+  void fetchReleases(id)
+}
+
+function toggleSearchPanel(): void {
+  searchPanelChoice.value = !searchPanelOpen.value
+}
+
+function showEverySource(): void {
+  showEachSource.value = true
+}
+</script>
+
+<template>
+  <div class="@container flex h-full min-h-0 flex-col">
+    <RequestDrawerToolbar leading="back" @back="goBack">
+      <template #title>
+        <p class="truncate text-sm font-medium text-foreground">
+          {{ isRetry ? t('bookRequests.releases.retryTitle') : t('bookRequests.releases.title') }}
+        </p>
+      </template>
+      <template #actions>
+        <Button variant="ghost" size="sm" :disabled="loading" @click="handleRefresh">
+          <RefreshCw :size="14" aria-hidden="true" />
+          {{ t('bookRequests.releases.refresh') }}
+        </Button>
+        <Button variant="ghost" size="sm" @click="openManual">{{ t('bookRequests.releases.manual') }}</Button>
+      </template>
+    </RequestDrawerToolbar>
+
+    <div class="min-h-0 flex-1 overflow-y-auto px-4 py-4">
+      <div v-if="requestLoading" role="status" class="flex items-center gap-2 text-sm text-muted-foreground">
+        <Loader2 class="size-4 animate-spin" aria-hidden="true" />
+        {{ t('bookRequests.detail.loading') }}
+      </div>
+
+      <EntityNotFound v-else-if="requestError === 'notFound' || requestError === 'forbidden'" :entity="t('bookRequests.detail.entityName')" />
+
+      <p v-else-if="requestError" role="alert" class="text-sm text-destructive">{{ t(`bookRequests.detail.errors.${requestError}`) }}</p>
+
+      <template v-else-if="request">
+        <!-- The stage is named in the toolbar, so what is left here is the book being grabbed for. -->
+        <header class="flex items-center gap-3.5">
+          <RequestCover :src="request.coverUrl" :media-kind="request.mediaKind" class="h-[72px] w-12 shadow-sm" :icon-size="20" />
+
+          <div class="min-w-0 flex-1">
+            <h2 class="truncate text-base font-semibold tracking-tight text-foreground">{{ request.title }}</h2>
+            <p class="mt-0.5 truncate text-sm text-muted-foreground">
+              {{ authorLine || t('bookRequests.detail.unknownAuthor') }}
+              <template v-if="request.publishedYear">
+                &middot; <span class="tabular-nums">{{ request.publishedYear }}</span>
+              </template>
+            </p>
+          </div>
+        </header>
+
+        <p v-if="isRetry && failureText" class="mt-3 text-sm text-muted-foreground">
+          {{ t('bookRequests.releases.previousFailure', { reason: failureText }) }}
+        </p>
+
+        <!--
+          Hidden entirely while no source is enabled, rather than headed with a different sentence.
+          Every part of it - the key, the local filters, the alternate keys to try next - describes
+          a search, and offering to change the terms of one that will not run is the same lie in a
+          quieter voice. The empty state below says what actually happened.
+        -->
+        <section
+          v-if="criteria && !noSourcesEnabled"
+          class="mt-3 rounded-lg border border-border bg-muted/40 p-3"
+          :aria-label="t('bookRequests.releases.criteria.label')"
+        >
+          <div class="flex items-start justify-between gap-3">
+            <!--
+              One key, stated once. The old panel said it three times: in the hint sentence, in a
+              chip, and again in every per-indexer card underneath.
+            -->
+            <i18n-t
+              v-if="searchFoundNothing"
+              keypath="bookRequests.releases.criteria.nothingFound"
+              tag="p"
+              scope="global"
+              class="min-w-0 text-sm font-medium text-foreground"
+            >
+              <template #key>
+                <span :class="criteria.activeIsbn && 'font-mono tabular-nums'">{{ activeKeyText }}</span>
+              </template>
+            </i18n-t>
+            <p v-else class="flex min-w-0 items-center gap-2 text-sm">
+              <Search :size="14" class="shrink-0 text-muted-foreground" aria-hidden="true" />
+              <span class="shrink-0 text-muted-foreground">
+                {{ t(criteria.activeIsbn ? 'bookRequests.releases.criteria.searched' : 'bookRequests.releases.criteria.searchedTitleAuthor') }}
+              </span>
+              <span class="truncate text-foreground" :class="criteria.activeIsbn && 'font-mono tabular-nums'" :title="activeKeyText">
+                {{ activeKeyText }}
+              </span>
+            </p>
+
+            <Button
+              type="button"
+              variant="ghost"
+              size="sm"
+              class="h-7 shrink-0 px-2 text-xs"
+              :aria-expanded="searchPanelOpen"
+              aria-controls="release-search-options"
+              @click="toggleSearchPanel"
+            >
+              {{ searchPanelOpen ? t('bookRequests.releases.criteria.closeSearch') : t('bookRequests.releases.criteria.changeSearch') }}
+              <ChevronUp v-if="searchPanelOpen" :size="13" aria-hidden="true" />
+              <ChevronDown v-else :size="13" aria-hidden="true" />
+            </Button>
+          </div>
+
+          <!--
+            Kept visible rather than folded away: this is the only place that separates a source
+            that found nothing from one whose session expired, and those need opposite fixes.
+          -->
+          <ul v-if="sourceRows.length" class="mt-2.5 space-y-1" :aria-label="t('bookRequests.releases.criteria.sources')">
+            <li v-if="sourcesCondensed" class="flex flex-wrap items-center gap-x-2 gap-y-0.5 text-xs">
+              <CircleCheck :size="13" class="shrink-0 text-success" aria-hidden="true" />
+              <span class="font-medium text-foreground">
+                {{ t('bookRequests.releases.criteria.sourcesSearched', { count: cleanSourceRows.length }) }}
+              </span>
+              <Button type="button" variant="ghost" size="sm" class="h-5 px-1.5 text-xs" @click="showEverySource">
+                {{ t('bookRequests.releases.criteria.showEachSource') }}
+              </Button>
+              <span class="ms-auto tabular-nums text-foreground">
+                {{ t('bookRequests.releases.criteria.sourceReleases', { count: condensedReleaseCount }) }}
+              </span>
+            </li>
+
+            <li v-for="row in listedSourceRows" :key="row.id" class="flex flex-wrap items-center gap-x-2 gap-y-0.5 text-xs">
+              <TriangleAlert v-if="!row.ok" :size="13" class="shrink-0 text-warning" aria-hidden="true" />
+              <CircleCheck v-else-if="row.count > 0" :size="13" class="shrink-0 text-success" aria-hidden="true" />
+              <CircleMinus v-else :size="13" class="shrink-0 text-muted-foreground" aria-hidden="true" />
+
+              <span class="shrink-0 font-medium text-foreground">{{ row.name }}</span>
+              <span v-if="row.echoesKey" class="text-muted-foreground">
+                {{
+                  t(row.isbnQuery ? 'bookRequests.releases.criteria.sourceSearchedIsbn' : 'bookRequests.releases.criteria.sourceSearchedTitleAuthor')
+                }}
+              </span>
+              <span v-else-if="row.query" class="min-w-0 truncate font-mono text-muted-foreground" :title="row.query">{{ row.query }}</span>
+              <span v-else class="text-muted-foreground">{{ t('bookRequests.releases.criteria.sourceNoAdapter') }}</span>
+
+              <span class="ms-auto flex shrink-0 items-center gap-2">
+                <Loader2 v-if="loading" class="size-3 animate-spin text-muted-foreground" aria-hidden="true" />
+                <template v-else-if="!row.ok">
+                  <span class="text-warning">{{ t(`bookRequests.releases.failures.${row.failure ?? 'error'}`) }}</span>
+                  <!-- The one failure with a specific fix, rather than a re-run of the same search. -->
+                  <RouterLink
+                    v-if="row.failure === 'unauthorized' && canFixSources"
+                    :to="{ name: 'settings-admin-requests' }"
+                    class="inline-flex items-center gap-0.5 text-foreground underline-offset-2 hover:underline"
+                  >
+                    {{ t('bookRequests.releases.criteria.fixSource') }}
+                    <ArrowUpRight :size="12" aria-hidden="true" />
+                  </RouterLink>
+                </template>
+                <template v-else>
+                  <span v-if="row.filtered" class="text-muted-foreground">
+                    {{ t('bookRequests.releases.criteria.sourceFiltered', { count: row.filtered }) }}
+                  </span>
+                  <span v-if="row.count > 0" class="tabular-nums text-foreground">
+                    {{ t('bookRequests.releases.criteria.sourceReleases', { count: row.count }) }}
+                  </span>
+                  <span v-else class="text-muted-foreground">{{ t('bookRequests.releases.criteria.sourceNone') }}</span>
+                </template>
+              </span>
+            </li>
+
+            <li v-if="uncoveredIndexerCount" class="ps-5 text-xs text-muted-foreground">
+              {{ t('bookRequests.releases.criteria.uncovered', { count: uncoveredIndexerCount }) }}
+            </li>
+          </ul>
+
+          <div v-if="searchPanelOpen" id="release-search-options" class="mt-2.5 border-t border-border pt-2.5">
+            <div class="flex items-center justify-between gap-3">
+              <h4 id="release-search-alternatives" class="text-xs font-medium text-muted-foreground">
+                {{ t('bookRequests.releases.criteria.searchInstead') }}
+              </h4>
+              <Button
+                type="button"
+                variant="ghost"
+                size="sm"
+                class="h-7 shrink-0 px-2 text-xs"
+                :aria-expanded="searchEditing"
+                @click="toggleSearchEditor"
+              >
+                <Pencil :size="13" aria-hidden="true" />
+                {{ searchEditing ? t('bookRequests.releases.criteria.closeEditor') : t('bookRequests.releases.criteria.editFields') }}
+              </Button>
+            </div>
+
+            <!--
+              One axis, not two lists: the key the search ran under is stated above, and these are
+              the other keys it could run under. A key already spent this visit says what it
+              returned, because four alternates from one provider are otherwise indistinguishable.
+            -->
+            <div class="mt-1.5 flex flex-wrap gap-1.5" role="group" aria-labelledby="release-search-alternatives">
+              <Button
+                v-for="isbn in alternativeIsbns"
+                :key="isbn"
+                type="button"
+                variant="outline"
+                size="sm"
+                class="h-auto min-w-0 flex-col items-start gap-0 px-2.5 py-1.5"
+                :disabled="loading"
+                @click="runAlternativeIsbnSearch(isbn)"
+              >
+                <span class="font-mono text-xs tabular-nums">{{ isbn }}</span>
+                <span class="max-w-48 truncate text-[10px] font-normal text-muted-foreground">{{ isbnKeyLabel(isbn) }}</span>
+              </Button>
+              <Button
+                v-if="criteria.activeIsbn"
+                type="button"
+                variant="outline"
+                size="sm"
+                class="h-auto flex-col items-start gap-0 px-2.5 py-1.5"
+                :disabled="loading"
+                @click="runTitleAuthorSearch"
+              >
+                <span class="text-xs">{{ t('bookRequests.releases.criteria.searchWithoutIsbn') }}</span>
+                <span v-if="titleAuthorAttempt" class="text-[10px] font-normal text-muted-foreground">{{ titleAuthorAttempt }}</span>
+              </Button>
+            </div>
+
+            <!-- Never sent to a source, so changing one of these cannot surface a new release. -->
+            <div
+              v-if="localOnlyCriteriaFacts.length"
+              class="mt-2.5 flex flex-wrap items-center gap-1.5"
+              role="group"
+              aria-labelledby="release-search-local-criteria"
+            >
+              <h4 id="release-search-local-criteria" class="me-0.5 text-xs font-medium text-muted-foreground">
+                {{ t('bookRequests.releases.criteria.filteredLocally') }}
+              </h4>
+              <dl class="flex flex-wrap gap-1.5 text-xs">
+                <div
+                  v-for="fact in localOnlyCriteriaFacts"
+                  :key="fact.key"
+                  class="inline-flex min-w-0 rounded-full border border-border bg-background px-2 py-1"
+                >
+                  <dt class="font-medium text-muted-foreground">{{ fact.label }}:</dt>
+                  <dd class="ms-1 max-w-72 truncate text-foreground" :title="fact.value">{{ fact.value }}</dd>
+                </div>
+              </dl>
+            </div>
+
+            <form v-if="searchEditing" class="mt-3 space-y-3 border-t border-border pt-3" @submit="handleCustomSearchSubmit">
+              <div class="grid gap-3 sm:grid-cols-2">
+                <div class="space-y-1.5">
+                  <label for="release-search-title" class="text-xs font-medium text-foreground">
+                    {{ t('bookRequests.releases.criteria.title') }}
+                  </label>
+                  <input
+                    id="release-search-title"
+                    v-model="searchTitle"
+                    type="text"
+                    maxlength="500"
+                    class="h-9 w-full rounded-md border border-input bg-background px-3 text-sm text-foreground focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/40 focus-visible:outline-none"
+                  />
+                </div>
+
+                <div class="space-y-1.5">
+                  <label for="release-search-language" class="text-xs font-medium text-foreground">
+                    {{ t('bookRequests.releases.criteria.language') }}
+                  </label>
+                  <input
+                    id="release-search-language"
+                    v-model="searchLanguage"
+                    type="text"
+                    maxlength="20"
+                    class="h-9 w-full rounded-md border border-input bg-background px-3 text-sm text-foreground focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/40 focus-visible:outline-none"
+                    :placeholder="t('bookRequests.releases.criteria.languagePlaceholder')"
+                  />
+                </div>
+
+                <div class="space-y-1.5">
+                  <label for="release-search-authors" class="text-xs font-medium text-foreground">
+                    {{ t('bookRequests.releases.criteria.authorsEditor') }}
+                  </label>
+                  <textarea
+                    id="release-search-authors"
+                    v-model="searchAuthors"
+                    rows="3"
+                    maxlength="13000"
+                    class="w-full resize-y rounded-md border border-input bg-background px-3 py-2 text-sm text-foreground focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/40 focus-visible:outline-none"
+                    :placeholder="t('bookRequests.releases.criteria.authorsPlaceholder')"
+                  ></textarea>
+                </div>
+
+                <div class="space-y-1.5">
+                  <label for="release-search-formats" class="text-xs font-medium text-foreground">
+                    {{ t('bookRequests.releases.criteria.formats') }}
+                  </label>
+                  <input
+                    id="release-search-formats"
+                    v-model="searchFormats"
+                    type="text"
+                    maxlength="419"
+                    class="h-9 w-full rounded-md border border-input bg-background px-3 text-sm text-foreground focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/40 focus-visible:outline-none"
+                    :placeholder="t('bookRequests.releases.criteria.formatsPlaceholder')"
+                  />
+                </div>
+              </div>
+
+              <fieldset class="space-y-2">
+                <legend class="text-xs font-medium text-foreground">{{ t('bookRequests.releases.criteria.isbnSelection') }}</legend>
+                <p class="text-xs text-muted-foreground">{{ t('bookRequests.releases.criteria.isbnSelectionHint') }}</p>
+                <div v-if="searchIsbnOptions.length" class="flex flex-wrap gap-2">
+                  <label
+                    v-for="(isbn, index) in searchIsbnOptions"
+                    :key="isbn"
+                    :for="`release-search-isbn-${index}`"
+                    class="inline-flex cursor-pointer items-center gap-2 rounded-md border border-border bg-background px-2.5 py-1.5 text-xs text-foreground focus-within:border-ring focus-within:ring-[3px] focus-within:ring-ring/40"
+                  >
+                    <input
+                      :id="`release-search-isbn-${index}`"
+                      type="radio"
+                      name="release-search-isbn"
+                      class="size-3.5 accent-primary"
+                      :checked="selectedSearchIsbn === isbn"
+                      @change="selectSearchIsbn(isbn)"
+                    />
+                    <span class="font-mono">{{ isbn }}</span>
+                  </label>
+                </div>
+                <label
+                  for="release-search-without-isbn"
+                  class="inline-flex cursor-pointer items-center gap-2 rounded-md border border-border bg-background px-2.5 py-1.5 text-xs text-foreground focus-within:border-ring focus-within:ring-[3px] focus-within:ring-ring/40"
+                >
+                  <input
+                    id="release-search-without-isbn"
+                    type="radio"
+                    name="release-search-isbn"
+                    class="size-3.5 accent-primary"
+                    :checked="selectedSearchIsbn === null"
+                    @change="selectTitleAuthorSearch"
+                  />
+                  <span>{{ t('bookRequests.releases.criteria.noIsbnSelected') }}</span>
+                </label>
+                <div class="flex flex-col gap-2 sm:flex-row">
+                  <label for="release-search-custom-isbn" class="sr-only">{{ t('bookRequests.releases.criteria.customIsbn') }}</label>
+                  <input
+                    id="release-search-custom-isbn"
+                    v-model="customSearchIsbn"
+                    type="text"
+                    maxlength="20"
+                    class="h-9 min-w-0 flex-1 rounded-md border border-input bg-background px-3 font-mono text-sm text-foreground focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/40 focus-visible:outline-none"
+                    :placeholder="t('bookRequests.releases.criteria.customIsbnPlaceholder')"
+                  />
+                  <Button type="button" variant="outline" size="sm" @click="addCustomSearchIsbn">
+                    <Plus :size="14" aria-hidden="true" />
+                    {{ t('bookRequests.releases.criteria.addIsbn') }}
+                  </Button>
+                </div>
+              </fieldset>
+
+              <p class="text-xs text-muted-foreground">
+                {{ t('bookRequests.releases.criteria.fixedMedia', { media: t(`bookRequests.mediaKind.${criteria.mediaKind}`) }) }}
+              </p>
+              <p v-if="searchEditError" role="alert" class="text-xs text-destructive">{{ searchEditError }}</p>
+
+              <div class="flex flex-col-reverse gap-2 sm:flex-row sm:justify-end">
+                <Button type="button" variant="ghost" size="sm" @click="resetSearchEditor">
+                  {{ t('bookRequests.releases.criteria.useRequestFields') }}
+                </Button>
+                <Button type="submit" size="sm" :disabled="loading">
+                  <Loader2 v-if="loading" class="animate-spin" aria-hidden="true" />
+                  {{ t('bookRequests.releases.criteria.runSearch') }}
+                </Button>
+              </div>
+            </form>
+          </div>
+        </section>
+
+        <!-- Not while nothing was searched: "showing the last search" is the same claim again. -->
+        <p v-if="cached && !loading && !noSourcesEnabled" class="mt-3 text-xs text-muted-foreground">
+          {{ t('bookRequests.releases.cached') }}
+        </p>
+
+        <p v-if="loading" role="status" class="mt-5 flex items-center gap-2 text-sm text-muted-foreground">
+          <Loader2 class="size-4 animate-spin" aria-hidden="true" />
+          {{ t('bookRequests.releases.searching') }}
+        </p>
+
+        <!-- Otherwise a search that failed once leaves closing and reopening the picker as the fix. -->
+        <div v-else-if="loadFailed" role="alert" class="mt-5 flex flex-wrap items-center gap-3">
+          <p class="text-sm text-destructive">{{ t('bookRequests.releases.errors.loadFailed') }}</p>
+          <Button variant="outline" size="sm" @click="handleRefresh">{{ t('common.retry') }}</Button>
+        </div>
+
+        <template v-else>
+          <!--
+            Nothing was asked anything, so this is not a fact about the book. The fix is one of two
+            things and they are not interchangeable: an instance with three sources switched off
+            does not need a fourth.
+          -->
+          <RequestEmptyState v-if="noSourcesEnabled" :icon="SearchX" :title="noSourcesTitle" :message="noSourcesHint">
+            <Button v-if="canFixSources" variant="outline" size="sm" as-child>
+              <RouterLink :to="{ name: 'settings-admin-requests' }" class="inline-flex items-center justify-center gap-1.5">
+                {{ noSourcesConfigured ? t('bookRequests.releases.addSource') : t('bookRequests.releases.reviewSources') }}
+                <ArrowUpRight :size="14" aria-hidden="true" />
+              </RouterLink>
+            </Button>
+            <Button variant="ghost" size="sm" @click="openManual">{{ t('bookRequests.releases.manual') }}</Button>
+          </RequestEmptyState>
+
+          <!--
+            A medium nothing carries is the one empty state the panel above cannot explain: no
+            source was searched, so its list is empty too, and the fix is to add a source that
+            covers this kind of book rather than to try another key.
+          -->
+          <RequestEmptyState
+            v-else-if="releases.length === 0 && searched && nothingCoversMedium"
+            :icon="SearchX"
+            :title="t('bookRequests.releases.mediumUncovered')"
+            :message="t('bookRequests.releases.mediumUncoveredHint')"
+          >
+            <Button variant="outline" size="sm" :disabled="loading" @click="handleRefresh">
+              <RefreshCw :size="14" aria-hidden="true" />
+              {{ t('bookRequests.releases.refresh') }}
+            </Button>
+            <Button variant="ghost" size="sm" @click="openManual">{{ t('bookRequests.releases.manual') }}</Button>
+          </RequestEmptyState>
+
+          <template v-else-if="releases.length > 0">
+            <!--
+              Everything true of every release, said once. Four of the old nine columns were
+              constant on a single-indexer search, and dropping them gives the two that actually
+              differ the width the release title was being squeezed out of.
+            -->
+            <p class="mt-3.5 flex flex-wrap items-center gap-x-2 gap-y-1 text-xs text-muted-foreground">
+              <span class="font-medium text-foreground">{{ t('bookRequests.releases.summaryCount', { count: releases.length }) }}</span>
+              <template v-for="fact in summaryFacts" :key="fact">
+                <span aria-hidden="true" class="opacity-50">&middot;</span>
+                <span>{{ fact }}</span>
+              </template>
+              <template v-if="sharedIndexer">
+                <span aria-hidden="true" class="opacity-50">&middot;</span>
+                <span class="rounded-full border px-1.5 py-px font-medium" :class="sharedIndexerClass">
+                  {{ t('bookRequests.releases.allIndexer', { name: sharedIndexer }) }}
+                </span>
+              </template>
+            </p>
+
+            <p
+              v-if="nothingMatchedProfile"
+              role="status"
+              class="mt-3 flex items-start gap-2 rounded-lg border border-warning/40 bg-warning/10 p-3 text-xs text-foreground"
+            >
+              <TriangleAlert :size="14" class="mt-px shrink-0 text-warning" aria-hidden="true" />
+              <span class="settings-prose">{{ t('bookRequests.releases.noneMatchedProfile') }}</span>
+            </p>
+
+            <!--
+              Sort is one choice among a few, so it reads as a segmented control; the facets are
+              independent toggles, so they read as chips. Rendered flat rather than as the old
+              left rail, because the cards below need no column budget defended.
+            -->
+            <div v-if="showFacets" class="mt-3.5 flex flex-wrap items-center gap-x-4 gap-y-2.5">
+              <div v-for="group in facetGroups" :key="group.key" role="group" :aria-label="group.label" class="flex flex-wrap items-center gap-1.5">
+                <span class="text-[11px] font-semibold tracking-wide text-muted-foreground uppercase">{{ group.label }}</span>
+
+                <div v-if="group.key === 'sort'" class="flex rounded-lg bg-muted p-0.5">
+                  <button
+                    v-for="option in group.options"
+                    :key="option.id"
+                    type="button"
+                    class="rounded-md px-2.5 py-1 text-xs transition-colors focus-visible:ring-2 focus-visible:ring-ring focus-visible:outline-none motion-reduce:transition-none"
+                    :class="option.active ? 'bg-card text-foreground shadow-sm' : 'text-muted-foreground hover:text-foreground'"
+                    :aria-pressed="option.active"
+                    @click="option.select"
+                  >
+                    {{ option.label }}
+                  </button>
+                </div>
+
+                <template v-else>
+                  <button
+                    v-for="option in group.options"
+                    :key="option.id"
+                    type="button"
+                    class="flex items-center gap-1.5 rounded-full border px-2.5 py-0.5 text-xs transition-colors focus-visible:ring-2 focus-visible:ring-ring focus-visible:outline-none motion-reduce:transition-none"
+                    :class="[
+                      option.className ??
+                        (option.active
+                          ? 'border-primary bg-primary text-primary-foreground'
+                          : 'border-border text-muted-foreground hover:border-ring hover:text-foreground'),
+                      option.className && option.active && 'ring-2 ring-current ring-offset-1 ring-offset-background',
+                      group.key === 'format' && 'uppercase',
+                    ]"
+                    :style="group.key === 'format' ? formatFacetStyle(option.label, option.active) : undefined"
+                    :aria-pressed="option.active"
+                    @click="option.select"
+                  >
+                    <span class="min-w-0 truncate">{{ option.label }}</span>
+                    <span v-if="option.count !== null" class="tabular-nums opacity-75">{{ option.count }}</span>
+                  </button>
+                </template>
+              </div>
+
+              <Button v-if="hasFilter" variant="ghost" size="sm" @click="clearFilters">
+                {{ t('bookRequests.releases.clearFilters') }}
+              </Button>
+            </div>
+
+            <p
+              v-if="visibleReleases.length === 0"
+              role="status"
+              class="mt-4 rounded-lg border border-border bg-card p-4 text-sm text-muted-foreground"
+            >
+              {{ t('bookRequests.releases.filteredEmpty') }}
+            </p>
+
+            <!--
+              One shape for every release, including the best one. The old layout drew the winner
+              as a bordered box and its nearest rival as a bare numeral in a table cell, which
+              made two releases tied at the same score impossible to compare at a glance.
+            -->
+            <ul v-else class="mt-4 space-y-2" :aria-label="t('bookRequests.releases.tableCaption')">
+              <li
+                v-for="(release, index) in visibleReleases"
+                :key="releaseKey(release)"
+                class="rounded-xl border p-3 transition-colors motion-reduce:transition-none"
+                :class="isBest(index) ? 'border-primary/50 bg-primary/6 hover:bg-primary/10' : 'border-border bg-card hover:bg-accent/50'"
+              >
+                <div class="flex flex-wrap items-center gap-x-3 gap-y-3">
+                  <!--
+                    A basis, not just `flex-1`: growing from zero never exceeds the row, so the
+                    send button stayed on the line and squeezed the title down to one word per
+                    line on a phone. Given a real basis the button wraps under it instead.
+                  -->
+                  <div class="flex min-w-0 flex-1 basis-72 items-center gap-3">
+                    <!--
+                      The label is sr-only text rather than `aria-label`: a plain span is not a
+                      role that takes a name, so most screen reader and browser pairs ignore one
+                      there and announce the bare number with nothing saying what it counts.
+                    -->
+                    <span
+                      class="flex size-11 shrink-0 items-center justify-center rounded-lg border text-[15px] font-semibold tabular-nums"
+                      :class="[scoreClass(release.score), scoreSurfaceClass(release.score)]"
+                    >
+                      <span aria-hidden="true">{{ release.score }}</span>
+                      <span class="sr-only">{{ t('bookRequests.releases.scoreLabel', { score: release.score }) }}</span>
+                    </span>
+
+                    <div class="min-w-0 flex-1">
+                      <p v-if="isBest(index)" class="mb-0.5 flex flex-wrap items-center gap-x-2 gap-y-1">
+                        <span class="inline-flex items-center gap-1 text-[11px] font-semibold tracking-wide text-primary uppercase">
+                          <Zap :size="12" aria-hidden="true" />
+                          {{ t('bookRequests.releases.bestMatch') }}
+                        </span>
+                        <span v-if="tiedWithBest > 0" class="rounded-full border border-border px-2 py-px text-[11px] text-muted-foreground">
+                          {{ t('bookRequests.releases.tiedWithBest', { count: tiedWithBest }) }}
+                        </span>
+                      </p>
+
+                      <p class="line-clamp-2 text-sm font-medium text-foreground">{{ release.title }}</p>
+
+                      <!--
+                        Two runs, not one. The chips say where the release comes from and what
+                        grabbing it will do, which is categorical and the same on every row from
+                        one source; the text run below states this release's own numbers. Run
+                        together they were six spans of identical muted text with nothing but a
+                        gap to say where one fact ended and the next began.
+                      -->
+                      <div class="mt-1 flex flex-wrap items-center gap-1.5 text-xs">
+                        <span
+                          class="inline-flex items-center gap-1 rounded-full border px-1.5 py-px font-medium"
+                          :class="protocolChipClass(seedsBack(release))"
+                        >
+                          <Magnet v-if="seedsBack(release)" :size="11" aria-hidden="true" />
+                          <Globe v-else :size="11" aria-hidden="true" />
+                          {{ seedsBack(release) ? t('bookRequests.releases.protocol.torrent') : t('bookRequests.releases.protocol.directPill') }}
+                        </span>
+                        <!--
+                          Neutral until an operator says otherwise. There is no closed set of
+                          indexers to build a palette from, so no hue could be derived that stood
+                          for "MyAnonaMouse" in a way a reader could decode; one assigned in
+                          settings is decodable precisely because somebody chose it. The name still
+                          carries the identity on its own, so an uncoloured source loses nothing.
+                        -->
+                        <span v-if="!sharedIndexer" class="rounded-full border px-1.5 py-px font-medium" :class="indexerChipClass(release)">
+                          {{ release.indexerName }}
+                        </span>
+                        <!--
+                          The operator's own words for why this release ranks where it does. It
+                          leads the flags because it is the axis the list is ordered on, and a row
+                          whose position the score alone cannot explain needs it said.
+                        -->
+                        <span
+                          v-if="release.tierName"
+                          class="rounded-full border border-primary/45 bg-primary/10 px-1.5 py-px font-medium text-primary"
+                        >
+                          {{ release.tierName }}
+                        </span>
+                        <span
+                          v-if="release.alreadyGrabbed"
+                          class="rounded-full border border-border bg-muted px-1.5 py-px font-medium text-muted-foreground"
+                        >
+                          {{ t('bookRequests.releases.alreadyGrabbed') }}
+                        </span>
+                        <span
+                          v-if="release.vipOnly"
+                          class="rounded-full border border-warning/40 bg-warning/10 px-1.5 py-px font-medium text-warning"
+                        >
+                          {{ t('bookRequests.releases.vipOnly') }}
+                        </span>
+                        <span
+                          v-if="refusalText(release)"
+                          class="rounded-full border border-destructive/40 bg-destructive/10 px-1.5 py-px font-medium text-destructive"
+                        >
+                          {{ refusalText(release) }}
+                        </span>
+                        <span
+                          v-if="release.freeleech && !allFreeleech"
+                          class="rounded-full border border-success/40 bg-success/10 px-1.5 py-px font-medium text-success"
+                        >
+                          {{ t('bookRequests.releases.freeleech') }}
+                        </span>
+                      </div>
+
+                      <div class="mt-1 flex flex-wrap items-center gap-x-1.5 gap-y-0.5 text-xs text-muted-foreground">
+                        <template v-for="(fact, factIndex) in metaFacts(release)" :key="fact.key">
+                          <span v-if="factIndex > 0" aria-hidden="true">·</span>
+                          <span :class="fact.numeric && 'tabular-nums'">
+                            <template v-for="(part, partIndex) in fact.parts" :key="part.text">
+                              <span v-if="partIndex > 0" aria-hidden="true"> + </span>
+                              <span :class="part.emphasis && 'font-medium text-foreground'">{{ part.text }}</span>
+                            </template>
+                          </span>
+                        </template>
+
+                        <!--
+                          The credits are mostly signals every release shares, so shown inline
+                          they were the loudest thing on screen and the least decisive. Penalties
+                          stay out; the rest is one click away for whoever wants to audit it.
+                        -->
+                        <button
+                          v-if="credits(release).length"
+                          type="button"
+                          class="ms-1 rounded text-xs text-muted-foreground underline underline-offset-2 hover:text-foreground focus-visible:ring-2 focus-visible:ring-ring focus-visible:outline-none"
+                          :aria-expanded="isExpanded(release)"
+                          @click="toggleWhy(release)"
+                        >
+                          {{ t('bookRequests.releases.whyThisScore') }}
+                        </button>
+                      </div>
+
+                      <p v-if="audioParts(release).length" class="mt-0.5 text-xs text-muted-foreground">
+                        <span class="sr-only">{{ t('bookRequests.releases.audio') }}: </span>
+                        {{ audioParts(release).join(' · ') }}
+                      </p>
+
+                      <span
+                        v-for="penalty in penalties(release)"
+                        :key="penalty.code"
+                        class="mt-0.5 flex items-center gap-1.5 text-xs text-destructive"
+                      >
+                        <TriangleAlert :size="12" class="shrink-0" aria-hidden="true" />
+                        {{ reasonText(penalty) }} <span class="tabular-nums">{{ reasonPoints(penalty.points) }}</span>
+                      </span>
+
+                      <ul v-if="isExpanded(release)" class="mt-1.5 flex flex-wrap gap-1" :aria-label="t('bookRequests.releases.scoreBreakdown')">
+                        <li
+                          v-for="reason in credits(release)"
+                          :key="reason.code"
+                          class="rounded border border-border bg-muted px-1.5 py-0.5 text-xs text-muted-foreground"
+                        >
+                          {{ reasonText(reason) }} <span class="tabular-nums text-foreground">{{ reasonPoints(reason.points) }}</span>
+                        </li>
+                      </ul>
+                    </div>
+                  </div>
+
+                  <div class="ms-auto flex items-center gap-1.5">
+                    <Button variant="ghost" size="sm" :aria-expanded="filesAreExpanded(release)" @click="toggleFiles(release)">
+                      <EyeOff v-if="filesAreExpanded(release)" :size="14" aria-hidden="true" />
+                      <Eye v-else :size="14" aria-hidden="true" />
+                      {{ filesAreExpanded(release) ? t('bookRequests.releases.hideFiles') : t('bookRequests.releases.viewFiles') }}
+                    </Button>
+                    <Button
+                      :variant="isBest(index) ? 'default' : 'outline'"
+                      size="sm"
+                      :disabled="busy || isInspecting(release) || inspectionBlocksSend(release) || isRefused(release)"
+                      @click="handleGrab(release)"
+                    >
+                      <Loader2 v-if="isInspecting(release)" class="size-3.5 animate-spin" aria-hidden="true" />
+                      <Download v-else-if="isBest(index)" :size="14" aria-hidden="true" />
+                      {{
+                        isInspecting(release)
+                          ? t('bookRequests.releases.inspectingShort')
+                          : isBest(index)
+                            ? t('bookRequests.releases.grab')
+                            : t('bookRequests.releases.send')
+                      }}
+                    </Button>
+                  </div>
+                </div>
+
+                <ReleaseFileInspectionPanel
+                  v-if="filesAreExpanded(release)"
+                  :inspection="inspectionFor(release)"
+                  :loading="isInspecting(release)"
+                  :failed="inspectionHasFailed(release)"
+                  :failure-reason="inspectionFailureReason(release)"
+                />
+              </li>
+            </ul>
+            <p class="mt-3 text-xs text-muted-foreground">{{ t('bookRequests.releases.singleFileNote') }}</p>
+          </template>
+        </template>
+
+        <GrabReleaseDialog :request="manualOpen ? request : null" :clients="clients" :busy="busy" @close="closeManual" @grab="handleManualGrab" />
+      </template>
+    </div>
+  </div>
+</template>
diff --git a/client/src/features/book-requests/components/ReleaseUnitChooser.vue b/client/src/features/book-requests/components/ReleaseUnitChooser.vue
new file mode 100644
index 000000000..580061de1
--- /dev/null
+++ b/client/src/features/book-requests/components/ReleaseUnitChooser.vue
@@ -0,0 +1,68 @@
+<script setup lang="ts">
+import { ref } from 'vue'
+import { useI18n } from 'vue-i18n'
+import { AudioLines, BookOpen, Images, Loader2 } from '@lucide/vue'
+import type { ReleaseUnitChoice } from '@bookorbit/types'
+import { Button } from '@/components/ui/button'
+import { formatBytes } from '@/lib/formatting'
+
+const props = defineProps<{
+  units: ReleaseUnitChoice[]
+  busy: boolean
+}>()
+
+const emit = defineEmits<{ choose: [number] }>()
+
+const { t } = useI18n()
+
+/** Nothing is preselected: the whole point is that BookOrbit could not tell which one was wanted. */
+const selected = ref<number | null>(null)
+
+const UNIT_ICONS = { ebook: BookOpen, audiobook: AudioLines, comic: Images } as const
+
+function unitLabel(unit: ReleaseUnitChoice): string {
+  return unit.title ?? t('bookRequests.chooser.untitled')
+}
+
+function unitDetail(unit: ReleaseUnitChoice): string {
+  const parts = [t(`bookRequests.chooser.mediaKind.${unit.mediaKind}`), t('bookRequests.chooser.files', { count: unit.contentFileCount })]
+  if (unit.sizeBytes !== null) parts.push(formatBytes(unit.sizeBytes))
+  return parts.join(' · ')
+}
+
+function handleImport() {
+  if (selected.value !== null) emit('choose', selected.value)
+}
+</script>
+
+<template>
+  <section class="rounded-lg border border-border bg-card p-4" :aria-label="t('bookRequests.chooser.title')">
+    <h3 class="text-sm font-semibold text-foreground">{{ t('bookRequests.chooser.title') }}</h3>
+    <p class="mt-1 text-xs text-muted-foreground">{{ t('bookRequests.chooser.hint', { count: props.units.length }) }}</p>
+
+    <fieldset class="mt-3" :disabled="props.busy">
+      <legend class="sr-only">{{ t('bookRequests.chooser.title') }}</legend>
+
+      <div class="grid gap-1.5">
+        <label
+          v-for="unit in props.units"
+          :key="unit.index"
+          class="flex items-start gap-2.5 rounded-md border border-border p-2.5 transition-colors hover:border-primary/50"
+          :class="selected === unit.index ? 'border-primary bg-primary/5' : ''"
+        >
+          <input v-model="selected" type="radio" name="release-unit" class="mt-1 accent-primary" :value="unit.index" />
+          <component :is="UNIT_ICONS[unit.mediaKind]" class="mt-0.5 size-4 shrink-0 text-muted-foreground" aria-hidden="true" />
+          <span class="min-w-0 flex-1">
+            <span class="block break-words text-sm text-foreground">{{ unitLabel(unit) }}</span>
+            <span class="block text-xs text-muted-foreground">{{ unitDetail(unit) }}</span>
+          </span>
+        </label>
+      </div>
+    </fieldset>
+
+    <Button class="mt-3" :disabled="selected === null || props.busy" @click="handleImport">
+      <Loader2 v-if="props.busy" class="size-4 animate-spin" aria-hidden="true" />
+      {{ t('bookRequests.chooser.import') }}
+    </Button>
+  </section>
+</template>
diff --git a/client/src/features/book-requests/components/RequestAttemptsPanel.vue b/client/src/features/book-requests/components/RequestAttemptsPanel.vue
new file mode 100644
index 000000000..67c6d0f64
--- /dev/null
+++ b/client/src/features/book-requests/components/RequestAttemptsPanel.vue
@@ -0,0 +1,105 @@
+<script setup lang="ts">
+import { computed, watch } from 'vue'
+import { useI18n } from 'vue-i18n'
+import { ChevronDown, Globe, Loader2, Magnet } from '@lucide/vue'
+import type { BookRequestDownloadItem, BookRequestItem } from '@bookorbit/types'
+import { formatDate } from '@/i18n/formatters'
+import { formatBytes } from '@/lib/formatting'
+import { useRequestAttempts } from '../composables/useRequestAttempts'
+
+const props = defineProps<{
+  request: BookRequestItem
+  /** Moderating the queue, which decides whether the admin or the self-fulfil endpoint serves this. */
+  canManage: boolean
+}>()
+
+const { t } = useI18n()
+const { attempts, loading, failed, fetchAttempts, reset } = useRequestAttempts(() => props.canManage)
+
+/**
+ * Everything except the attempt the transfer section is already showing. Matched by id rather
+ * than dropped by position, so a request whose newest attempt is not the one on the row keeps it.
+ */
+const earlier = computed(() => attempts.value.filter((attempt) => attempt.id !== props.request.download?.id))
+
+/** Nothing to say until a request has been sent somewhere more than once. */
+const show = computed(() => loading.value || failed.value || earlier.value.length > 0)
+
+watch(
+  () => [props.request.id, props.request.download?.id, props.request.status] as const,
+  ([id]) => {
+    reset()
+    void fetchAttempts(id)
+  },
+  { immediate: true },
+)
+
+/**
+ * A refused attempt never reached a client, which is what the missing hash means. Calling that
+ * "download failed" would say something that did not happen: nothing was ever downloaded.
+ */
+function outcomeText(attempt: BookRequestDownloadItem): string {
+  if (attempt.status === 'failed' && attempt.clientHash === null) return t('bookRequests.attempts.refused')
+  return t(`bookRequests.download.status.${attempt.status}`)
+}
+
+function isRefusal(attempt: BookRequestDownloadItem): boolean {
+  return attempt.status === 'failed'
+}
+
+function seedsBack(attempt: BookRequestDownloadItem): boolean {
+  return attempt.source !== 'direct_url'
+}
+
+function facts(attempt: BookRequestDownloadItem): string[] {
+  const parts = [attempt.indexerName ?? t('bookRequests.attempts.handPicked')]
+  if (attempt.releaseSizeBytes !== null) parts.push(formatBytes(attempt.releaseSizeBytes))
+  parts.push(formatDate(new Date(attempt.createdAt), { dateStyle: 'medium', timeStyle: 'short' }))
+  return parts
+}
+</script>
+
+<template>
+  <details v-if="show" :key="request.id" class="group rounded-lg border border-border bg-card">
+    <summary
+      class="flex cursor-pointer list-none items-center justify-between gap-3 rounded-lg px-4 py-3 text-xs font-semibold tracking-wide text-foreground uppercase focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 focus-visible:ring-offset-background [&::-webkit-details-marker]:hidden"
+    >
+      {{ t('bookRequests.attempts.title') }}
+      <ChevronDown class="size-4 shrink-0 transition-transform group-open:rotate-180" aria-hidden="true" />
+    </summary>
+
+    <div class="px-4 pb-4">
+      <div v-if="loading" class="flex items-center gap-2 text-sm text-muted-foreground">
+        <Loader2 class="size-4 animate-spin" aria-hidden="true" />
+        {{ t('bookRequests.attempts.loading') }}
+      </div>
+
+      <p v-else-if="failed" role="alert" class="text-sm text-destructive">{{ t('bookRequests.attempts.loadFailed') }}</p>
+
+      <ul v-else class="space-y-2.5">
+        <li v-for="attempt in earlier" :key="attempt.id" class="text-sm">
+          <p class="flex flex-wrap items-center gap-x-2 gap-y-1">
+            <span
+              class="inline-flex items-center gap-1 rounded-full border px-1.5 py-px text-xs font-medium"
+              :class="isRefusal(attempt) ? 'border-destructive/40 bg-destructive/10 text-destructive' : 'border-border text-muted-foreground'"
+            >
+              <Magnet v-if="seedsBack(attempt)" :size="11" aria-hidden="true" />
+              <Globe v-else :size="11" aria-hidden="true" />
+              {{ outcomeText(attempt) }}
+            </span>
+            <span class="min-w-0 flex-1 truncate text-foreground">{{ attempt.releaseTitle }}</span>
+          </p>
+
+          <p class="mt-0.5 text-xs text-muted-foreground">
+            <template v-for="(fact, index) in facts(attempt)" :key="fact">
+              <span v-if="index > 0" aria-hidden="true"> · </span>
+              <span>{{ fact }}</span>
+            </template>
+          </p>
+
+          <p v-if="attempt.errorMessage" class="mt-0.5 text-xs text-destructive">{{ attempt.errorMessage }}</p>
+        </li>
+      </ul>
+    </div>
+  </details>
+</template>
diff --git a/client/src/features/book-requests/components/RequestCover.vue b/client/src/features/book-requests/components/RequestCover.vue
new file mode 100644
index 000000000..1e8466688
--- /dev/null
+++ b/client/src/features/book-requests/components/RequestCover.vue
@@ -0,0 +1,74 @@
+<script setup lang="ts">
+import { computed, ref, watch } from 'vue'
+import { BookOpen, Headphones, Images } from '@lucide/vue'
+import type { BookRequestMediaKind } from '@bookorbit/types'
+
+const props = withDefaults(
+  defineProps<{
+    src: string | null
+    fallbackSources?: string[]
+    sourceKey?: string
+    mediaKind: BookRequestMediaKind
+    /** Sizing lives with the caller, because a table thumbnail and a page header differ. */
+    class?: string
+    iconSize?: number
+  }>(),
+  { class: '', iconSize: 18 },
+)
+
+const MEDIA_ICONS = { ebook: BookOpen, audiobook: Headphones, comic: Images } as const
+
+/**
+ * Cover URLs come from metadata providers, so they point at hosts BookOrbit does not control and
+ * fail routinely. A bare `v-if="coverUrl"` only covers the null case: a URL that is present but
+ * dead renders as a transparent gap where the cover should be, which reads as a broken row.
+ */
+const failedIndex = ref(0)
+
+const emit = defineEmits<{
+  sourceChange: [payload: { key: string | undefined; src: string | null }]
+}>()
+
+const sources = computed(() =>
+  [props.src, ...(props.fallbackSources ?? [])]
+    .filter((src): src is string => Boolean(src))
+    .filter((src, index, values) => values.indexOf(src) === index),
+)
+const sourceSignature = computed(() => sources.value.join('\u0000'))
+
+const currentSrc = computed(() => sources.value[failedIndex.value] ?? null)
+
+watch(sourceSignature, () => {
+  failedIndex.value = 0
+})
+
+watch(
+  currentSrc,
+  (src) => {
+    emit('sourceChange', { key: props.sourceKey, src })
+  },
+  { immediate: true },
+)
+
+const showImage = computed(() => currentSrc.value !== null)
+const icon = computed(() => MEDIA_ICONS[props.mediaKind] ?? BookOpen)
+
+function handleError() {
+  failedIndex.value += 1
+}
+</script>
+
+<template>
+  <img
+    v-if="showImage"
+    :src="currentSrc ?? undefined"
+    alt=""
+    class="shrink-0 rounded border border-border bg-muted object-cover"
+    :class="props.class"
+    loading="lazy"
+    @error="handleError"
+  />
+  <div v-else class="flex shrink-0 items-center justify-center rounded border border-border bg-muted" :class="props.class" aria-hidden="true">
+    <component :is="icon" :size="iconSize" class="text-muted-foreground" />
+  </div>
+</template>
diff --git a/client/src/features/book-requests/components/RequestDetailPanel.vue b/client/src/features/book-requests/components/RequestDetailPanel.vue
new file mode 100644
index 000000000..7689d7631
--- /dev/null
+++ b/client/src/features/book-requests/components/RequestDetailPanel.vue
@@ -0,0 +1,976 @@
+<script setup lang="ts">
+import { computed, inject, onMounted, ref, watch } from 'vue'
+import { useI18n } from 'vue-i18n'
+import { useRoute, useRouter } from 'vue-router'
+import { toast } from 'vue-sonner'
+import {
+  BookOpen,
+  ChevronDown,
+  Ellipsis,
+  ExternalLink,
+  EyeOff,
+  FileText,
+  Headphones,
+  Images,
+  Library,
+  Loader2,
+  Search,
+  TriangleAlert,
+  Users,
+} from '@lucide/vue'
+import { isBookRequestFulfiller, isFulfillableBookRequestStatus, isGrabbableBookRequestStatus, Permission } from '@bookorbit/types'
+import type { BookCard, BookDockFile, BookRequestItem } from '@bookorbit/types'
+import { Button } from '@/components/ui/button'
+import ConfirmDialog from '@/components/ui/ConfirmDialog.vue'
+import { DropdownMenu, DropdownMenuContent, DropdownMenuItem, DropdownMenuTrigger } from '@/components/ui/dropdown-menu'
+import { Input } from '@/components/ui/input'
+import BookCoverImage from '@/features/book/components/BookCoverImage.vue'
+import EntityNotFound from '@/components/EntityNotFound.vue'
+import { useAuth } from '@/features/auth/composables/useAuth'
+import { usePermissions } from '@/features/auth/composables/usePermissions'
+import { useLibraries } from '@/features/library/composables/useLibraries'
+import { formatDateTime } from '@/i18n/formatters'
+import { formatBytes } from '@/lib/formatting'
+import RequestCover from './RequestCover.vue'
+import ReleaseUnitChooser from './ReleaseUnitChooser.vue'
+import RequestReviewPanel from './RequestReviewPanel.vue'
+import RequestDownloadProgress from './RequestDownloadProgress.vue'
+import RequestDrawerToolbar from './RequestDrawerToolbar.vue'
+import RequestPipeline from './RequestPipeline.vue'
+import RequestAttemptsPanel from './RequestAttemptsPanel.vue'
+import RequestSeedPanel from './RequestSeedPanel.vue'
+import RequestStatusBadge from './RequestStatusBadge.vue'
+import { useBookRequestActions, type ActionOutcome } from '../composables/useBookRequests'
+import { useBookRequestDetail } from '../composables/useBookRequestDetail'
+import { useBookRequestProgress } from '../composables/useBookRequestProgress'
+import { useCoalescedRefresh } from '../composables/useCoalescedRefresh'
+import { useFulfilmentPicker, type FulfilmentSource } from '../composables/useFulfilmentPicker'
+import { formatLanguageName } from '@/i18n/formatters'
+import { requestLanguageOptions, useRequestDestinationDefault } from '../composables/useRequestDestinationDefault'
+import { useRequestReview } from '../composables/useRequestReview'
+import { REQUEST_DRAWER } from '../requestDrawerContext'
+import { canCancelRequest, canDeleteRequest, canDismissRequest, canLeaveRequest, cancelStopsATransfer } from '../requestActions'
+import { requestFailureText } from '../requestOutcome'
+import { localizedRequestActionFailure } from '../requestActionFailure'
+import { currentRequestProgress, requestPresentationStatus } from '../requestPipeline'
+
+const { t, locale } = useI18n()
+const route = useRoute()
+const router = useRouter()
+const { hasPermission } = usePermissions()
+const { user } = useAuth()
+const drawer = inject(REQUEST_DRAWER, null)
+
+const MEDIA_ICONS = { ebook: BookOpen, audiobook: Headphones, comic: Images } as const
+
+/** The same window the list behind the drawer collapses its own refreshes into. */
+const CHANGE_REFRESH_WINDOW_MS = 400
+
+/**
+ * Accessor form of the moderator check, declared before the composables that take it: they read
+ * the reference at call time, and a `const` further down is still in its temporal dead zone.
+ * Composables cannot ask `usePermissions` themselves, because that reaches the router.
+ */
+const canManageFn = () => hasPermission(Permission.ManageBookRequests)
+
+const { request, loading, error, fetchRequest, setRequest } = useBookRequestDetail()
+const { libraries, fetchLibraries } = useLibraries()
+const { load: loadDefaultDestination, defaultFor: instanceDefaultFor, resolveDestination } = useRequestDestinationDefault()
+const { progressByRequest, onRequestsChanged, pruneSettledProgress } = useBookRequestProgress()
+const actions = useBookRequestActions(canManageFn)
+const picker = useFulfilmentPicker()
+const { review, fetchReview, reset: resetReview } = useRequestReview(canManageFn)
+
+const decisionNote = ref('')
+/**
+ * The offered list plus whatever this request already asks for, which is not always one of them: a
+ * metadata provider can seed a language the dropdown does not list. Without this the select would
+ * fall back to showing "any language" and quietly misdescribe the request.
+ */
+const languageOptions = computed(() => {
+  const options = requestLanguageOptions(locale.value)
+  const current = request.value?.language ?? null
+  if (current === null || options.some((option) => option.code === current)) return options
+  return [{ code: current, name: formatLanguageName(current) }, ...options]
+})
+const targetLibraryId = ref<number | null>(null)
+const targetFolderId = ref<number | null>(null)
+
+const requestId = computed(() => Number(route.params.id))
+const canManage = computed(() => hasPermission(Permission.ManageBookRequests))
+/**
+ * Fulfilment rights on *this* request, which is a different question from moderating the queue: a
+ * self-server drives the rows that are theirs to drive and nobody else's. Usually that is their
+ * own, but a submission that collided with somebody else's undriven request takes that row on
+ * instead, and `fulfillerUserId` is what records it. Mirrors `assertCanFulfil` on the server,
+ * which is what actually enforces it.
+ */
+const canFulfilThis = computed(
+  () =>
+    canManage.value ||
+    (hasPermission(Permission.BookRequestSelfFulfill) && request.value != null && isBookRequestFulfiller(request.value, user.value?.id)),
+)
+const busy = computed(() => actions.isPending(request.value?.id))
+const mediaIcon = computed(() => (request.value ? (MEDIA_ICONS[request.value.mediaKind] ?? BookOpen) : BookOpen))
+const authorLine = computed(() => request.value?.authors.join(', ') ?? '')
+/** Non-empty only while an attempt is held because its release turned out to hold several books. */
+const releaseUnits = computed(() => request.value?.download?.releaseUnits ?? [])
+const isHeld = computed(() => request.value?.status === 'needs_review')
+/**
+ * The panel restates the hold in full only when it has a score to show. With no score, or with
+ * the dock entry gone, the server's own sentence is the only record of why this stopped, so it
+ * stays. It also stays for every ordinary failure, which has no panel at all.
+ */
+const failureText = computed(() => (request.value ? requestFailureText(request.value, (key, named) => t(key, named)) : null))
+const showFailureReason = computed(() => failureText.value != null && !(isHeld.value && review.value?.verification != null))
+/** Only a request that stopped badly earns the destructive treatment; a hand-back is information. */
+const failureIsAlarming = computed(() => request.value?.status === 'failed' || request.value?.status === 'needs_review')
+/** Whoever is going to say it, the transfer line is not the one that should say it twice. */
+const showDownloadError = computed(() => !showFailureReason.value && !(isHeld.value && review.value !== null))
+const liveProgress = computed(() => {
+  if (!request.value) return null
+  return currentRequestProgress(request.value, progressByRequest.value[request.value.id])
+})
+const presentationStatus = computed(() => (request.value ? requestPresentationStatus(request.value, liveProgress.value) : null))
+
+const isPending = computed(() => request.value?.status === 'pending')
+const canDecide = computed(() => canManage.value && isPending.value)
+const canGrab = computed(() => canFulfilThis.value && request.value != null && isGrabbableBookRequestStatus(request.value.status))
+const showTransferRetry = computed(() => canGrab.value && request.value?.download?.status === 'failed')
+const canFulfill = computed(() => canManage.value && request.value != null && isFulfillableBookRequestStatus(request.value.status))
+const canCancel = computed(() =>
+  request.value ? canCancelRequest(request.value, user.value?.id ?? null, canManage.value, hasPermission(Permission.BookRequestSelfFulfill)) : false,
+)
+const canDismiss = computed(() => (request.value ? canDismissRequest(request.value) : false))
+const canDelete = computed(() => (request.value ? canDeleteRequest(request.value, canManage.value) : false))
+const canLeave = computed(() => (request.value ? canLeaveRequest(request.value, user.value?.id ?? null) : false))
+const hasMenuActions = computed(() => canDismiss.value || canLeave.value || canCancel.value || canDelete.value)
+const canApproveNow = computed(() => canDecide.value && !busy.value && targetLibraryId.value !== null)
+const showFooter = computed(() => canDecide.value || (canGrab.value && !showTransferRetry.value))
+
+const confirming = ref<'cancel' | 'cancelDownload' | 'delete' | 'leave' | 'discardImport' | null>(null)
+
+const CONFIRM_COPY = {
+  delete: { title: 'bookRequests.confirm.deleteTitle', label: 'bookRequests.actions.delete' },
+  leave: { title: 'bookRequests.confirm.leaveTitle', label: 'bookRequests.actions.leave' },
+  discardImport: { title: 'bookRequests.confirm.discardImportTitle', label: 'bookRequests.review.discard' },
+  cancelDownload: { title: 'bookRequests.confirm.cancelDownloadTitle', label: 'bookRequests.actions.cancelDownload' },
+  cancel: { title: 'bookRequests.confirm.cancelTitle', label: 'bookRequests.actions.cancel' },
+} as const
+
+const confirmTitle = computed(() => t(CONFIRM_COPY[confirming.value ?? 'cancel'].title))
+
+const confirmDescription = computed(() => {
+  if (confirming.value === 'delete') return t('bookRequests.confirm.deleteDescription')
+  if (confirming.value === 'leave') return t('bookRequests.confirm.leaveDescription')
+  if (confirming.value === 'discardImport') return t('bookRequests.confirm.discardImportDescription')
+  if (confirming.value === 'cancelDownload') return t('bookRequests.confirm.cancelDownloadDescription')
+  return request.value && cancelStopsATransfer(request.value)
+    ? t('bookRequests.confirm.cancelDescriptionWithDownload')
+    : t('bookRequests.confirm.cancelDescription')
+})
+
+const confirmLabel = computed(() => t(CONFIRM_COPY[confirming.value ?? 'cancel'].label))
+
+const selectedLibrary = computed(() => libraries.value.find((library) => library.id === targetLibraryId.value) ?? null)
+const folders = computed(() => selectedLibrary.value?.folders ?? [])
+const grabLabel = computed(() => (request.value?.status === 'failed' ? 'bookRequests.actions.retryRelease' : 'bookRequests.actions.grab'))
+
+const pickerResults = computed(() => (picker.source.value === 'book' ? picker.books.value : picker.dockFiles.value))
+const hasSearched = computed(() => picker.query.value.trim() !== '')
+
+onMounted(async () => {
+  await fetchRequest(requestId.value)
+  resetDestination()
+  void syncReview()
+})
+
+/** Only a held request has anything to review, and only somebody who can file it may read it. */
+async function syncReview(): Promise<void> {
+  if (!canFulfilThis.value || !isHeld.value || !request.value) {
+    resetReview()
+    return
+  }
+  await fetchReview(request.value.id)
+}
+
+/**
+ * Permissions arrive with the session, which on a hard load of `/requests/:id` lands after mount.
+ * Gating the fetch on `canManage` at mount alone leaves the approver with an empty destination
+ * select on exactly the load that went straight to a request.
+ */
+watch(
+  canManage,
+  (allowed) => {
+    if (!allowed) return
+    void fetchLibraries()
+    void loadDefaultDestination()
+    void syncReview()
+  },
+  { immediate: true },
+)
+
+// A status transition needs a fresh row, but the request already on screen stays mounted while it
+// arrives. Coalesced like the list behind it: approving thirty rows broadcasts thirty changes, and
+// answering each of them refetched this one request thirty times over.
+onRequestsChanged(
+  useCoalescedRefresh(() => {
+    if (!Number.isInteger(requestId.value)) return
+    void fetchRequest(requestId.value, { background: true }).then(syncReview)
+  }, CHANGE_REFRESH_WINDOW_MS),
+)
+
+// The fetched row is the authority once its attempt has settled; the last tick is then just noise.
+watch(request, (row) => {
+  if (row) pruneSettledProgress([row])
+})
+
+// Stepping to the next request keeps this component mounted and only swaps the id under it.
+watch(requestId, async (id) => {
+  if (!Number.isInteger(id)) return
+  picker.reset()
+  decisionNote.value = ''
+  resetReview()
+  await fetchRequest(id)
+  resetDestination()
+  void syncReview()
+})
+
+// Libraries can land after the panel has rendered, and an untouched picker still needs them.
+watch(libraries, () => {
+  if (targetLibraryId.value === null) resetDestination()
+})
+
+/** What approving without touching this would do, which is the instance default for its medium. */
+const unpickedDestinationLabel = computed(() => {
+  const fallback = instanceDefaultFor(request.value?.mediaKind ?? 'ebook')
+  return fallback.libraryName === null
+    ? t('bookRequests.detail.destinationLibraryPlaceholder')
+    : t('bookRequests.search.libraryDefault', { library: fallback.libraryName })
+})
+
+/** What the request already carries, or the only library there is. */
+function resetDestination() {
+  const carried = { libraryId: request.value?.targetLibraryId ?? null, folderId: request.value?.targetFolderId ?? null }
+  const destination = resolveDestination(libraries.value, carried)
+  targetLibraryId.value = destination.libraryId
+  targetFolderId.value = destination.folderId
+}
+
+function firstFolderId(libraryId: number | null): number | null {
+  if (libraryId === null) return null
+  return libraries.value.find((library) => library.id === libraryId)?.folders?.[0]?.id ?? null
+}
+
+function handleLibraryChange(event: Event) {
+  const value = Number((event.target as HTMLSelectElement).value)
+  targetLibraryId.value = Number.isInteger(value) && value > 0 ? value : null
+  // A folder from the library we just left would file the book back into it.
+  targetFolderId.value = firstFolderId(targetLibraryId.value)
+}
+
+function handleFolderChange(event: Event) {
+  const value = Number((event.target as HTMLSelectElement).value)
+  targetFolderId.value = Number.isInteger(value) && value > 0 ? value : null
+}
+
+/** A load that failed once otherwise leaves closing and reopening the drawer as the only retry. */
+function handleRetryLoad() {
+  if (!Number.isInteger(requestId.value)) return
+  void fetchRequest(requestId.value).then(syncReview)
+}
+
+/** The query carries the tab and the filters behind the drawer, so every level keeps it. */
+function goToReleases() {
+  void router.push({ name: 'book-request-releases', params: { id: requestId.value }, query: route.query })
+}
+
+/**
+ * The drawer traps focus, so it owns these keys outright and cannot collide with the filters on
+ * the list behind it. Typing a decision note still has to win, which is the whole exclusion.
+ *
+ * Bound to the drawer's own root rather than the window, which is what keeps a single-character
+ * shortcut inside WCAG 2.1.4: it acts only while the component that documents it holds focus.
+ * The footer states them, and the approve button carries `aria-keyshortcuts` so a screen reader
+ * announces the one that decides a request.
+ */
+function isTypingTarget(target: EventTarget | null): boolean {
+  if (!(target instanceof HTMLElement)) return false
+  return target.isContentEditable || ['INPUT', 'TEXTAREA', 'SELECT'].includes(target.tagName)
+}
+
+function handleKeydown(event: KeyboardEvent) {
+  if (event.metaKey || event.ctrlKey || event.altKey || isTypingTarget(event.target)) return
+
+  if (event.key === 'j') {
+    event.preventDefault()
+    drawer?.goNext()
+    return
+  }
+  if (event.key === 'k') {
+    event.preventDefault()
+    drawer?.goPrevious()
+    return
+  }
+  if (event.key === 'a' && canApproveNow.value) {
+    event.preventDefault()
+    void approveRequest()
+  }
+}
+
+/**
+ * Every action returns the updated row, so the panel never re-fetches to learn what it just did.
+ * The refusal travels with it rather than being read back off the composable, so one action in
+ * flight cannot describe another.
+ */
+function applyUpdate(outcome: ActionOutcome, failureKey: string): boolean {
+  if (!outcome.item) {
+    const localized = localizedRequestActionFailure(outcome)
+    const description = localized ? t(localized.key, localized.params) : outcome.reason
+    toast.error(t(failureKey), description ? { description } : undefined)
+    return false
+  }
+  setRequest(outcome.item)
+  return true
+}
+
+async function approveRequest(): Promise<boolean> {
+  if (!request.value || targetLibraryId.value === null) return false
+  const outcome = await actions.approve(request.value.id, {
+    decisionNote: decisionNote.value.trim() || undefined,
+    targetLibraryId: targetLibraryId.value,
+    targetFolderId: targetFolderId.value ?? undefined,
+  })
+  if (!applyUpdate(outcome, 'bookRequests.errors.approveFailed')) return false
+  toast.success(t('bookRequests.toasts.approved'))
+  return true
+}
+
+/**
+ * The language decides which releases can match at all, and it arrives from whichever edition was
+ * picked in the metadata results rather than from anything the requester chose. Correcting it here
+ * saves cancelling a request and making it again, and the next search runs against the new one.
+ */
+async function handleLanguageChange(event: Event) {
+  const current = request.value
+  if (!current) return
+
+  const select = event.target as HTMLSelectElement
+  const value = select.value
+  const outcome = await actions.setLanguage(current.id, value === '' ? null : value)
+  if (!applyUpdate(outcome, 'bookRequests.errors.languageChangeFailed')) {
+    // The bound value never changed, so Vue has nothing to re-render and the control is left
+    // showing a language the request was not saved with. Put it back by hand.
+    select.value = request.value?.language ?? ''
+    return
+  }
+  toast.success(t('bookRequests.toasts.languageChanged'))
+}
+
+function handleApprove() {
+  void approveRequest()
+}
+
+/**
+ * The decided row stays in the list, so stepping on lands somewhere real. At the end of the queue
+ * there is nowhere to go and the drawer stays put rather than closing out from under the approver.
+ */
+async function handleApproveAndNext() {
+  if (await approveRequest()) drawer?.goNext()
+}
+
+async function handleReject() {
+  if (!request.value) return
+  const outcome = await actions.reject(request.value.id, { decisionNote: decisionNote.value.trim() || undefined })
+  if (applyUpdate(outcome, 'bookRequests.errors.rejectFailed')) toast.success(t('bookRequests.toasts.rejected'))
+}
+
+async function cancelRequest() {
+  if (!request.value) return
+  const outcome = await actions.cancel(request.value.id)
+  if (applyUpdate(outcome, 'bookRequests.errors.cancelFailed')) toast.success(t('bookRequests.toasts.cancelled'))
+}
+
+async function cancelDownload() {
+  if (!request.value?.download) return
+  const outcome = await actions.cancelDownload(request.value.id, request.value.download.id)
+  if (applyUpdate(outcome, 'bookRequests.errors.cancelDownloadFailed')) toast.success(t('bookRequests.toasts.downloadCancelled'))
+}
+
+async function deleteRequest() {
+  if (!request.value) return
+  const outcome = await actions.remove(request.value.id)
+  if (!outcome.ok) {
+    toast.error(t('bookRequests.errors.deleteFailed'), outcome.reason ? { description: outcome.reason } : undefined)
+    return
+  }
+  toast.success(t('bookRequests.toasts.deleted'))
+  // Nothing left behind this route to look at.
+  drawer?.close()
+}
+
+/** Stopping a live transfer and deleting a row both ask first; the rest are one click. */
+function handleCancel() {
+  if (request.value && cancelStopsATransfer(request.value)) confirming.value = 'cancel'
+  else void cancelRequest()
+}
+
+function handleCancelDownload() {
+  confirming.value = 'cancelDownload'
+}
+
+function handleRemove() {
+  confirming.value = 'delete'
+}
+
+function handleLeave() {
+  confirming.value = 'leave'
+}
+
+function handleDiscardImport() {
+  confirming.value = 'discardImport'
+}
+
+/**
+ * The dialog stays open until the action settles. Closing it first left `busy` with nothing to
+ * render, so a cancellation that has to reach a download client looked instantaneous and finished
+ * somewhere off screen; it also let a second Enter start the same action twice.
+ */
+async function handleConfirm() {
+  const pending = confirming.value
+  if (pending === 'delete') await deleteRequest()
+  else if (pending === 'cancel') await cancelRequest()
+  else if (pending === 'cancelDownload') await cancelDownload()
+  else if (pending === 'leave') await leaveRequest()
+  else if (pending === 'discardImport') await discardImport()
+  confirming.value = null
+}
+
+/**
+ * Leaving costs the caller their access to the request, so there is no row to update afterwards
+ * and nothing behind this route left to look at.
+ */
+async function leaveRequest() {
+  if (!request.value) return
+  const outcome = await actions.leave(request.value.id)
+  if (!outcome.ok) {
+    toast.error(t('bookRequests.errors.leaveFailed'), outcome.reason ? { description: outcome.reason } : undefined)
+    return
+  }
+  toast.success(t('bookRequests.toasts.left'))
+  drawer?.close()
+}
+
+async function discardImport() {
+  if (!request.value) return
+  const outcome = await actions.discardImport(request.value.id)
+  if (!applyUpdate(outcome, 'bookRequests.errors.discardImportFailed')) return
+  resetReview()
+  toast.success(t('bookRequests.toasts.importDiscarded'))
+}
+
+function handleConfirmCancel() {
+  confirming.value = null
+}
+
+async function handleDismiss() {
+  if (!request.value) return
+  const outcome = await actions.dismiss(request.value.id)
+  if (applyUpdate(outcome, 'bookRequests.errors.dismissFailed')) toast.success(t('bookRequests.toasts.dismissed'))
+}
+
+async function handleRestore() {
+  if (!request.value) return
+  const outcome = await actions.restore(request.value.id)
+  if (applyUpdate(outcome, 'bookRequests.errors.restoreFailed')) toast.success(t('bookRequests.toasts.restored'))
+}
+
+async function handleFulfill() {
+  const payload = picker.toPayload()
+  if (!request.value || !payload) return
+  const outcome = await actions.fulfill(request.value.id, payload)
+  if (applyUpdate(outcome, 'bookRequests.errors.fulfilFailed')) {
+    picker.reset()
+    toast.success(t('bookRequests.toasts.fulfilled'))
+  }
+}
+
+async function handleRemoveDownload(payload: { request: BookRequestItem; downloadId: number; deleteFiles: boolean }) {
+  const outcome = await actions.removeDownload(payload.request.id, payload.downloadId, { deleteFiles: payload.deleteFiles })
+  if (applyUpdate(outcome, 'bookRequests.errors.removeDownloadFailed')) toast.success(t('bookRequests.toasts.downloadRemoved'))
+}
+
+async function handleChooseReleaseUnit(unitIndex: number) {
+  const download = request.value?.download
+  if (!request.value || !download) return
+
+  const outcome = await actions.selectReleaseUnit(request.value.id, download.id, { unitIndex })
+  if (applyUpdate(outcome, 'bookRequests.errors.selectUnitFailed')) toast.success(t('bookRequests.toasts.unitChosen'))
+}
+
+/** The score was right about what it measured; the approver is overruling it, not correcting it. */
+async function handleFileAnyway() {
+  if (!request.value) return
+
+  const outcome = await actions.forceFile(request.value.id)
+  if (!applyUpdate(outcome, 'bookRequests.review.fileFailed')) return
+
+  resetReview()
+  toast.success(t('bookRequests.review.filed'))
+}
+
+function handlePickerQuery(event: Event) {
+  picker.search((event.target as HTMLInputElement).value)
+}
+
+function selectBookSource() {
+  picker.setSource('book' satisfies FulfilmentSource)
+}
+
+function selectDockSource() {
+  picker.setSource('dockFile' satisfies FulfilmentSource)
+}
+
+function selectBook(book: BookCard) {
+  picker.select({ source: 'book', id: book.id })
+}
+
+function selectDockFile(file: BookDockFile) {
+  picker.select({ source: 'dockFile', id: file.id })
+}
+
+function dockFileMeta(file: BookDockFile): string {
+  return [file.format?.toUpperCase(), file.fileSize === null ? null : formatBytes(file.fileSize)].filter(Boolean).join(' · ')
+}
+</script>
+
+<template>
+  <!--
+    A container query, not a viewport one: this panel is 600px inside a 1920px window, and every
+    `sm:` or `xl:` in it would otherwise size itself against the screen it cannot see.
+  -->
+  <div class="@container flex h-full min-h-0 flex-col" @keydown="handleKeydown">
+    <RequestDrawerToolbar stepper>
+      <template #actions>
+        <DropdownMenu v-if="hasMenuActions">
+          <DropdownMenuTrigger as-child>
+            <Button variant="ghost" size="icon-sm" :aria-label="t('bookRequests.card.moreActions', { title: request?.title ?? '' })">
+              <Ellipsis :size="16" aria-hidden="true" />
+            </Button>
+          </DropdownMenuTrigger>
+          <DropdownMenuContent align="end">
+            <DropdownMenuItem v-if="canDismiss && !request?.dismissed" :disabled="busy" @click="handleDismiss">
+              {{ t('bookRequests.actions.dismiss') }}
+            </DropdownMenuItem>
+            <DropdownMenuItem v-if="canDismiss && request?.dismissed" :disabled="busy" @click="handleRestore">
+              {{ t('bookRequests.actions.restore') }}
+            </DropdownMenuItem>
+            <!-- Only for somebody who joined this rather than made it: the way back out of the
+                 attach that folds a second request for the same book into the first. -->
+            <DropdownMenuItem v-if="canLeave" :disabled="busy" @click="handleLeave">
+              {{ t('bookRequests.actions.leave') }}
+            </DropdownMenuItem>
+            <DropdownMenuItem v-if="canCancel" variant="destructive" :disabled="busy" @click="handleCancel">
+              {{ t('bookRequests.actions.cancel') }}
+            </DropdownMenuItem>
+            <DropdownMenuItem v-if="canDelete" variant="destructive" :disabled="busy" @click="handleRemove">
+              {{ t('bookRequests.actions.delete') }}
+            </DropdownMenuItem>
+          </DropdownMenuContent>
+        </DropdownMenu>
+      </template>
+    </RequestDrawerToolbar>
+
+    <div class="min-h-0 flex-1 overflow-y-auto px-4 py-4">
+      <div v-if="loading" role="status" class="flex items-center gap-2 text-sm text-muted-foreground">
+        <Loader2 class="size-4 animate-spin" aria-hidden="true" />
+        {{ t('bookRequests.detail.loading') }}
+      </div>
+
+      <EntityNotFound v-else-if="error === 'notFound' || error === 'forbidden'" :entity="t('bookRequests.detail.entityName')" />
+
+      <div v-else-if="error" role="alert" class="flex flex-wrap items-center gap-3">
+        <p class="text-sm text-destructive">{{ t(`bookRequests.detail.errors.${error}`) }}</p>
+        <Button variant="outline" size="sm" :disabled="loading" @click="handleRetryLoad">{{ t('common.retry') }}</Button>
+      </div>
+
+      <template v-else-if="request">
+        <header class="flex items-start gap-4">
+          <RequestCover :src="request.coverUrl" :media-kind="request.mediaKind" class="h-[105px] w-[70px] shadow-sm" :icon-size="24" />
+
+          <div class="min-w-0 flex-1 space-y-1.5">
+            <h2 class="text-lg leading-snug font-semibold tracking-tight text-foreground">{{ request.title }}</h2>
+            <p class="text-sm text-muted-foreground">{{ authorLine || t('bookRequests.detail.unknownAuthor') }}</p>
+
+            <div class="flex flex-wrap items-center gap-1.5 pt-1">
+              <RequestStatusBadge :status="presentationStatus ?? request.status" />
+              <span class="inline-flex items-center gap-1 rounded-full border border-border px-2 py-0.5 text-xs text-muted-foreground">
+                <component :is="mediaIcon" :size="12" aria-hidden="true" />
+                {{ t(`bookRequests.mediaKind.${request.mediaKind}`) }}
+              </span>
+              <span
+                v-if="request.targetLibraryName"
+                class="inline-flex items-center gap-1 rounded-full border border-border px-2 py-0.5 text-xs text-muted-foreground"
+              >
+                <Library :size="12" aria-hidden="true" />
+                {{ request.targetLibraryName }}
+              </span>
+              <Button
+                v-if="request.status === 'available' && request.matchedBookId !== null"
+                as-child
+                variant="outline"
+                size="sm"
+                class="h-6 rounded-full px-2 text-xs shadow-none"
+              >
+                <RouterLink :to="{ name: 'book-detail', params: { bookId: request.matchedBookId } }">
+                  <ExternalLink class="size-3" aria-hidden="true" />
+                  {{ t('bookRequests.actions.goToBook') }}
+                </RouterLink>
+              </Button>
+              <span
+                v-if="request.subscribers.length"
+                class="inline-flex items-center gap-1 rounded-full border border-border px-2 py-0.5 text-xs text-muted-foreground"
+              >
+                <Users :size="12" aria-hidden="true" />
+                {{ t('bookRequests.card.alsoWantedCount', { count: request.subscribers.length }) }}
+              </span>
+              <span
+                v-if="request.dismissed"
+                class="inline-flex items-center gap-1 rounded-full border border-border px-2 py-0.5 text-xs text-muted-foreground"
+              >
+                <EyeOff :size="12" aria-hidden="true" />
+                {{ t('bookRequests.card.dismissedBadge') }}
+              </span>
+            </div>
+          </div>
+        </header>
+
+        <div class="mt-5 space-y-4">
+          <section class="rounded-lg border border-border bg-card p-4" :aria-label="t('bookRequests.pipeline.label')">
+            <h3 class="mb-3.5 text-xs font-semibold tracking-wide text-muted-foreground uppercase">{{ t('bookRequests.pipeline.label') }}</h3>
+            <RequestPipeline :request="request" :live="liveProgress" />
+          </section>
+
+          <section v-if="request.download" class="rounded-lg border border-border bg-card p-4" :aria-label="t('bookRequests.detail.transfer')">
+            <h3 class="mb-2 text-xs font-semibold tracking-wide text-muted-foreground uppercase">{{ t('bookRequests.detail.transfer') }}</h3>
+            <RequestDownloadProgress
+              :download="request.download"
+              :live="liveProgress"
+              :show-error="showDownloadError"
+              :can-retry="showTransferRetry"
+              :can-cancel="canCancel"
+              @retry="goToReleases"
+              @cancel="handleCancelDownload"
+            />
+          </section>
+
+          <!--
+            Under the current transfer, because that is the question it answers: what was tried
+            before this, and what did those sources say. Approvers only: it names indexers.
+          -->
+          <RequestAttemptsPanel v-if="canFulfilThis" :request="request" :can-manage="canManage" />
+
+          <!-- Sits above the failure reason: the reason says a choice is needed, and this is it. -->
+          <ReleaseUnitChooser v-if="canFulfilThis && releaseUnits.length" :units="releaseUnits" :busy="busy" @choose="handleChooseReleaseUnit" />
+
+          <RequestReviewPanel
+            v-if="isHeld && review"
+            :review="review"
+            :can-manage="canFulfilThis"
+            :busy="busy"
+            @file="handleFileAnyway"
+            @discard="handleDiscardImport"
+          />
+
+          <!--
+            Alarm styling and `role="alert"` are for a request that actually failed. Automation also
+            hands a request back at `approved` with a reason on it, and shouting an interruption at
+            somebody about a request that is simply waiting for them is the wrong register.
+          -->
+          <p
+            v-if="showFailureReason"
+            :role="failureIsAlarming ? 'alert' : 'status'"
+            class="flex items-start gap-2 rounded-lg border p-3"
+            :class="failureIsAlarming ? 'border-destructive/40 bg-destructive/8' : 'border-border bg-muted'"
+          >
+            <TriangleAlert
+              :size="15"
+              class="mt-0.5 shrink-0"
+              :class="failureIsAlarming ? 'text-destructive' : 'text-muted-foreground'"
+              aria-hidden="true"
+            />
+            <span class="text-sm" :class="failureIsAlarming ? 'text-destructive' : 'text-foreground'">{{ failureText }}</span>
+          </p>
+
+          <!-- The decision inputs live here; the buttons that consume them sit in the footer. -->
+          <section v-if="canDecide" class="space-y-3 rounded-lg border border-border bg-card p-4">
+            <h3 class="text-sm font-semibold text-foreground">{{ t('bookRequests.detail.decideTitle') }}</h3>
+
+            <div class="grid gap-3 @xl:grid-cols-2">
+              <div>
+                <label for="request-target-library" class="mb-1 block text-sm font-medium text-foreground">
+                  {{ t('bookRequests.detail.destinationLibraryLabel') }}
+                </label>
+                <select
+                  id="request-target-library"
+                  :value="targetLibraryId ?? ''"
+                  class="h-9 w-full rounded-md border border-input bg-background px-3 text-sm text-foreground focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 focus-visible:outline-none"
+                  @change="handleLibraryChange"
+                >
+                  <!-- Names the instance default, so an approver can see where a request that
+                       chose nowhere would land rather than guessing from an empty select. -->
+                  <option value="">{{ unpickedDestinationLabel }}</option>
+                  <option v-for="library in libraries" :key="library.id" :value="library.id">{{ library.name }}</option>
+                </select>
+              </div>
+
+              <div>
+                <label for="request-language" class="mb-1 block text-sm font-medium text-foreground">
+                  {{ t('bookRequests.detail.languageLabel') }}
+                </label>
+                <select
+                  id="request-language"
+                  :value="request?.language ?? ''"
+                  class="h-9 w-full rounded-md border border-input bg-background px-3 text-sm text-foreground focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 focus-visible:outline-none"
+                  @change="handleLanguageChange"
+                >
+                  <option value="">{{ t('bookRequests.detail.languageAny') }}</option>
+                  <option v-for="option in languageOptions" :key="option.code" :value="option.code">{{ option.name }}</option>
+                </select>
+              </div>
+
+              <div v-if="folders.length > 1">
+                <label for="request-target-folder" class="mb-1 block text-sm font-medium text-foreground">
+                  {{ t('bookRequests.detail.destinationFolderLabel') }}
+                </label>
+                <select
+                  id="request-target-folder"
+                  :value="targetFolderId ?? ''"
+                  class="h-9 w-full rounded-md border border-input bg-background px-3 text-sm text-foreground focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 focus-visible:outline-none"
+                  @change="handleFolderChange"
+                >
+                  <option v-for="folder in folders" :key="folder.id" :value="folder.id">{{ folder.path }}</option>
+                </select>
+              </div>
+            </div>
+
+            <div>
+              <label for="request-decision-note" class="mb-1 block text-sm font-medium text-foreground">
+                {{ t('bookRequests.detail.decisionNoteLabel') }}
+              </label>
+              <Input id="request-decision-note" v-model="decisionNote" :placeholder="t('bookRequests.detail.decisionNotePlaceholder')" />
+            </div>
+
+            <p v-if="targetLibraryId === null" class="text-sm text-muted-foreground">{{ t('bookRequests.detail.destinationRequired') }}</p>
+          </section>
+
+          <!--
+            Was two number inputs asking for a database id. Now it searches the thing being named,
+            and the id never reaches the screen.
+
+            Shut by default, and keyed on the request so it shuts again when the drawer steps on:
+            closing a request by hand is the escape hatch, not the reason anyone opened this.
+          -->
+          <details v-if="canFulfill" :key="requestId" class="group rounded-lg border border-border bg-card">
+            <summary
+              class="flex cursor-pointer list-none items-center gap-2 rounded-lg p-4 text-sm font-semibold text-foreground focus-visible:ring-2 focus-visible:ring-ring focus-visible:outline-none [&::-webkit-details-marker]:hidden"
+            >
+              {{ t('bookRequests.detail.fulfilTitle') }}
+              <ChevronDown
+                :size="15"
+                class="ms-auto shrink-0 text-muted-foreground transition-transform group-open:rotate-180 motion-reduce:transition-none"
+                aria-hidden="true"
+              />
+            </summary>
+
+            <div class="space-y-3 px-4 pb-4">
+              <p class="text-sm text-muted-foreground">{{ t('bookRequests.detail.fulfilHint') }}</p>
+
+              <div
+                class="inline-flex gap-0.5 rounded-lg border border-border bg-muted p-0.5"
+                role="group"
+                :aria-label="t('bookRequests.detail.fulfilSourceLabel')"
+              >
+                <button
+                  type="button"
+                  class="rounded-md px-3 py-1.5 text-sm font-medium transition-colors focus-visible:ring-2 focus-visible:ring-ring focus-visible:outline-none motion-reduce:transition-none"
+                  :class="picker.source.value === 'book' ? 'bg-background text-foreground shadow-xs' : 'text-muted-foreground hover:text-foreground'"
+                  :aria-pressed="picker.source.value === 'book'"
+                  @click="selectBookSource"
+                >
+                  {{ t('bookRequests.detail.fulfilFromLibrary') }}
+                </button>
+                <button
+                  type="button"
+                  class="rounded-md px-3 py-1.5 text-sm font-medium transition-colors focus-visible:ring-2 focus-visible:ring-ring focus-visible:outline-none motion-reduce:transition-none"
+                  :class="
+                    picker.source.value === 'dockFile' ? 'bg-background text-foreground shadow-xs' : 'text-muted-foreground hover:text-foreground'
+                  "
+                  :aria-pressed="picker.source.value === 'dockFile'"
+                  @click="selectDockSource"
+                >
+                  {{ t('bookRequests.detail.fulfilFromDock') }}
+                </button>
+              </div>
+
+              <div class="relative">
+                <Search :size="15" class="absolute start-3 top-1/2 -translate-y-1/2 text-muted-foreground" aria-hidden="true" />
+                <label for="fulfil-search" class="sr-only">{{ t('bookRequests.detail.fulfilSearchLabel') }}</label>
+                <input
+                  id="fulfil-search"
+                  type="search"
+                  :value="picker.query.value"
+                  class="h-9 w-full rounded-md border border-input bg-background ps-9 pe-3 text-sm text-foreground placeholder:text-muted-foreground focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 focus-visible:outline-none"
+                  :placeholder="
+                    picker.source.value === 'book' ? t('bookRequests.detail.fulfilSearchBooks') : t('bookRequests.detail.fulfilSearchDock')
+                  "
+                  @input="handlePickerQuery"
+                />
+              </div>
+
+              <p v-if="picker.searching.value" role="status" class="text-sm text-muted-foreground">{{ t('bookRequests.detail.fulfilSearching') }}</p>
+
+              <p v-else-if="hasSearched && pickerResults.length === 0" role="status" class="text-sm text-muted-foreground">
+                {{ t('bookRequests.detail.fulfilNoResults') }}
+              </p>
+
+              <ul v-else-if="picker.source.value === 'book' && picker.books.value.length" class="grid gap-2 @xl:grid-cols-2">
+                <li v-for="book in picker.books.value" :key="book.id">
+                  <button
+                    type="button"
+                    class="flex w-full items-center gap-2.5 rounded-lg border p-2.5 text-start transition-colors focus-visible:ring-2 focus-visible:ring-ring focus-visible:outline-none motion-reduce:transition-none"
+                    :class="
+                      picker.isSelected({ source: 'book', id: book.id })
+                        ? 'border-primary bg-primary/8'
+                        : 'border-border bg-card hover:border-ring/50'
+                    "
+                    :aria-pressed="picker.isSelected({ source: 'book', id: book.id })"
+                    @click="selectBook(book)"
+                  >
+                    <BookCoverImage
+                      :book-id="book.id"
+                      type="thumbnail"
+                      :version="book.updatedAt"
+                      class="h-[42px] w-7 shrink-0 rounded bg-muted object-cover"
+                      :alt="''"
+                    />
+                    <span class="min-w-0 flex-1">
+                      <span class="block truncate text-sm font-medium text-foreground">{{ book.title }}</span>
+                      <span class="block truncate text-xs text-muted-foreground">{{ book.authors.join(', ') }}</span>
+                    </span>
+                  </button>
+                </li>
+              </ul>
+
+              <ul v-else-if="picker.source.value === 'dockFile' && picker.dockFiles.value.length" class="grid gap-2 @xl:grid-cols-2">
+                <li v-for="file in picker.dockFiles.value" :key="file.id">
+                  <button
+                    type="button"
+                    class="flex w-full items-center gap-2.5 rounded-lg border p-2.5 text-start transition-colors focus-visible:ring-2 focus-visible:ring-ring focus-visible:outline-none motion-reduce:transition-none"
+                    :class="
+                      picker.isSelected({ source: 'dockFile', id: file.id })
+                        ? 'border-primary bg-primary/8'
+                        : 'border-border bg-card hover:border-ring/50'
+                    "
+                    :aria-pressed="picker.isSelected({ source: 'dockFile', id: file.id })"
+                    @click="selectDockFile(file)"
+                  >
+                    <FileText :size="16" class="shrink-0 text-muted-foreground" aria-hidden="true" />
+                    <span class="min-w-0 flex-1">
+                      <span class="block truncate text-sm font-medium text-foreground">{{ file.fileName }}</span>
+                      <span class="block truncate text-xs text-muted-foreground">{{ dockFileMeta(file) }}</span>
+                    </span>
+                  </button>
+                </li>
+              </ul>
+
+              <Button :disabled="busy || picker.selected.value === null" @click="handleFulfill">
+                {{ t('bookRequests.actions.markFulfilled') }}
+              </Button>
+            </div>
+          </details>
+
+          <RequestSeedPanel v-if="canFulfilThis" :request="request" :busy="busy" :can-manage="canManage" @remove="handleRemoveDownload" />
+
+          <section class="rounded-lg border border-border bg-card p-4">
+            <h3 class="mb-3 text-xs font-semibold tracking-wide text-muted-foreground uppercase">{{ t('bookRequests.detail.requestSection') }}</h3>
+            <dl class="space-y-2.5">
+              <div class="flex items-baseline justify-between gap-4">
+                <dt class="text-sm text-muted-foreground">{{ t('bookRequests.detail.requestedBy') }}</dt>
+                <dd class="text-end text-sm text-foreground">{{ request.requesterName }}</dd>
+              </div>
+              <div class="flex items-baseline justify-between gap-4">
+                <dt class="text-sm text-muted-foreground">{{ t('bookRequests.detail.requestedOn') }}</dt>
+                <dd class="text-end text-sm text-foreground tabular-nums">{{ formatDateTime(new Date(request.createdAt)) }}</dd>
+              </div>
+              <div v-if="request.decidedByUsername" class="flex items-baseline justify-between gap-4">
+                <dt class="text-sm text-muted-foreground">{{ t('bookRequests.detail.decidedBy') }}</dt>
+                <dd class="text-end text-sm text-foreground">{{ request.decidedByUsername }}</dd>
+              </div>
+              <div v-if="request.seriesName" class="flex items-baseline justify-between gap-4">
+                <dt class="text-sm text-muted-foreground">{{ t('bookRequests.detail.series') }}</dt>
+                <dd class="text-end text-sm text-foreground">{{ request.seriesName }}</dd>
+              </div>
+              <div v-if="request.isbn13" class="flex items-baseline justify-between gap-4">
+                <dt class="text-sm text-muted-foreground">{{ t('bookRequests.detail.isbn') }}</dt>
+                <dd class="text-end text-sm text-foreground tabular-nums">{{ request.isbn13 }}</dd>
+              </div>
+            </dl>
+          </section>
+
+          <section v-if="request.note || request.decisionNote" class="space-y-3 rounded-lg border border-border bg-card p-4">
+            <div v-if="request.note">
+              <h3 class="mb-1 text-xs font-semibold tracking-wide text-muted-foreground uppercase">
+                {{ t('bookRequests.detail.requesterNote') }}
+              </h3>
+              <p class="text-sm text-muted-foreground">{{ request.note }}</p>
+            </div>
+            <div v-if="request.decisionNote">
+              <h3 class="mb-1 text-xs font-semibold tracking-wide text-muted-foreground uppercase">
+                {{ t('bookRequests.detail.decisionNote') }}
+              </h3>
+              <p class="text-sm text-muted-foreground">{{ request.decisionNote }}</p>
+            </div>
+          </section>
+
+          <section v-if="request.subscribers.length" class="rounded-lg border border-border bg-card p-4">
+            <h3 class="mb-3 text-xs font-semibold tracking-wide text-muted-foreground uppercase">{{ t('bookRequests.detail.alsoWanted') }}</h3>
+            <ul class="space-y-1.5">
+              <li v-for="subscriber in request.subscribers" :key="subscriber.userId" class="text-sm text-muted-foreground">
+                {{ subscriber.name }}
+              </li>
+            </ul>
+          </section>
+        </div>
+      </template>
+    </div>
+
+    <!-- The action that matters for the stage this request is at, and nothing else. -->
+    <footer v-if="request && showFooter" class="flex shrink-0 flex-wrap items-center gap-2 border-t border-border px-4 py-3">
+      <template v-if="canDecide">
+        <Button v-if="drawer?.hasNext.value" :disabled="!canApproveNow" @click="handleApproveAndNext">
+          {{ t('bookRequests.actions.approveAndNext') }}
+        </Button>
+        <Button :variant="drawer?.hasNext.value ? 'outline' : 'default'" :disabled="!canApproveNow" aria-keyshortcuts="a" @click="handleApprove">
+          {{ t('bookRequests.actions.approve') }}
+        </Button>
+        <Button variant="destructive-outline" :disabled="busy" @click="handleReject">{{ t('bookRequests.actions.reject') }}</Button>
+      </template>
+
+      <Button v-else-if="canGrab" :disabled="busy" @click="goToReleases">{{ t(grabLabel) }}</Button>
+
+      <!-- A keyboard hint the keyboard user cannot see is not a hint. The footer already wraps. -->
+      <p class="ms-auto text-xs text-muted-foreground">{{ t('bookRequests.drawer.shortcuts') }}</p>
+    </footer>
+
+    <ConfirmDialog
+      :open="confirming !== null"
+      :title="confirmTitle"
+      :description="confirmDescription"
+      :confirm-label="confirmLabel"
+      :busy="busy"
+      @confirm="handleConfirm"
+      @cancel="handleConfirmCancel"
+    />
+  </div>
+</template>
diff --git a/client/src/features/book-requests/components/RequestDownloadProgress.vue b/client/src/features/book-requests/components/RequestDownloadProgress.vue
new file mode 100644
index 000000000..ab565a196
--- /dev/null
+++ b/client/src/features/book-requests/components/RequestDownloadProgress.vue
@@ -0,0 +1,121 @@
+<script setup lang="ts">
+import { computed } from 'vue'
+import { useI18n } from 'vue-i18n'
+import { RefreshCw } from '@lucide/vue'
+import type { BookRequestDownloadItem, BookRequestProgressEvent } from '@bookorbit/types'
+import { Button } from '@/components/ui/button'
+import { formatPercent } from '@/i18n/formatters'
+import { formatBytes } from '@/lib/formatting'
+import { currentRequestProgress } from '../requestPipeline'
+import { protocolChipClass, sourceChipClass } from '../sourceColors'
+
+const props = withDefaults(
+  defineProps<{
+    download: BookRequestDownloadItem
+    /** A live tick, when one has arrived since the list was last fetched. */
+    live: BookRequestProgressEvent | null
+    /** Off when something else on the page already explains this failure at greater length. */
+    showError?: boolean
+    /** Recovery stays permission-gated by the request detail that owns the release picker. */
+    canRetry?: boolean
+    /** Cancellation follows the same request ownership rules as the detail menu. */
+    canCancel?: boolean
+  }>(),
+  { showError: true, canRetry: false, canCancel: false },
+)
+
+const emit = defineEmits<{ retry: []; cancel: [] }>()
+
+const { t } = useI18n()
+
+const currentLive = computed(() => currentRequestProgress({ status: 'grabbed', download: props.download }, props.live))
+const status = computed(() => currentLive.value?.status ?? props.download.status)
+const percent = computed(() => Math.max(0, Math.min(100, currentLive.value?.progressPercent ?? props.download.progressPercent)))
+/** Locale-formatted: where the percent sign goes, and whether it takes a space, is not universal. */
+const percentLabel = computed(() => formatPercent(percent.value / 100))
+const downloadedBytes = computed(() => currentLive.value?.downloadedBytes ?? props.download.downloadedBytes)
+const totalBytes = computed(() => currentLive.value?.totalBytes ?? props.download.totalBytes)
+
+/** Only a live transfer has a meaningful bar; everything else is a state, not a proportion. */
+const showBar = computed(() => status.value === 'queued' || status.value === 'downloading')
+const showRetry = computed(() => status.value === 'failed' && props.canRetry)
+const showCancel = computed(() => showBar.value && props.canCancel)
+
+/**
+ * Which source this came from, and how. A finished transfer says only that the book arrived, and
+ * the one thing an approver asks about it afterwards is where it came from - not least because
+ * the release that worked is often not the one the request started with.
+ */
+const isTorrent = computed(() => props.download.source !== 'direct_url')
+const sourceName = computed(() => props.download.indexerName ?? t('bookRequests.download.source.pasted'))
+const protocolName = computed(() => t(isTorrent.value ? 'bookRequests.releases.protocol.torrent' : 'bookRequests.releases.protocol.direct'))
+const selectionName = computed(() => t(props.download.automated ? 'bookRequests.download.source.automatic' : 'bookRequests.download.source.manual'))
+
+const sizeLine = computed(() => {
+  if (totalBytes.value) {
+    return t('bookRequests.download.transferred', {
+      done: formatBytes(downloadedBytes.value),
+      total: formatBytes(totalBytes.value),
+    })
+  }
+  return downloadedBytes.value > 0 ? t('bookRequests.download.transferredUnknown', { done: formatBytes(downloadedBytes.value) }) : null
+})
+
+function handleRetry() {
+  emit('retry')
+}
+
+function handleCancel() {
+  emit('cancel')
+}
+</script>
+
+<template>
+  <div class="mt-3 rounded-md border border-border bg-muted/40 p-2">
+    <div class="flex flex-wrap items-center justify-between gap-2 text-xs">
+      <span class="text-foreground">{{ t(`bookRequests.download.status.${status}`) }}</span>
+      <span v-if="showBar" class="text-muted-foreground tabular-nums">{{ percentLabel }}</span>
+    </div>
+
+    <div
+      v-if="showBar"
+      class="mt-1.5 h-1.5 w-full overflow-hidden rounded-full bg-border"
+      role="progressbar"
+      :aria-valuenow="percent"
+      aria-valuemin="0"
+      aria-valuemax="100"
+      :aria-label="t('bookRequests.download.progressLabel', { title: download.releaseTitle })"
+    >
+      <div class="h-full rounded-full bg-primary transition-[width] duration-500 motion-reduce:transition-none" :style="{ width: `${percent}%` }" />
+    </div>
+
+    <p v-if="showBar && sizeLine" class="settings-hint tabular-nums">{{ sizeLine }}</p>
+    <p v-if="props.showError && download.errorMessage" class="settings-hint">{{ download.errorMessage }}</p>
+    <p class="settings-hint break-all">{{ download.releaseTitle }}</p>
+    <div v-if="showRetry || showCancel" class="mt-2 flex flex-wrap gap-2">
+      <Button v-if="showRetry" variant="outline" size="sm" @click="handleRetry">
+        <RefreshCw :size="14" aria-hidden="true" />
+        {{ t('bookRequests.actions.retryRelease') }}
+      </Button>
+      <Button v-if="showCancel" variant="destructive-outline" size="sm" @click="handleCancel">
+        {{ t('bookRequests.actions.cancelDownload') }}
+      </Button>
+    </div>
+    <div class="mt-1 flex flex-wrap items-center gap-1.5 text-xs">
+      <span class="rounded-full border px-1.5 py-px font-medium" :class="sourceChipClass(download.indexerColor)">
+        {{ sourceName }}
+      </span>
+      <span class="rounded-full border px-1.5 py-px font-medium" :class="protocolChipClass(isTorrent)">
+        {{ protocolName }}
+      </span>
+      <span
+        v-if="download.downloadClientName"
+        class="rounded-full border px-1.5 py-px font-medium"
+        :class="sourceChipClass(download.downloadClientColor)"
+      >
+        {{ download.downloadClientName }}
+      </span>
+      <span class="text-muted-foreground">{{ selectionName }}</span>
+    </div>
+  </div>
+</template>
diff --git a/client/src/features/book-requests/components/RequestDrawer.vue b/client/src/features/book-requests/components/RequestDrawer.vue
new file mode 100644
index 000000000..7af8c5469
--- /dev/null
+++ b/client/src/features/book-requests/components/RequestDrawer.vue
@@ -0,0 +1,66 @@
+<script setup lang="ts">
+import { computed } from 'vue'
+import { useI18n } from 'vue-i18n'
+import { useMediaQuery } from '@vueuse/core'
+import { Sheet, SheetContent, SheetDescription, SheetTitle } from '@/components/ui/sheet'
+
+const props = defineProps<{
+  open: boolean
+  /** 1 is the request itself, 2 is the release picker stacked over it. */
+  level: 1 | 2
+}>()
+
+const emit = defineEmits<{
+  close: []
+  back: []
+}>()
+
+const { t } = useI18n()
+
+/** Tailwind's `sm`, which is also where the list stops being a table and starts being cards. */
+const isNarrowViewport = useMediaQuery('(max-width: 639px)')
+
+const side = computed(() => (isNarrowViewport.value ? ('bottom' as const) : ('right' as const)))
+
+/**
+ * The picker needs the extra width to land in the layout it already has below its own widest
+ * breakpoint: the facet rail wraps into a bar and the table keeps its optional columns. On a phone
+ * it takes the whole screen instead, because a picker row does not survive being half a sheet.
+ */
+const sizeClass = computed(() => {
+  if (isNarrowViewport.value) return props.level === 2 ? 'h-full rounded-none' : 'h-[88svh] rounded-t-xl'
+  return props.level === 2 ? 'w-full sm:max-w-[52.5rem]' : 'w-full sm:max-w-[37.5rem]'
+})
+
+const title = computed(() => (props.level === 2 ? t('bookRequests.releases.title') : t('bookRequests.drawer.label')))
+
+function handleOpenChange(value: boolean) {
+  if (!value) emit('close')
+}
+
+/**
+ * Escape pops one level rather than dismissing the stack, so leaving the picker lands back on the
+ * request it was opened for. Clicking the scrim still closes the lot, which is what a scrim means.
+ */
+function handleEscape(event: KeyboardEvent) {
+  if (props.level !== 2) return
+  event.preventDefault()
+  emit('back')
+}
+</script>
+
+<template>
+  <Sheet :open="open" @update:open="handleOpenChange">
+    <SheetContent
+      :side="side"
+      hide-close
+      class="gap-0 p-0 duration-200 motion-safe:transition-[max-width] motion-reduce:transition-none"
+      :class="sizeClass"
+      @escape-key-down="handleEscape"
+    >
+      <SheetTitle class="sr-only">{{ title }}</SheetTitle>
+      <SheetDescription class="sr-only">{{ t('bookRequests.drawer.description') }}</SheetDescription>
+      <slot />
+    </SheetContent>
+  </Sheet>
+</template>
diff --git a/client/src/features/book-requests/components/RequestDrawerToolbar.vue b/client/src/features/book-requests/components/RequestDrawerToolbar.vue
new file mode 100644
index 000000000..2624e4d95
--- /dev/null
+++ b/client/src/features/book-requests/components/RequestDrawerToolbar.vue
@@ -0,0 +1,90 @@
+<script setup lang="ts">
+import { inject } from 'vue'
+import { useI18n } from 'vue-i18n'
+import { ChevronDown, ChevronLeft, ChevronUp, X } from '@lucide/vue'
+import { Button } from '@/components/ui/button'
+import { REQUEST_DRAWER } from '../requestDrawerContext'
+
+const props = withDefaults(
+  defineProps<{
+    /** `back` pops to the request behind the picker; `close` leaves the drawer entirely. */
+    leading?: 'close' | 'back'
+    /** Only the request itself walks the queue. Inside the picker there is one release list. */
+    stepper?: boolean
+  }>(),
+  { leading: 'close', stepper: false },
+)
+
+const emit = defineEmits<{ back: [] }>()
+
+const { t } = useI18n()
+const drawer = inject(REQUEST_DRAWER, null)
+
+function handleLeading() {
+  if (props.leading === 'back') emit('back')
+  else drawer?.close()
+}
+
+function handleClose() {
+  drawer?.close()
+}
+
+function handlePrevious() {
+  drawer?.goPrevious()
+}
+
+function handleNext() {
+  drawer?.goNext()
+}
+</script>
+
+<template>
+  <div class="flex shrink-0 items-center gap-1.5 border-b border-border px-3 py-2.5">
+    <Button
+      variant="ghost"
+      size="icon-sm"
+      :aria-label="leading === 'back' ? t('bookRequests.releases.backToRequest') : t('common.close')"
+      @click="handleLeading"
+    >
+      <component :is="leading === 'back' ? ChevronLeft : X" :size="16" aria-hidden="true" />
+    </Button>
+
+    <!--
+      Hidden when the open request is not in the list, which a filter change or a dismissal can do
+      while the drawer is still open on it. A position of "0 of 12" is worse than no position.
+    -->
+    <div v-if="stepper && drawer && drawer.position.value > 0" class="flex items-center gap-0.5 rounded-lg border border-border p-0.5">
+      <Button
+        variant="ghost"
+        size="icon-sm"
+        class="size-6"
+        :disabled="!drawer.hasPrevious.value"
+        :aria-label="t('bookRequests.drawer.previous')"
+        @click="handlePrevious"
+      >
+        <ChevronUp :size="14" aria-hidden="true" />
+      </Button>
+      <span class="px-1 text-xs text-muted-foreground tabular-nums">
+        {{ t('bookRequests.drawer.position', { position: drawer.position.value, total: drawer.total.value }) }}
+      </span>
+      <Button
+        variant="ghost"
+        size="icon-sm"
+        class="size-6"
+        :disabled="!drawer.hasNext.value"
+        :aria-label="t('bookRequests.drawer.next')"
+        @click="handleNext"
+      >
+        <ChevronDown :size="14" aria-hidden="true" />
+      </Button>
+    </div>
+
+    <div class="min-w-0 flex-1"><slot name="title" /></div>
+
+    <div class="flex shrink-0 items-center gap-1"><slot name="actions" /></div>
+
+    <Button v-if="leading === 'back'" variant="ghost" size="icon-sm" :aria-label="t('common.close')" @click="handleClose">
+      <X :size="16" aria-hidden="true" />
+    </Button>
+  </div>
+</template>
diff --git a/client/src/features/book-requests/components/RequestEmptyState.vue b/client/src/features/book-requests/components/RequestEmptyState.vue
new file mode 100644
index 000000000..f6ec44494
--- /dev/null
+++ b/client/src/features/book-requests/components/RequestEmptyState.vue
@@ -0,0 +1,24 @@
+<script setup lang="ts">
+import type { Component } from 'vue'
+
+defineProps<{
+  icon: Component
+  title: string
+  message?: string
+}>()
+</script>
+
+<template>
+  <!--
+    One treatment for every empty list in the feature, matching the Book Dock file list so the two
+    pages do not each invent their own. Actions go in the slot.
+  -->
+  <div role="status" class="flex flex-col items-center gap-3 px-6 py-16 text-center">
+    <div class="flex size-12 items-center justify-center rounded-full bg-primary/10 text-primary">
+      <component :is="icon" class="size-6" aria-hidden="true" />
+    </div>
+    <p class="text-sm font-medium text-foreground">{{ title }}</p>
+    <p v-if="message" class="max-w-md text-xs text-muted-foreground">{{ message }}</p>
+    <div v-if="$slots.default" class="mt-1 flex flex-wrap justify-center gap-2"><slot /></div>
+  </div>
+</template>
diff --git a/client/src/features/book-requests/components/RequestListSkeleton.vue b/client/src/features/book-requests/components/RequestListSkeleton.vue
new file mode 100644
index 000000000..1f4223c83
--- /dev/null
+++ b/client/src/features/book-requests/components/RequestListSkeleton.vue
@@ -0,0 +1,31 @@
+<script setup lang="ts">
+import { useI18n } from 'vue-i18n'
+
+withDefaults(defineProps<{ rows?: number }>(), { rows: 6 })
+
+const { t } = useI18n()
+</script>
+
+<template>
+  <!--
+    Skeleton rows rather than a line of text. They hold the shape the table is about to take, so
+    the page does not jump when the data lands.
+  -->
+  <div class="rounded-lg border border-border bg-card" role="status" :aria-label="t('bookRequests.list.loading')">
+    <div
+      v-for="row in rows"
+      :key="row"
+      class="flex animate-pulse items-center gap-3 border-b border-border/60 p-3 last:border-b-0 motion-reduce:animate-none"
+    >
+      <div class="h-[46px] w-8 shrink-0 rounded bg-muted" />
+      <div class="flex-1 space-y-2">
+        <div class="h-3.5 w-2/5 rounded bg-muted" />
+        <div class="h-3 w-1/4 rounded bg-muted" />
+      </div>
+      <div class="hidden h-5 w-20 shrink-0 rounded-full bg-muted lg:block" />
+      <div class="hidden h-3 w-32 shrink-0 rounded bg-muted lg:block" />
+      <div class="h-8 w-20 shrink-0 rounded-md bg-muted" />
+    </div>
+    <span class="sr-only">{{ t('bookRequests.list.loading') }}</span>
+  </div>
+</template>
diff --git a/client/src/features/book-requests/components/RequestListTable.vue b/client/src/features/book-requests/components/RequestListTable.vue
new file mode 100644
index 000000000..13fbf3c3e
--- /dev/null
+++ b/client/src/features/book-requests/components/RequestListTable.vue
@@ -0,0 +1,575 @@
+<script setup lang="ts">
+import { computed } from 'vue'
+import { useI18n } from 'vue-i18n'
+import { ArrowDown, ArrowUp, BookOpen, ChevronsUpDown, ExternalLink, EyeOff, Headphones, Images, TriangleAlert, Zap } from '@lucide/vue'
+import { isGrabbableBookRequestStatus } from '@bookorbit/types'
+import type { BookRequestItem, BookRequestProgressEvent, BookRequestSortDirection, BookRequestSortField } from '@bookorbit/types'
+import { formatPercent, formatRelativeFromNow } from '@/i18n/formatters'
+import { formatBytes } from '@/lib/formatting'
+import type { RequestListDensity } from '../composables/useRequestListDensity'
+import { canBulkActRequest } from '../requestActions'
+import { requestFailureText, requestOutcome } from '../requestOutcome'
+import { currentRequestProgress, requestPresentationStatus } from '../requestPipeline'
+import RequestCover from './RequestCover.vue'
+import RequestPipeline from './RequestPipeline.vue'
+import RequestRowActions from './RequestRowActions.vue'
+import RequestStatusBadge from './RequestStatusBadge.vue'
+
+const props = defineProps<{
+  requests: BookRequestItem[]
+  canManage: boolean
+  /** Whether the viewer may drive fulfilment on rows that are theirs to drive. */
+  canSelfFulfil: boolean
+  currentUserId: number | null
+  /** Every row with an action in flight, so two rows acted on at once each stay disabled. */
+  busyIds: ReadonlySet<number>
+  progressByRequest: Record<number, BookRequestProgressEvent | undefined>
+  density: RequestListDensity
+  sortBy: BookRequestSortField
+  sortDir: BookRequestSortDirection
+  selectedIds: number[]
+}>()
+
+const emit = defineEmits<{
+  open: [request: BookRequestItem]
+  approve: [request: BookRequestItem]
+  reject: [request: BookRequestItem]
+  cancel: [request: BookRequestItem]
+  dismiss: [request: BookRequestItem]
+  restore: [request: BookRequestItem]
+  remove: [request: BookRequestItem]
+  grab: [request: BookRequestItem]
+  sort: [field: BookRequestSortField]
+  'toggle-select': [request: BookRequestItem]
+  'toggle-select-all': []
+}>()
+
+const { t } = useI18n()
+
+const isCompact = computed(() => props.density === 'compact')
+
+const MEDIA_ICONS = { ebook: BookOpen, audiobook: Headphones, comic: Images } as const
+
+/** Literal classes, because Tailwind reads this file as text and never sees a class built at runtime. */
+const MEDIA_COLORS = {
+  ebook: 'text-[var(--pill-media-ebook)]',
+  audiobook: 'text-[var(--pill-media-audiobook)]',
+  comic: 'text-[var(--pill-media-comic)]',
+} as const
+
+function mediaIcon(request: BookRequestItem) {
+  return MEDIA_ICONS[request.mediaKind] ?? BookOpen
+}
+
+function mediaColor(request: BookRequestItem): string {
+  return MEDIA_COLORS[request.mediaKind] ?? 'text-muted-foreground'
+}
+
+/** The icon stands alone in the row, so the medium has to reach assistive tech some other way. */
+function mediaLabel(request: BookRequestItem): string {
+  return t(`bookRequests.mediaKind.${request.mediaKind}`)
+}
+
+function authorLine(request: BookRequestItem): string {
+  return request.authors.join(', ')
+}
+
+/** Reconcile socket progress with the latest fetched attempt before rendering a transfer bar. */
+function progressFor(request: BookRequestItem): { percent: number; done: number; total: number | null } | null {
+  const live = liveFor(request)
+  const download = request.download
+  if (!download) return null
+  const status = live?.status ?? download.status
+  if (status !== 'queued' && status !== 'downloading') return null
+  return {
+    percent: Math.max(0, Math.min(100, live?.progressPercent ?? download.progressPercent)),
+    done: live?.downloadedBytes ?? download.downloadedBytes,
+    total: live?.totalBytes ?? download.totalBytes,
+  }
+}
+
+/** Locale-formatted: where the percent sign goes, and whether it takes a space, is not universal. */
+function percentLabel(request: BookRequestItem): string {
+  return formatPercent((progressFor(request)?.percent ?? 0) / 100)
+}
+
+function liveFor(request: BookRequestItem): BookRequestProgressEvent | null {
+  return currentRequestProgress(request, props.progressByRequest[request.id])
+}
+
+function statusFor(request: BookRequestItem): BookRequestItem['status'] {
+  return requestPresentationStatus(request, liveFor(request))
+}
+
+function outcomeFor(request: BookRequestItem) {
+  return requestOutcome(request, liveFor(request), (iso) => formatRelativeFromNow(new Date(iso)))
+}
+
+/** Per row rather than computed: the list renders hundreds and each one asks about its own request. */
+function failureFor(request: BookRequestItem): string | null {
+  return requestFailureText(request, (key, named) => t(key, named))
+}
+
+/** Whether the reason describes something that went wrong, as opposed to something to do next. */
+function isFailure(request: BookRequestItem): boolean {
+  return outcomeFor(request).kind === 'failure'
+}
+
+function transferLine(request: BookRequestItem): string | null {
+  const progress = progressFor(request)
+  if (!progress?.total) return null
+  return t('bookRequests.download.transferred', { done: formatBytes(progress.done), total: formatBytes(progress.total) })
+}
+
+function isPending(request: BookRequestItem): boolean {
+  return request.status === 'pending'
+}
+
+function canGrab(request: BookRequestItem): boolean {
+  return props.canManage && isGrabbableBookRequestStatus(request.status)
+}
+
+/**
+ * A row with no destination library is still selectable: the endpoint names it in the failure list,
+ * which is more use than a checkbox that silently refuses to tick.
+ */
+function isSelectable(request: BookRequestItem): boolean {
+  return canBulkActRequest(request, props.canManage)
+}
+
+function isSelected(request: BookRequestItem): boolean {
+  return props.selectedIds.includes(request.id)
+}
+
+const selectableIds = computed(() => props.requests.filter(isSelectable).map((request) => request.id))
+const hasSelectableRows = computed(() => selectableIds.value.length > 0)
+const allSelected = computed(() => hasSelectableRows.value && selectableIds.value.every((id) => props.selectedIds.includes(id)))
+const someSelected = computed(() => selectableIds.value.some((id) => props.selectedIds.includes(id)))
+
+/** A settled row's actions stay reachable but stop competing with the rows that need a decision. */
+function actionsAreQuiet(request: BookRequestItem): boolean {
+  return !isPending(request) && !canGrab(request)
+}
+
+function ariaSort(field: BookRequestSortField): 'ascending' | 'descending' | 'none' {
+  if (props.sortBy !== field) return 'none'
+  return props.sortDir === 'asc' ? 'ascending' : 'descending'
+}
+
+function sortIcon(field: BookRequestSortField) {
+  if (props.sortBy !== field) return ChevronsUpDown
+  return props.sortDir === 'asc' ? ArrowUp : ArrowDown
+}
+
+function sortByTitle() {
+  emit('sort', 'title')
+}
+
+function sortByMediaKind() {
+  emit('sort', 'mediaKind')
+}
+
+function sortByRequester() {
+  emit('sort', 'requester')
+}
+
+function sortByAge() {
+  emit('sort', 'createdAt')
+}
+
+function sortByState() {
+  emit('sort', 'status')
+}
+
+function toggleSelectAll() {
+  emit('toggle-select-all')
+}
+
+function handleToggleSelect(request: BookRequestItem) {
+  emit('toggle-select', request)
+}
+
+function handleOpen(request: BookRequestItem) {
+  emit('open', request)
+}
+
+function handleApprove(request: BookRequestItem) {
+  emit('approve', request)
+}
+
+function handleReject(request: BookRequestItem) {
+  emit('reject', request)
+}
+
+function handleCancel(request: BookRequestItem) {
+  emit('cancel', request)
+}
+
+function handleDismiss(request: BookRequestItem) {
+  emit('dismiss', request)
+}
+
+function handleRestore(request: BookRequestItem) {
+  emit('restore', request)
+}
+
+function handleRemove(request: BookRequestItem) {
+  emit('remove', request)
+}
+
+function handleGrab(request: BookRequestItem) {
+  emit('grab', request)
+}
+</script>
+
+<template>
+  <div class="rounded-lg border border-border bg-card">
+    <!--
+      One list, two shapes. The table needs roughly 900px of columns before anything truncates, so
+      below `lg` the same rows stack rather than growing a horizontal scrollbar. Nothing wraps the
+      table in an overflow container on purpose: `overflow-x` would trap the sticky header inside a
+      box that never scrolls vertically, and the header would stop sticking.
+    -->
+    <table class="hidden w-full border-collapse text-sm lg:table">
+      <caption class="sr-only">
+        {{
+          t('bookRequests.table.caption')
+        }}
+      </caption>
+      <thead class="sticky top-0 z-10 bg-card">
+        <tr class="border-b border-border">
+          <th v-if="hasSelectableRows" scope="col" class="w-10 px-3 py-2.5">
+            <input
+              type="checkbox"
+              class="h-3.5 w-3.5 rounded border-border accent-primary"
+              :checked="allSelected"
+              :indeterminate.prop="someSelected && !allSelected"
+              :aria-label="t('bookRequests.table.selectAll')"
+              @change="toggleSelectAll"
+            />
+          </th>
+
+          <th scope="col" class="px-3 py-2.5 text-start" :aria-sort="ariaSort('title')">
+            <button
+              type="button"
+              class="inline-flex items-center gap-1 rounded text-xs font-semibold tracking-wide text-muted-foreground uppercase transition-colors hover:text-foreground focus-visible:ring-2 focus-visible:ring-ring focus-visible:outline-none motion-reduce:transition-none"
+              @click="sortByTitle"
+            >
+              {{ t('bookRequests.table.title') }}
+              <component :is="sortIcon('title')" :size="12" aria-hidden="true" />
+            </button>
+          </th>
+
+          <th scope="col" class="w-24 px-3 py-2.5 text-start" :aria-sort="ariaSort('mediaKind')">
+            <button
+              type="button"
+              class="inline-flex items-center gap-1 rounded text-xs font-semibold tracking-wide text-muted-foreground uppercase transition-colors hover:text-foreground focus-visible:ring-2 focus-visible:ring-ring focus-visible:outline-none motion-reduce:transition-none"
+              @click="sortByMediaKind"
+            >
+              {{ t('bookRequests.table.mediaKind') }}
+              <component :is="sortIcon('mediaKind')" :size="12" aria-hidden="true" />
+            </button>
+          </th>
+
+          <th scope="col" class="hidden w-36 px-3 py-2.5 text-start xl:table-cell" :aria-sort="ariaSort('requester')">
+            <button
+              type="button"
+              class="inline-flex items-center gap-1 rounded text-xs font-semibold tracking-wide text-muted-foreground uppercase transition-colors hover:text-foreground focus-visible:ring-2 focus-visible:ring-ring focus-visible:outline-none motion-reduce:transition-none"
+              @click="sortByRequester"
+            >
+              {{ t('bookRequests.table.requestedBy') }}
+              <component :is="sortIcon('requester')" :size="12" aria-hidden="true" />
+            </button>
+          </th>
+
+          <th scope="col" class="w-32 px-3 py-2.5 text-start" :aria-sort="ariaSort('createdAt')">
+            <button
+              type="button"
+              class="inline-flex items-center gap-1 rounded text-xs font-semibold tracking-wide text-muted-foreground uppercase transition-colors hover:text-foreground focus-visible:ring-2 focus-visible:ring-ring focus-visible:outline-none motion-reduce:transition-none"
+              @click="sortByAge"
+            >
+              {{ t('bookRequests.table.age') }}
+              <component :is="sortIcon('createdAt')" :size="12" aria-hidden="true" />
+            </button>
+          </th>
+
+          <th scope="col" class="w-40 px-3 py-2.5 text-start" :aria-sort="ariaSort('status')">
+            <button
+              type="button"
+              class="inline-flex items-center gap-1 rounded text-xs font-semibold tracking-wide text-muted-foreground uppercase transition-colors hover:text-foreground focus-visible:ring-2 focus-visible:ring-ring focus-visible:outline-none motion-reduce:transition-none"
+              @click="sortByState"
+            >
+              {{ t('bookRequests.table.state') }}
+              <component :is="sortIcon('status')" :size="12" aria-hidden="true" />
+            </button>
+          </th>
+
+          <th scope="col" class="w-72 px-3 py-2.5 text-start text-xs font-semibold tracking-wide text-muted-foreground uppercase">
+            {{ t('bookRequests.table.outcome') }}
+          </th>
+
+          <th scope="col" class="w-44 px-3 py-2.5">
+            <span class="sr-only">{{ t('bookRequests.table.actions') }}</span>
+          </th>
+        </tr>
+      </thead>
+
+      <tbody>
+        <tr
+          v-for="request in requests"
+          :key="request.id"
+          class="border-b border-border/60 hover:bg-muted/40"
+          :class="[isSelected(request) && 'bg-primary/8', request.dismissed && 'opacity-60']"
+        >
+          <td v-if="hasSelectableRows" class="px-3" :class="isCompact ? 'py-1.5' : 'py-2.5'">
+            <input
+              v-if="isSelectable(request)"
+              type="checkbox"
+              class="h-3.5 w-3.5 rounded border-border accent-primary"
+              :checked="isSelected(request)"
+              :aria-label="t('bookRequests.table.selectRow', { title: request.title })"
+              @change="handleToggleSelect(request)"
+            />
+          </td>
+
+          <td class="px-3" :class="isCompact ? 'py-1.5' : 'py-2.5'">
+            <div class="flex min-w-0 items-center gap-2.5">
+              <RequestCover
+                :src="request.coverUrl"
+                :media-kind="request.mediaKind"
+                :class="isCompact ? 'h-8 w-[22px]' : 'h-[46px] w-8'"
+                :icon-size="isCompact ? 11 : 14"
+              />
+              <div class="min-w-0">
+                <div class="flex min-w-0 items-center gap-2">
+                  <button
+                    type="button"
+                    class="min-w-0 truncate text-start font-medium text-foreground hover:underline focus-visible:underline focus-visible:outline-none"
+                    @click="handleOpen(request)"
+                  >
+                    {{ request.title }}
+                  </button>
+                  <RouterLink
+                    v-if="request.status === 'available' && request.matchedBookId !== null"
+                    :to="{ name: 'book-detail', params: { bookId: request.matchedBookId } }"
+                    class="inline-flex shrink-0 rounded-sm text-muted-foreground transition-colors hover:text-foreground focus-visible:ring-2 focus-visible:ring-ring focus-visible:outline-none motion-reduce:transition-none"
+                    :title="t('book.actions.bookDetails')"
+                  >
+                    <ExternalLink :size="14" aria-hidden="true" />
+                    <span class="sr-only">{{ t('book.actions.bookDetails') }}</span>
+                  </RouterLink>
+                </div>
+                <span v-if="authorLine(request)" class="block truncate text-xs text-muted-foreground">{{ authorLine(request) }}</span>
+              </div>
+            </div>
+          </td>
+
+          <td class="px-3" :class="isCompact ? 'py-1.5' : 'py-2.5'">
+            <span class="inline-flex" :title="mediaLabel(request)">
+              <component :is="mediaIcon(request)" :size="16" :class="mediaColor(request)" aria-hidden="true" />
+              <span class="sr-only">{{ mediaLabel(request) }}</span>
+            </span>
+          </td>
+
+          <!--
+            `max-w-0` with the header's `w-36`: an auto-layout table sizes a column to its widest
+            content, so `truncate` alone never fires here and one long display name takes its width
+            out of Title instead. Zero maximum plus a stated width is what holds the column still.
+          -->
+          <td class="hidden max-w-0 truncate px-3 text-muted-foreground xl:table-cell" :class="isCompact ? 'py-1.5' : 'py-2.5'">
+            <span :title="request.requesterName">{{ request.requesterName }}</span>
+          </td>
+
+          <td class="px-3 text-xs text-muted-foreground whitespace-nowrap tabular-nums" :class="isCompact ? 'py-1.5' : 'py-2.5'">
+            {{ formatRelativeFromNow(new Date(request.createdAt)) }}
+          </td>
+
+          <!-- Pipeline and State were two columns saying one thing; the stage bar rides the chip. -->
+          <td class="px-3" :class="isCompact ? 'py-1.5' : 'py-2.5'">
+            <div class="inline-flex flex-col items-start gap-2">
+              <!--
+                The self-serve marker rides beside the chip rather than under it. Stacked, it added a
+                line to this cell and left the table ragged: rows carrying it stood 19px taller than
+                rows that did not. The column has room for a chip plus an icon and not for a chip
+                plus a second pill, so the label moves into the tooltip and the screen-reader text.
+              -->
+              <div class="inline-flex items-center gap-1.5">
+                <RequestStatusBadge :status="statusFor(request)" />
+                <span v-if="request.selfServe" class="inline-flex text-muted-foreground" :title="t('bookRequests.selfServeBadgeHint')">
+                  <Zap :size="12" aria-hidden="true" />
+                  <span class="sr-only">{{ t('bookRequests.selfServeBadge') }}</span>
+                </span>
+              </div>
+              <RequestPipeline v-if="!isCompact" :request="request" :live="liveFor(request)" compact />
+              <span v-if="request.dismissed" class="inline-flex items-center gap-1 text-xs text-muted-foreground">
+                <EyeOff :size="11" aria-hidden="true" />
+                {{ t('bookRequests.card.dismissedBadge') }}
+              </span>
+            </div>
+          </td>
+
+          <td class="px-3 text-xs" :class="isCompact ? 'py-1.5' : 'py-2.5'">
+            <template v-if="outcomeFor(request).kind === 'progress'">
+              <div
+                class="h-1.5 w-full max-w-24 overflow-hidden rounded-full bg-muted"
+                role="progressbar"
+                :aria-valuenow="progressFor(request)?.percent ?? 0"
+                aria-valuemin="0"
+                aria-valuemax="100"
+                :aria-label="t('bookRequests.download.progressLabel', { title: request.title })"
+              >
+                <div
+                  class="h-full rounded-full bg-primary transition-[width] duration-500 motion-reduce:transition-none"
+                  :style="{ width: `${progressFor(request)?.percent ?? 0}%` }"
+                />
+              </div>
+              <p class="mt-1 text-muted-foreground tabular-nums">
+                {{ percentLabel(request) }}
+                <template v-if="transferLine(request)">&middot; {{ transferLine(request) }}</template>
+              </p>
+            </template>
+
+            <p v-else-if="isFailure(request)" class="line-clamp-2 text-destructive">
+              {{ failureFor(request) ?? t('bookRequests.outcome.failedUnknown') }}
+            </p>
+
+            <!--
+              A request automation handed back is still `approved`, and the stage line for that state
+              reads "Looking for a release" - which is the one thing nothing is doing for it. When
+              there is a reason on the row, the reason is the outcome.
+            -->
+            <p v-else-if="failureFor(request)" class="line-clamp-2 text-muted-foreground">
+              {{ failureFor(request) }}
+            </p>
+
+            <p v-else class="text-muted-foreground">
+              {{ t(`bookRequests.outcome.${outcomeFor(request).key}`, outcomeFor(request).params ?? {}) }}
+            </p>
+          </td>
+
+          <td class="px-3" :class="isCompact ? 'py-1.5' : 'py-2.5'">
+            <div
+              class="flex items-center justify-end gap-1"
+              :class="
+                actionsAreQuiet(request) && 'opacity-60 transition-opacity focus-within:opacity-100 hover:opacity-100 motion-reduce:transition-none'
+              "
+            >
+              <RequestRowActions
+                :request="request"
+                :can-manage="canManage"
+                :can-self-fulfil="canSelfFulfil"
+                :current-user-id="currentUserId"
+                :busy="busyIds.has(request.id)"
+                @open="handleOpen"
+                @approve="handleApprove"
+                @reject="handleReject"
+                @grab="handleGrab"
+                @dismiss="handleDismiss"
+                @restore="handleRestore"
+                @cancel="handleCancel"
+                @remove="handleRemove"
+              />
+            </div>
+          </td>
+        </tr>
+      </tbody>
+    </table>
+
+    <!-- Below `lg` the same rows stack. Same data, same actions, no second component to keep in step. -->
+    <ul class="divide-y divide-border/60 lg:hidden">
+      <li v-for="request in requests" :key="request.id" class="p-3" :class="request.dismissed && 'opacity-60'">
+        <div class="flex min-w-0 gap-3">
+          <input
+            v-if="isSelectable(request)"
+            type="checkbox"
+            class="mt-1 h-3.5 w-3.5 shrink-0 rounded border-border accent-primary"
+            :checked="isSelected(request)"
+            :aria-label="t('bookRequests.table.selectRow', { title: request.title })"
+            @change="handleToggleSelect(request)"
+          />
+          <RequestCover :src="request.coverUrl" :media-kind="request.mediaKind" class="h-[54px] w-9" :icon-size="16" />
+
+          <div class="min-w-0 flex-1 space-y-1.5">
+            <div class="flex min-w-0 items-center gap-2">
+              <button
+                type="button"
+                class="min-w-0 truncate text-start font-medium text-foreground hover:underline focus-visible:underline focus-visible:outline-none"
+                @click="handleOpen(request)"
+              >
+                {{ request.title }}
+              </button>
+              <RouterLink
+                v-if="request.status === 'available' && request.matchedBookId !== null"
+                :to="{ name: 'book-detail', params: { bookId: request.matchedBookId } }"
+                class="inline-flex shrink-0 rounded-sm text-muted-foreground transition-colors hover:text-foreground focus-visible:ring-2 focus-visible:ring-ring focus-visible:outline-none motion-reduce:transition-none"
+                :title="t('book.actions.bookDetails')"
+              >
+                <ExternalLink :size="14" aria-hidden="true" />
+                <span class="sr-only">{{ t('book.actions.bookDetails') }}</span>
+              </RouterLink>
+            </div>
+            <p v-if="authorLine(request)" class="truncate text-xs text-muted-foreground">{{ authorLine(request) }}</p>
+
+            <div class="flex flex-wrap items-center gap-2">
+              <RequestStatusBadge :status="statusFor(request)" />
+              <span
+                v-if="request.selfServe"
+                class="inline-flex items-center gap-1 rounded-full border border-border px-1.5 py-0.5 text-xs text-muted-foreground"
+                :title="t('bookRequests.selfServeBadgeHint')"
+              >
+                <Zap :size="11" aria-hidden="true" />
+                {{ t('bookRequests.selfServeBadge') }}
+              </span>
+              <span class="inline-flex" :title="mediaLabel(request)">
+                <component :is="mediaIcon(request)" :size="15" :class="mediaColor(request)" aria-hidden="true" />
+                <span class="sr-only">{{ mediaLabel(request) }}</span>
+              </span>
+              <span class="text-xs text-muted-foreground">
+                {{ t('bookRequests.card.requestedByAt', { name: request.requesterName, time: formatRelativeFromNow(new Date(request.createdAt)) }) }}
+              </span>
+            </div>
+
+            <!--
+              A reason is no longer proof of a failure. Automation now hands a request back with one
+              written on it while the row sits at `approved`, and rendering that in alarm red under a
+              blue chip says two different things about the same row.
+            -->
+            <p
+              v-if="failureFor(request)"
+              class="flex items-start gap-1.5 text-xs"
+              :class="isFailure(request) ? 'text-destructive' : 'text-muted-foreground'"
+            >
+              <TriangleAlert v-if="isFailure(request)" :size="12" class="mt-0.5 shrink-0" aria-hidden="true" />
+              <span class="line-clamp-2">{{ failureFor(request) }}</span>
+            </p>
+            <p v-else-if="outcomeFor(request).kind === 'progress'" class="text-xs text-muted-foreground tabular-nums">
+              {{ percentLabel(request) }}
+              <template v-if="transferLine(request)">&middot; {{ transferLine(request) }}</template>
+            </p>
+            <p v-else class="text-xs text-muted-foreground">
+              {{ t(`bookRequests.outcome.${outcomeFor(request).key}`, outcomeFor(request).params ?? {}) }}
+            </p>
+          </div>
+
+          <div class="flex shrink-0 flex-col items-end gap-1.5">
+            <RequestRowActions
+              :request="request"
+              :can-manage="canManage"
+              :can-self-fulfil="canSelfFulfil"
+              :current-user-id="currentUserId"
+              :busy="busyIds.has(request.id)"
+              @open="handleOpen"
+              @approve="handleApprove"
+              @reject="handleReject"
+              @grab="handleGrab"
+              @dismiss="handleDismiss"
+              @restore="handleRestore"
+              @cancel="handleCancel"
+              @remove="handleRemove"
+            />
+          </div>
+        </div>
+      </li>
+    </ul>
+  </div>
+</template>
diff --git a/client/src/features/book-requests/components/RequestPipeline.vue b/client/src/features/book-requests/components/RequestPipeline.vue
new file mode 100644
index 000000000..b3b9730ba
--- /dev/null
+++ b/client/src/features/book-requests/components/RequestPipeline.vue
@@ -0,0 +1,106 @@
+<script setup lang="ts">
+import { computed } from 'vue'
+import { useI18n } from 'vue-i18n'
+import { Check } from '@lucide/vue'
+import type { BookRequestItem, BookRequestProgressEvent } from '@bookorbit/types'
+import { REQUEST_PIPELINE_STEPS, requestPipelineState, requestStepState, type RequestPipelineTone } from '../requestPipeline'
+
+const props = withDefaults(
+  defineProps<{
+    request: Pick<BookRequestItem, 'status' | 'download'>
+    live?: BookRequestProgressEvent | null
+    /** The table rendering: five segments, no labels, same state model. */
+    compact?: boolean
+  }>(),
+  { compact: false, live: null },
+)
+
+const { t } = useI18n()
+
+/** Semantic, not decorative: a halted request has to read as halted without the label. */
+const TONE_CLASS: Record<RequestPipelineTone, string> = {
+  waiting: 'text-warning',
+  progress: 'text-info',
+  done: 'text-success',
+  failed: 'text-destructive',
+  stopped: 'text-muted-foreground',
+}
+
+const state = computed(() => requestPipelineState(props.request, props.live))
+const toneClass = computed(() => TONE_CLASS[state.value.tone])
+const steps = computed(() =>
+  REQUEST_PIPELINE_STEPS.map((step, index) => ({
+    step,
+    index,
+    label: t(`bookRequests.pipeline.steps.${step}`),
+    state: requestStepState(state.value, index),
+  })),
+)
+
+const currentLabel = computed(() => steps.value[state.value.currentIndex]?.label ?? '')
+
+/** Colour is never the only carrier, so the whole bar has one sentence behind it. */
+const summary = computed(() => {
+  if (state.value.tone === 'done') return t('bookRequests.pipeline.summary.done')
+  return t(`bookRequests.pipeline.summary.${state.value.tone}`, { step: currentLabel.value })
+})
+</script>
+
+<template>
+  <ol v-if="compact" class="flex items-center gap-0.5" :class="toneClass" :aria-label="summary">
+    <li
+      v-for="entry in steps"
+      :key="entry.step"
+      class="h-1 w-3.5 rounded-full"
+      :class="[
+        entry.state === 'done' && 'bg-current',
+        entry.state === 'current' && 'bg-current ring-2 ring-current/25',
+        entry.state === 'upcoming' && 'bg-border',
+      ]"
+    />
+  </ol>
+
+  <div v-else class="flex flex-col gap-1.5">
+    <ol class="flex items-center" :class="toneClass" :aria-label="t('bookRequests.pipeline.label')">
+      <li
+        v-for="entry in steps"
+        :key="entry.step"
+        class="flex items-center"
+        :class="entry.index < steps.length - 1 ? 'flex-1' : 'shrink-0'"
+        :aria-current="entry.state === 'current' ? 'step' : undefined"
+      >
+        <span
+          class="flex size-3.5 shrink-0 items-center justify-center rounded-full border-2 transition-colors motion-reduce:transition-none"
+          :class="[
+            entry.state === 'done' && 'border-current bg-current',
+            entry.state === 'current' && 'border-current bg-card ring-4 ring-current/20',
+            entry.state === 'upcoming' && 'border-border bg-card',
+          ]"
+        >
+          <Check v-if="entry.state === 'done'" :size="8" :stroke-width="4" class="text-card" aria-hidden="true" />
+          <span v-else-if="entry.state === 'current'" class="size-1.5 rounded-full bg-current" />
+        </span>
+        <span v-if="entry.index < steps.length - 1" class="h-0.5 flex-1" :class="entry.state === 'done' ? 'bg-current' : 'bg-border'" />
+      </li>
+    </ol>
+
+    <!-- Five labels do not fit a phone, so below sm only the stage in play is named. -->
+    <ol class="hidden sm:flex" aria-hidden="true">
+      <li
+        v-for="entry in steps"
+        :key="entry.step"
+        class="pe-1 text-[10.5px] leading-tight"
+        :class="[
+          entry.index < steps.length - 1 ? 'flex-1' : 'shrink-0 pe-0 text-end',
+          entry.state === 'current' ? `font-semibold ${toneClass}` : 'text-muted-foreground',
+        ]"
+      >
+        {{ entry.label }}
+      </li>
+    </ol>
+
+    <p class="text-[11px] font-semibold sm:hidden" :class="toneClass" aria-hidden="true">{{ currentLabel }}</p>
+
+    <p class="sr-only">{{ summary }}</p>
+  </div>
+</template>
diff --git a/client/src/features/book-requests/components/RequestReviewPanel.vue b/client/src/features/book-requests/components/RequestReviewPanel.vue
new file mode 100644
index 000000000..d5bcb0777
--- /dev/null
+++ b/client/src/features/book-requests/components/RequestReviewPanel.vue
@@ -0,0 +1,145 @@
+<script setup lang="ts">
+import { computed } from 'vue'
+import { useI18n } from 'vue-i18n'
+import { Check, FileText, Image, Loader2, Minus, Paperclip, Tags, Trash2, X } from '@lucide/vue'
+import type { BookRequestReview, BookRequestReviewFile, BookRequestVerificationRow } from '@bookorbit/types'
+import { Button } from '@/components/ui/button'
+import { formatBytes } from '@/lib/formatting'
+
+const props = defineProps<{
+  review: BookRequestReview
+  canManage: boolean
+  busy: boolean
+}>()
+
+const emit = defineEmits<{ file: []; discard: [] }>()
+
+const { t } = useI18n()
+
+const ROLE_ICONS = { content: FileText, cover: Image, metadata: Tags, supplement: Paperclip } as const
+
+const VERDICT_ICONS = { match: Check, mismatch: X, unknown: Minus } as const
+
+/** Only the mismatch is coloured. A tick in green beside every matching field is just noise. */
+const VERDICT_CLASSES = { match: 'text-muted-foreground', mismatch: 'text-destructive', unknown: 'text-muted-foreground' } as const
+
+const verification = computed(() => props.review.verification)
+/** Both pointers to the dock entry are `on delete set null`, so a hand-filed one leaves nothing. */
+const entryGone = computed(() => props.review.bookDockFileId === null)
+
+const headline = computed(() => {
+  const detail = verification.value
+  if (!detail) return t('bookRequests.review.verificationOff')
+  return detail.passed
+    ? t('bookRequests.review.scoreClears', { score: detail.score, threshold: detail.threshold })
+    : t('bookRequests.review.scoreShort', { score: detail.score, threshold: detail.threshold })
+})
+
+const filesSummary = computed(() => {
+  const count = t('bookRequests.review.fileCount', { count: props.review.files.length })
+  return props.review.totalSizeBytes === null ? count : `${count} · ${formatBytes(props.review.totalSizeBytes)}`
+})
+
+/** Both sides empty says more as one line than as two rows of "Not set". */
+function isAbsent(row: BookRequestVerificationRow): boolean {
+  return row.requested === null && row.imported === null
+}
+
+function fileDetail(file: BookRequestReviewFile): string {
+  const parts: string[] = []
+  if (file.format) parts.push(file.format.toUpperCase())
+  if (file.fileSize !== null) parts.push(formatBytes(file.fileSize))
+  if (file.role !== 'content') parts.push(t(`bookRequests.review.role.${file.role}`))
+  return parts.join(' · ')
+}
+
+function handleFile() {
+  emit('file')
+}
+
+function handleDiscard() {
+  emit('discard')
+}
+</script>
+
+<template>
+  <section class="rounded-lg border border-border bg-card p-4" :aria-label="t('bookRequests.review.title')">
+    <h3 class="text-xs font-semibold tracking-wide text-muted-foreground uppercase">{{ t('bookRequests.review.title') }}</h3>
+
+    <template v-if="entryGone">
+      <p class="mt-2 text-sm text-foreground">{{ t('bookRequests.review.missingEntry') }}</p>
+      <p class="mt-1 text-sm text-muted-foreground">{{ t('bookRequests.review.missingEntryNext') }}</p>
+    </template>
+
+    <template v-else>
+      <p class="mt-2 text-sm text-foreground">{{ headline }}</p>
+      <p v-if="verification" class="mt-1 text-sm text-muted-foreground">{{ t(`bookRequests.review.reason.${verification.reason}`) }}</p>
+
+      <dl v-if="verification" class="mt-4 grid gap-3">
+        <div v-for="row in verification.rows" :key="row.field" class="grid gap-1 border-t border-border pt-3 first:border-t-0 first:pt-0">
+          <dt class="flex items-center gap-1.5 text-xs font-medium tracking-wide text-muted-foreground uppercase">
+            <component :is="VERDICT_ICONS[row.verdict]" :size="13" :class="VERDICT_CLASSES[row.verdict]" aria-hidden="true" />
+            {{ t(`bookRequests.review.field.${row.field}`) }}
+            <span class="sr-only">{{ t(`bookRequests.review.verdict.${row.verdict}`) }}</span>
+          </dt>
+
+          <dd v-if="isAbsent(row)" class="text-sm text-muted-foreground">{{ t('bookRequests.review.absent') }}</dd>
+          <dd v-else class="grid gap-1 @md:grid-cols-2">
+            <span class="grid gap-0.5">
+              <span class="text-xs text-muted-foreground">{{ t('bookRequests.review.requested') }}</span>
+              <span class="break-words text-sm text-foreground">{{ row.requested ?? t('bookRequests.review.notSet') }}</span>
+            </span>
+            <span class="grid gap-0.5">
+              <span class="text-xs text-muted-foreground">{{ t('bookRequests.review.imported') }}</span>
+              <span class="break-words text-sm" :class="row.verdict === 'mismatch' ? 'text-destructive' : 'text-foreground'">
+                {{ row.imported ?? t('bookRequests.review.notSet') }}
+              </span>
+            </span>
+          </dd>
+        </div>
+      </dl>
+
+      <h4 class="mt-4 border-t border-border pt-3 text-xs font-semibold tracking-wide text-muted-foreground uppercase">
+        {{ t('bookRequests.review.filesTitle') }}
+      </h4>
+      <p class="mt-1 text-xs text-muted-foreground">{{ filesSummary }}</p>
+
+      <ul class="mt-2 grid gap-1">
+        <li v-for="file in props.review.files" :key="file.fileName" class="flex items-start gap-2 rounded-md border border-border p-2">
+          <component :is="ROLE_ICONS[file.role]" :size="15" class="mt-0.5 shrink-0 text-muted-foreground" aria-hidden="true" />
+          <span class="min-w-0 flex-1">
+            <span class="block break-all text-sm text-foreground">{{ file.fileName }}</span>
+            <span v-if="fileDetail(file)" class="block text-xs text-muted-foreground">{{ fileDetail(file) }}</span>
+          </span>
+        </li>
+      </ul>
+
+      <template v-if="props.canManage">
+        <p v-if="!props.review.canFile" class="mt-3 text-sm text-muted-foreground">{{ t('bookRequests.review.noDestination') }}</p>
+        <div class="mt-3 flex flex-wrap items-center gap-3">
+          <Button :disabled="!props.review.canFile || props.busy" @click="handleFile">
+            <Loader2 v-if="props.busy" class="size-4 animate-spin" aria-hidden="true" />
+            {{ t('bookRequests.review.fileAnyway') }}
+          </Button>
+          <!--
+            The other answer, beside the first rather than behind a menu: a held import is a
+            question with exactly two answers, and until this existed the only way to say "wrong
+            book" was to cancel the request and leave the dock entry behind as an orphan.
+          -->
+          <Button variant="destructive-outline" :disabled="props.busy" @click="handleDiscard">
+            <Trash2 :size="15" aria-hidden="true" />
+            {{ t('bookRequests.review.discard') }}
+          </Button>
+          <RouterLink
+            :to="{ name: 'book-dock' }"
+            class="rounded-sm text-sm text-muted-foreground underline underline-offset-2 hover:text-foreground focus-visible:ring-[3px] focus-visible:ring-ring/50 focus-visible:outline-none"
+          >
+            {{ t('bookRequests.review.openDock') }}
+          </RouterLink>
+        </div>
+        <p class="mt-2 text-xs text-muted-foreground">{{ t('bookRequests.review.fileAnywayHint') }}</p>
+        <p class="mt-1 text-xs text-muted-foreground">{{ t('bookRequests.review.discardHint') }}</p>
+      </template>
+    </template>
+  </section>
+</template>
diff --git a/client/src/features/book-requests/components/RequestRowActions.vue b/client/src/features/book-requests/components/RequestRowActions.vue
new file mode 100644
index 000000000..ecba7ff51
--- /dev/null
+++ b/client/src/features/book-requests/components/RequestRowActions.vue
@@ -0,0 +1,109 @@
+<script setup lang="ts">
+import { computed } from 'vue'
+import { useI18n } from 'vue-i18n'
+import { Ellipsis } from '@lucide/vue'
+import { isGrabbableBookRequestStatus } from '@bookorbit/types'
+import type { BookRequestItem } from '@bookorbit/types'
+import { Button } from '@/components/ui/button'
+import { DropdownMenu, DropdownMenuContent, DropdownMenuItem, DropdownMenuTrigger } from '@/components/ui/dropdown-menu'
+import { canCancelRequest, canDeleteRequest, canDismissRequest } from '../requestActions'
+
+/**
+ * The actions one request row offers: the one thing to do next, and everything else behind a menu.
+ *
+ * Extracted because the list renders in two shapes - a table above `lg` and stacked cards below -
+ * and both need exactly this cluster. Written out twice it drifted: the same six menu items in the
+ * same order, differing only in where the line breaks fell. Layout stays with the caller, which is
+ * the only part that genuinely differs between the two.
+ */
+const props = defineProps<{
+  request: BookRequestItem
+  canManage: boolean
+  /** Whether the viewer may drive fulfilment on rows that are theirs to drive. */
+  canSelfFulfil: boolean
+  currentUserId: number | null
+  busy: boolean
+}>()
+
+const emit = defineEmits<{
+  open: [request: BookRequestItem]
+  approve: [request: BookRequestItem]
+  reject: [request: BookRequestItem]
+  cancel: [request: BookRequestItem]
+  dismiss: [request: BookRequestItem]
+  restore: [request: BookRequestItem]
+  remove: [request: BookRequestItem]
+  grab: [request: BookRequestItem]
+}>()
+
+const { t } = useI18n()
+
+const isPending = computed(() => props.request.status === 'pending')
+const canApprove = computed(() => props.canManage && isPending.value)
+const canGrab = computed(() => props.canManage && isGrabbableBookRequestStatus(props.request.status))
+const canCancel = computed(() => canCancelRequest(props.request, props.currentUserId, props.canManage, props.canSelfFulfil))
+const canDismiss = computed(() => canDismissRequest(props.request))
+const canDelete = computed(() => canDeleteRequest(props.request, props.canManage))
+
+function handleOpen() {
+  emit('open', props.request)
+}
+
+function handleApprove() {
+  emit('approve', props.request)
+}
+
+function handleReject() {
+  emit('reject', props.request)
+}
+
+function handleCancel() {
+  emit('cancel', props.request)
+}
+
+function handleDismiss() {
+  emit('dismiss', props.request)
+}
+
+function handleRestore() {
+  emit('restore', props.request)
+}
+
+function handleRemove() {
+  emit('remove', props.request)
+}
+
+function handleGrab() {
+  emit('grab', props.request)
+}
+</script>
+
+<template>
+  <Button v-if="canApprove" size="sm" :disabled="busy" @click="handleApprove">{{ t('bookRequests.actions.approve') }}</Button>
+  <Button v-else-if="canGrab" variant="outline" size="sm" :disabled="busy" @click="handleGrab">{{ t('bookRequests.actions.grab') }}</Button>
+  <Button v-else variant="outline" size="sm" @click="handleOpen">{{ t('bookRequests.card.details') }}</Button>
+
+  <DropdownMenu>
+    <DropdownMenuTrigger as-child>
+      <Button variant="ghost" size="icon-sm" :aria-label="t('bookRequests.card.moreActions', { title: request.title })">
+        <Ellipsis :size="15" aria-hidden="true" />
+      </Button>
+    </DropdownMenuTrigger>
+    <DropdownMenuContent align="end">
+      <DropdownMenuItem v-if="canApprove" :disabled="busy" @click="handleReject">{{ t('bookRequests.actions.reject') }}</DropdownMenuItem>
+      <DropdownMenuItem v-if="canGrab && !isPending" :disabled="busy" @click="handleGrab">{{ t('bookRequests.actions.grab') }}</DropdownMenuItem>
+      <DropdownMenuItem v-if="canDismiss && !request.dismissed" :disabled="busy" @click="handleDismiss">
+        {{ t('bookRequests.actions.dismiss') }}
+      </DropdownMenuItem>
+      <DropdownMenuItem v-if="canDismiss && request.dismissed" :disabled="busy" @click="handleRestore">
+        {{ t('bookRequests.actions.restore') }}
+      </DropdownMenuItem>
+      <DropdownMenuItem v-if="canCancel" variant="destructive" :disabled="busy" @click="handleCancel">
+        {{ t('bookRequests.actions.cancel') }}
+      </DropdownMenuItem>
+      <DropdownMenuItem v-if="canDelete" variant="destructive" :disabled="busy" @click="handleRemove">
+        {{ t('bookRequests.actions.delete') }}
+      </DropdownMenuItem>
+    </DropdownMenuContent>
+  </DropdownMenu>
+</template>
diff --git a/client/src/features/book-requests/components/RequestSearchPanel.vue b/client/src/features/book-requests/components/RequestSearchPanel.vue
new file mode 100644
index 000000000..fc89c3b44
--- /dev/null
+++ b/client/src/features/book-requests/components/RequestSearchPanel.vue
@@ -0,0 +1,1037 @@
+<script setup lang="ts">
+import { computed, onMounted, onUnmounted, ref, watch } from 'vue'
+import { useI18n } from 'vue-i18n'
+import { useRoute, useRouter, type LocationQuery } from 'vue-router'
+import {
+  BookOpen,
+  Check,
+  ChevronDown,
+  CircleHelp,
+  Headphones,
+  Images,
+  Library,
+  Loader2,
+  Pin,
+  Search,
+  SlidersHorizontal,
+  User,
+  Users,
+} from '@lucide/vue'
+import {
+  AUDIO_FORMAT_LIST,
+  BOOK_REQUEST_MEDIA_KINDS,
+  canonicalizeBookRequestIsbn,
+  COMIC_FORMAT_LIST,
+  EBOOK_FORMAT_LIST,
+  isBookRequestFulfiller,
+  isGrabbableBookRequestStatus,
+  MAX_BOOK_REQUEST_SEARCH_ISBNS,
+  Permission,
+} from '@bookorbit/types'
+import type {
+  BookRequestMediaKind,
+  BookRequestMetadataSource,
+  BookRequestSubmitResult,
+  MetadataCandidate,
+  MetadataProviderKey,
+} from '@bookorbit/types'
+import { Button } from '@/components/ui/button'
+import { Popover, PopoverContent, PopoverTrigger } from '@/components/ui/popover'
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuLabel,
+  DropdownMenuSeparator,
+  DropdownMenuTrigger,
+} from '@/components/ui/dropdown-menu'
+import { toast } from 'vue-sonner'
+import { useAuth } from '@/features/auth/composables/useAuth'
+import { usePermissions } from '@/features/auth/composables/usePermissions'
+import { useMetadataSearch } from '@/features/book/composables/useMetadataSearch'
+import { providerIconPathSafe } from '@/features/book/lib/provider-icons'
+import { useLibraries } from '@/features/library/composables/useLibraries'
+import { getProviderColor } from '@/lib/provider-colors'
+import { useCandidateGroups, type CandidateGroup, type CandidateIsbnChoice } from '../composables/useCandidateGroups'
+import { formatLanguageName } from '@/i18n/formatters'
+import { requestLanguageOptions, useRequestDestinationDefault, useRequestLanguageDefault } from '../composables/useRequestDestinationDefault'
+import { submitFailureText, useRequestSubmission } from '../composables/useRequestSubmission'
+import RequestCover from './RequestCover.vue'
+
+const emit = defineEmits<{ submitted: [] }>()
+
+const { t, locale } = useI18n()
+const { filteredResults, coverProviderOrder, resultProviderOrder, interruptedProviders, isStreaming, hasSearched, providers, loadProviders, search } =
+  useMetadataSearch()
+const { libraries, fetchLibraries } = useLibraries()
+const { hasPermission } = usePermissions()
+const { user } = useAuth()
+const router = useRouter()
+const route = useRoute()
+const { lastFailure, submitting, mediaKind, annotate, getAvailability, submit, submitFreeText, checkFreeText, candidateKey } = useRequestSubmission()
+const { load: loadDefaultDestination, defaultFor: instanceDefaultFor, resolveDestination } = useRequestDestinationDefault()
+const {
+  defaultLanguage,
+  isSaving: savingLanguage,
+  load: loadLanguageDefault,
+  setDefault: setLanguageDefault,
+  resolveLanguage,
+} = useRequestLanguageDefault()
+
+const MEDIA_ICONS = { ebook: BookOpen, audiobook: Headphones, comic: Images } as const
+
+/**
+ * What each medium may be asked for, taken from the shared lists rather than restated here, so the
+ * form can never offer a format the scorer does not know how to recognise.
+ */
+const FORMATS_BY_MEDIA: Record<BookRequestMediaKind, readonly string[]> = {
+  ebook: EBOOK_FORMAT_LIST,
+  audiobook: AUDIO_FORMAT_LIST,
+  comic: COMIC_FORMAT_LIST,
+}
+
+const title = ref('')
+const author = ref('')
+const language = ref<string | null>(null)
+/**
+ * A preference, not a filter: a release in another format still appears, it simply scores lower.
+ * Kept per medium, because "epub" means nothing to an audiobook search and clearing the whole set
+ * on every media-kind press would throw away a choice the requester had just made.
+ */
+const preferredFormats = ref<Record<BookRequestMediaKind, string[]>>({ ebook: [], audiobook: [], comic: [] })
+const note = ref('')
+const optionsOpen = ref(false)
+const targetLibraryId = ref<number | null>(null)
+const targetFolderId = ref<number | null>(null)
+const activeCoverUrls = ref<Record<string, string | null>>({})
+const failedProviderIcons = ref(new Set<MetadataProviderKey>())
+const expandedMetadataGroups = ref(new Set<string>())
+const { groups } = useCandidateGroups(filteredResults, mediaKind, getAvailability, coverProviderOrder, language, resultProviderOrder)
+
+// Nobody approves these requests afterwards, so this is the only chance to say where the book goes.
+const autoApproves = computed(() => hasPermission(Permission.BookRequestAutoApprove))
+/** May download it now rather than asking for it, and pick the release by hand on the next screen. */
+const selfFulfils = computed(() => hasPermission(Permission.BookRequestSelfFulfill))
+const fulfillmentMode = ref<'automatic' | 'choose_release'>('automatic')
+const canChooseFulfillment = computed(() => autoApproves.value && selfFulfils.value)
+const choosesRelease = computed(() => selfFulfils.value && (!autoApproves.value || fulfillmentMode.value === 'choose_release'))
+/**
+ * Either way there is no second pair of eyes, so every destination rule below reads from this
+ * rather than from auto-approval alone: the select is shown, an unset destination is fatal, and a
+ * single library is worth preselecting.
+ */
+const settlesOnCreate = computed(() => autoApproves.value || selfFulfils.value)
+const selectedLibrary = computed(() => libraries.value.find((library) => library.id === targetLibraryId.value) ?? null)
+const folders = computed(() => selectedLibrary.value?.folders ?? [])
+const showDestination = computed(() => settlesOnCreate.value || libraries.value.length > 1)
+/**
+ * Nowhere for the book to go, which for an auto-approving requester is fatal: nobody decides on
+ * their request afterwards, so there is no later point where a destination could be picked.
+ *
+ * The instance default counts. It is applied server-side when the form names nothing, so leaving
+ * the select on "Default (Novels)" is a destination, not the absence of one; treating it as
+ * missing is what disabled every Request button on an instance that had defaults set.
+ */
+const destinationMissing = computed(
+  () => settlesOnCreate.value && targetLibraryId.value === null && instanceDefaultFor(mediaKind.value).libraryId === null,
+)
+
+const canSearch = computed(() => title.value.trim() !== '' || author.value.trim() !== '')
+
+/**
+ * What "no library chosen" actually means for this medium. The instance default is applied by the
+ * server, so without naming it here the requester submits with no idea where the book lands.
+ */
+const unpickedDestinationLabel = computed(() => {
+  const fallback = instanceDefaultFor(mediaKind.value)
+  if (fallback.libraryName !== null) return t('bookRequests.search.libraryDefault', { library: fallback.libraryName })
+  return settlesOnCreate.value ? t('bookRequests.search.libraryChoose') : t('bookRequests.search.libraryAny')
+})
+
+const isLanguagePinned = computed(() => language.value !== null && defaultLanguage.value === language.value)
+
+const languageOptions = computed(() => requestLanguageOptions(locale.value))
+
+onMounted(async () => {
+  await Promise.all([loadProviders(), fetchLibraries(), loadDefaultDestination(), loadLanguageDefault()])
+  // Your own interface language, until you pin one. Never the edition's: that is the silent
+  // inheritance that turned a request for a book into a request for a translation.
+  language.value = resolveLanguage(locale.value)
+  // One library is only worth preselecting for the requester who is also the approver.
+  targetLibraryId.value = resolveDestination(libraries.value, undefined, settlesOnCreate.value).libraryId
+})
+
+// A folder only means anything inside its own library, so it never outlives the library choice.
+watch(targetLibraryId, () => {
+  targetFolderId.value = folders.value[0]?.id ?? null
+})
+
+// Results stream in provider by provider, so annotate as they land rather than once at the end.
+watch(filteredResults, (results) => {
+  if (results.length) annotate(results)
+})
+
+async function runSearch() {
+  if (!canSearch.value) return
+  activeCoverUrls.value = {}
+  await search({
+    title: title.value.trim() || undefined,
+    author: author.value.trim() || undefined,
+    mediaKind: mediaKind.value,
+  })
+}
+
+function handleSearchSubmit(event: Event) {
+  event.preventDefault()
+  void runSearch()
+}
+
+function selectMediaKind(kind: BookRequestMediaKind) {
+  mediaKind.value = kind
+  if (hasSearched.value) void runSearch()
+}
+
+function selectAutomaticFulfillment() {
+  fulfillmentMode.value = 'automatic'
+}
+
+function selectReleaseFulfillment() {
+  fulfillmentMode.value = 'choose_release'
+}
+
+function handleLanguageChange(event: Event) {
+  const value = (event.target as HTMLSelectElement).value
+  language.value = value === '' ? null : value
+}
+
+async function toggleLanguageDefault() {
+  if (savingLanguage.value) return
+
+  const wasPinned = isLanguagePinned.value
+  if (!(await setLanguageDefault(wasPinned ? null : language.value))) {
+    toast.error(t('bookRequests.search.languageDefaultFailed'))
+    return
+  }
+
+  toast.success(
+    wasPinned
+      ? t('bookRequests.search.languageDefaultCleared')
+      : t('bookRequests.search.languageDefaultSaved', { language: formatLanguageName(language.value ?? '') }),
+  )
+}
+
+const mediaFormats = computed(() => FORMATS_BY_MEDIA[mediaKind.value])
+const activeFormats = computed(() => preferredFormats.value[mediaKind.value])
+
+/** What the collapsed row has to say for itself, so a set preference is never silently hidden. */
+const optionsSummary = computed(() => {
+  const formats = activeFormats.value
+  const hasNote = note.value.trim() !== ''
+  if (formats.length === 0 && !hasNote) return null
+  if (formats.length === 0) return t('bookRequests.search.noteLabel')
+  const listed = formats.map((format) => format.toUpperCase()).join(', ')
+  return hasNote ? t('bookRequests.search.optionsSummary', { formats: listed }) : listed
+})
+
+function isPreferredFormat(format: string): boolean {
+  return activeFormats.value.includes(format)
+}
+
+function togglePreferredFormat(format: string) {
+  const current = activeFormats.value
+  const next = current.includes(format) ? current.filter((value) => value !== format) : [...current, format]
+  preferredFormats.value = { ...preferredFormats.value, [mediaKind.value]: next }
+}
+
+function toggleOptions() {
+  optionsOpen.value = !optionsOpen.value
+}
+
+/** The two the request carries beyond the work itself, sent by both submission paths. */
+function requestExtras(): { note: string | null; preferredFormats: string[] } {
+  return { note: note.value.trim() || null, preferredFormats: [...activeFormats.value] }
+}
+
+function handleLibraryChange(event: Event) {
+  const value = (event.target as HTMLSelectElement).value
+  targetLibraryId.value = value === '' ? null : Number(value)
+}
+
+function handleFolderChange(event: Event) {
+  const value = (event.target as HTMLSelectElement).value
+  targetFolderId.value = value === '' ? null : Number(value)
+}
+
+const providerLabels = computed(() => new Map(providers.value.map((provider) => [provider.key, provider.label])))
+
+/** A provider that never answered leaves a shorter list, which otherwise reads as a thin catalogue. */
+const interruptedMessage = computed(() => {
+  const names = interruptedProviders.value.map(({ provider }) => providerLabels.value.get(provider) ?? provider)
+  return names.length ? t('bookRequests.search.sourcesUnavailable', { sources: names.join(', ') }) : null
+})
+
+function sourceNames(group: CandidateGroup): string {
+  return group.providers.map((provider) => providerLabels.value.get(provider) ?? provider).join(', ')
+}
+
+function providerLabel(provider: MetadataProviderKey): string {
+  return providerLabels.value.get(provider) ?? provider
+}
+
+function providerFallback(provider: MetadataProviderKey): string {
+  return providerLabel(provider).slice(0, 2).toUpperCase()
+}
+
+function providerSourceStyle(provider: MetadataProviderKey): Record<string, string> {
+  const color = getProviderColor(provider)
+  return {
+    borderColor: `${color}66`,
+    backgroundColor: `${color}12`,
+  }
+}
+
+function handleProviderIconError(provider: MetadataProviderKey): void {
+  failedProviderIcons.value = new Set([...failedProviderIcons.value, provider])
+}
+
+function identifierSummary(group: CandidateGroup): string {
+  if (group.isbns.length === 0) return t('bookRequests.search.identifiers.none')
+  if (group.isbns.length > 1) return t('bookRequests.search.identifiers.count', { count: group.isbns.length })
+  const agreeingSources = group.candidates.filter(
+    (candidate) => canonicalizeBookRequestIsbn(candidate.isbn10, candidate.isbn13) === group.isbns[0],
+  ).length
+  return agreeingSources > 1 ? t('bookRequests.search.identifiers.confirmed') : t('bookRequests.search.identifiers.one')
+}
+
+function isMetadataExpanded(group: CandidateGroup): boolean {
+  return expandedMetadataGroups.value.has(group.key)
+}
+
+function toggleMetadataDetails(group: CandidateGroup): void {
+  const next = new Set(expandedMetadataGroups.value)
+  if (next.has(group.key)) next.delete(group.key)
+  else next.add(group.key)
+  expandedMetadataGroups.value = next
+}
+
+function candidateProviderLabel(candidate: MetadataCandidate): string {
+  return providerLabel(candidate.provider)
+}
+
+function candidateDisplayTitle(candidate: MetadataCandidate): string {
+  return candidate.displayTitle ?? candidate.title ?? t('bookRequests.search.identifiers.notProvided')
+}
+
+function candidateIsbn(candidate: MetadataCandidate): string {
+  return canonicalizeBookRequestIsbn(candidate.isbn10, candidate.isbn13) ?? t('bookRequests.search.identifiers.notProvided')
+}
+
+function candidateYear(candidate: MetadataCandidate): string {
+  return candidate.publishedYear != null ? String(candidate.publishedYear) : t('bookRequests.search.yearUnknown')
+}
+
+function candidateLanguage(candidate: MetadataCandidate): string {
+  return candidate.language ? formatLanguageName(candidate.language) : t('bookRequests.search.identifiers.notProvided')
+}
+
+function requestMetadataSources(group: CandidateGroup): BookRequestMetadataSource[] {
+  return group.candidates.map((candidate) => ({
+    providerKey: candidate.provider,
+    providerId: candidate.providerId,
+    providerLabel: candidateProviderLabel(candidate),
+    isbn10: candidate.isbn10 ?? null,
+    isbn13: candidate.isbn13 ?? null,
+  }))
+}
+
+function searchScopeText(group: CandidateGroup): string {
+  return group.isbns.length === 0
+    ? t('bookRequests.search.identifiers.titleAuthorOnly')
+    : t('bookRequests.search.identifiers.searchScope', { count: Math.min(group.isbns.length, MAX_BOOK_REQUEST_SEARCH_ISBNS) })
+}
+
+function isbnSearchChoices(group: CandidateGroup): CandidateIsbnChoice[] {
+  return group.isbnChoices.slice(0, MAX_BOOK_REQUEST_SEARCH_ISBNS)
+}
+
+function recommendedSearchChoice(group: CandidateGroup): CandidateIsbnChoice | null {
+  return group.recommendedIsbnChoice
+}
+
+function searchChoiceProviders(choice: CandidateIsbnChoice): string {
+  return choice.providers.map(providerLabel).join(', ')
+}
+
+function isRecommendedChoice(group: CandidateGroup, choice: CandidateIsbnChoice): boolean {
+  return group.recommendedIsbnChoice?.isbn === choice.isbn
+}
+
+function recommendedSearchLabel(group: CandidateGroup): string {
+  return group.recommendedIsbnChoice
+    ? t('bookRequests.search.identifiers.primaryIsbn', { isbn: group.recommendedIsbnChoice.isbn })
+    : t('bookRequests.search.identifiers.primaryTitleAuthor')
+}
+
+function isGroupSubmitting(group: CandidateGroup): boolean {
+  return group.candidates.some((candidate) => submitting.value === candidateKey(candidate))
+}
+
+/** Joining a request someone else already made never touches the destination, so it stays open. */
+function isRequestDisabled(group: CandidateGroup): boolean {
+  if (isGroupSubmitting(group) || group.availability?.alreadySubscribed) return true
+  if (group.availability?.existingRequestId) return false
+  return destinationMissing.value
+}
+
+/**
+ * Three different actions wear this button. Joining wins over downloading: the work is already
+ * claimed, and a self-server who presses it is subscribing, not starting a second download.
+ */
+function requestLabel(group: CandidateGroup): string {
+  if (isJoinable(group)) return t('bookRequests.search.joinRequest')
+  if (choosesRelease.value) return t('bookRequests.search.chooseRelease')
+  return autoApproves.value ? t('bookRequests.search.getAutomatically') : t('bookRequests.search.request')
+}
+
+function isJoinable(group: CandidateGroup): boolean {
+  return Boolean(group.availability?.existingRequestId) && !group.availability?.alreadySubscribed
+}
+
+/**
+ * Only once a provider search has come back empty, and only for somebody who will pick the release
+ * themselves. An approver handed a row that says nothing but a typed string has no way to tell
+ * whether it is the book that was meant.
+ */
+const canSearchIndexersManually = computed(() => selfFulfils.value && hasSearched.value && title.value.trim() !== '')
+const showFreeTextOption = computed(() => canSearchIndexersManually.value && groups.value.length === 0)
+const showManualSearchOverride = computed(() => canSearchIndexersManually.value && groups.value.length > 0)
+
+const freeTextBusy = ref(false)
+const freeTextNotice = ref<string | null>(null)
+
+/** One sentence either way: the indexer fallback is a longer answer to the same question. */
+const noResultsHint = computed(() =>
+  showFreeTextOption.value ? t('bookRequests.search.noResultsIndexerHint', { title: title.value.trim() }) : t('bookRequests.search.noResultsHint'),
+)
+
+/**
+ * What the library and the queue already know about the typed text, shown before anything is
+ * created. Free text is the weakest identity the dedupe rules see, so this is a hint for a person
+ * rather than a gate: it can miss a match a provider result would have caught.
+ *
+ * Debounced, because the empty state stays on screen while the requester keeps typing and the
+ * unthrottled version asked the server once per keystroke. The generation counter is the other
+ * half: without it a slow answer to "Frank" can land after a fast one to "Frankenstein" and
+ * describe a title nobody is looking at any more.
+ */
+const FREE_TEXT_HINT_DEBOUNCE_MS = 350
+let hintHandle: ReturnType<typeof setTimeout> | null = null
+let hintGeneration = 0
+
+watch([showFreeTextOption, title, author, mediaKind], () => {
+  freeTextNotice.value = null
+  hintGeneration++
+  if (hintHandle !== null) clearTimeout(hintHandle)
+  if (!showFreeTextOption.value) return
+
+  const generation = hintGeneration
+  hintHandle = setTimeout(async () => {
+    const found = await checkFreeText({ title: title.value, author: author.value })
+    if (generation !== hintGeneration) return
+    if (found?.ownedBookId) freeTextNotice.value = t('bookRequests.search.alreadyInLibrary')
+    else if (found?.existingRequestId) freeTextNotice.value = t('bookRequests.search.alreadyRequested')
+  }, FREE_TEXT_HINT_DEBOUNCE_MS)
+})
+
+onUnmounted(() => {
+  if (hintHandle !== null) clearTimeout(hintHandle)
+})
+
+/**
+ * Where a submitted request leaves you.
+ *
+ * `subscribed` means the work was already claimed, which is often somebody else's request. It is
+ * not always: choosing a release twice folds you into *your own* row, and a self-fulfiller whose
+ * submission collides with an undriven request takes that row on rather than queueing behind it.
+ * Opening the picker therefore requires both manual intent and a request this person can drive.
+ */
+async function afterSubmit(result: BookRequestSubmitResult, openPicker: boolean, searchIsbn?: string | null): Promise<void> {
+  const mine = isBookRequestFulfiller(result.request, user.value?.id)
+  if (openPicker && mine && isGrabbableBookRequestStatus(result.request.status)) {
+    await router.push({ name: 'book-request-releases', params: { id: result.request.id }, query: releasesQuery(searchIsbn) })
+    return
+  }
+
+  toast.success(result.subscribed ? t('bookRequests.search.joinedExisting') : t('bookRequests.search.submitted'))
+  emit('submitted')
+}
+
+/**
+ * The query the release picker opens with: the tab and filters the list behind this panel is on,
+ * plus what to search for. Carried across rather than replaced, because the picker is a route on
+ * top of that list and closing it returns to whatever was underneath; both keys are cleared first,
+ * so a request submitted without an ISBN cannot inherit the one the last request was opened with.
+ */
+function releasesQuery(searchIsbn?: string | null): LocationQuery {
+  const carried = { ...route.query }
+  delete carried.isbn
+  delete carried.search
+  if (searchIsbn === undefined) return carried
+  return searchIsbn ? { ...carried, isbn: searchIsbn } : { ...carried, search: 'title-author' }
+}
+
+async function startFreeTextSearch() {
+  freeTextBusy.value = true
+  try {
+    const result = await submitFreeText(
+      { title: title.value, author: author.value },
+      {
+        targetLibraryId: targetLibraryId.value,
+        targetFolderId: targetFolderId.value,
+        language: language.value,
+        selfServe: true,
+        ...requestExtras(),
+      },
+    )
+    if (!result) {
+      toast.error(submitFailureText(lastFailure.value, t) ?? t('bookRequests.search.submitFailed'))
+      return
+    }
+    await afterSubmit(result, true)
+  } finally {
+    freeTextBusy.value = false
+  }
+}
+
+async function requestGroup(group: CandidateGroup) {
+  const choice = recommendedSearchChoice(group)
+  await requestGroupChoice(group, choice?.candidate ?? group.candidate, choice?.isbn ?? null, choosesRelease.value)
+}
+
+async function requestCandidate(group: CandidateGroup, candidate: MetadataCandidate): Promise<void> {
+  await requestGroupChoice(group, candidate, canonicalizeBookRequestIsbn(candidate.isbn10, candidate.isbn13), true)
+}
+
+async function requestTitleAuthor(group: CandidateGroup): Promise<void> {
+  await requestGroupChoice(group, group.candidate, null, true)
+}
+
+async function requestGroupChoice(group: CandidateGroup, candidate: MetadataCandidate, isbn: string | null, openPicker = true): Promise<void> {
+  const hasSelectedCover = Object.prototype.hasOwnProperty.call(activeCoverUrls.value, group.key)
+  const result = await submit(candidate, {
+    targetLibraryId: targetLibraryId.value,
+    targetFolderId: targetFolderId.value,
+    language: language.value,
+    coverUrl: hasSelectedCover ? (activeCoverUrls.value[group.key] ?? null) : group.coverUrl,
+    selfServe: openPicker,
+    isbn10: null,
+    isbn13: isbn,
+    providerKey: candidate.provider,
+    providerId: candidate.providerId,
+    metadataSources: requestMetadataSources(group),
+    ...requestExtras(),
+  })
+  if (!result) {
+    toast.error(submitFailureText(lastFailure.value, t) ?? t('bookRequests.search.submitFailed'))
+    return
+  }
+  await afterSubmit(result, openPicker, isbn)
+}
+
+function handleCoverSourceChange(payload: { key: string | undefined; src: string | null }) {
+  if (!payload.key) return
+  activeCoverUrls.value = { ...activeCoverUrls.value, [payload.key]: payload.src }
+}
+
+function mediaIconFor(kind: BookRequestMediaKind) {
+  return MEDIA_ICONS[kind] ?? BookOpen
+}
+</script>
+
+<template>
+  <div class="space-y-5">
+    <form @submit="handleSearchSubmit">
+      <!--
+        The query is one object, so it is one card. The fields carry their own fill and border
+        because a transparent input reads as a caption, and the secondary controls sit in a strip
+        attached to the same card rather than floating on their own line below it.
+      -->
+      <div class="overflow-hidden rounded-xl border border-border bg-card">
+        <div class="flex flex-col gap-2.5 p-3 sm:flex-row sm:flex-wrap sm:items-center">
+          <div
+            class="flex h-9 w-full items-center gap-2 rounded-md border border-input bg-background px-3 focus-within:border-ring focus-within:ring-[3px] focus-within:ring-ring/40 sm:w-auto sm:min-w-[13rem] sm:flex-[2]"
+          >
+            <Search :size="15" class="shrink-0 text-muted-foreground" aria-hidden="true" />
+            <label for="request-title" class="sr-only">{{ t('bookRequests.search.titleLabel') }}</label>
+            <input
+              id="request-title"
+              v-model="title"
+              type="text"
+              class="h-full w-full min-w-0 bg-transparent text-sm text-foreground placeholder:text-muted-foreground focus-visible:outline-none"
+              :placeholder="t('bookRequests.search.titlePlaceholder')"
+            />
+          </div>
+
+          <div
+            class="flex h-9 w-full items-center gap-2 rounded-md border border-input bg-background px-3 focus-within:border-ring focus-within:ring-[3px] focus-within:ring-ring/40 sm:w-auto sm:min-w-[11rem] sm:flex-[1.4]"
+          >
+            <User :size="15" class="shrink-0 text-muted-foreground" aria-hidden="true" />
+            <label for="request-author" class="sr-only">{{ t('bookRequests.search.authorLabel') }}</label>
+            <input
+              id="request-author"
+              v-model="author"
+              type="text"
+              class="h-full w-full min-w-0 bg-transparent text-sm text-foreground placeholder:text-muted-foreground focus-visible:outline-none"
+              :placeholder="t('bookRequests.search.authorPlaceholder')"
+            />
+          </div>
+
+          <Button type="submit" class="w-full sm:w-auto sm:shrink-0" :disabled="isStreaming || !canSearch">
+            <Loader2 v-if="isStreaming" class="animate-spin" aria-hidden="true" />
+            {{ t('bookRequests.search.submit') }}
+          </Button>
+        </div>
+
+        <div class="flex flex-wrap items-center gap-x-3.5 gap-y-2.5 border-t border-border bg-muted px-3 py-2.5">
+          <!-- A real track, so three buttons read as one control rather than as loose links. -->
+          <fieldset class="inline-flex h-9 items-center gap-0.5 rounded-lg border border-border bg-card p-[3px]">
+            <legend class="sr-only">{{ t('bookRequests.search.mediaKindLabel') }}</legend>
+            <button
+              v-for="kind in BOOK_REQUEST_MEDIA_KINDS"
+              :key="kind"
+              type="button"
+              class="inline-flex h-full items-center gap-1.5 rounded-md px-2.5 text-xs font-medium transition-colors focus-visible:ring-2 focus-visible:ring-ring focus-visible:outline-none motion-reduce:transition-none"
+              :class="mediaKind === kind ? 'bg-background text-foreground shadow-xs' : 'text-muted-foreground hover:text-foreground'"
+              :aria-pressed="mediaKind === kind"
+              @click="selectMediaKind(kind)"
+            >
+              <component :is="mediaIconFor(kind)" :size="13" aria-hidden="true" />
+              {{ t(`bookRequests.mediaKind.${kind}`) }}
+            </button>
+          </fieldset>
+
+          <fieldset
+            v-if="canChooseFulfillment"
+            class="inline-flex h-9 w-full items-center gap-0.5 rounded-lg border border-border bg-card p-[3px] sm:w-auto"
+          >
+            <legend class="sr-only">{{ t('bookRequests.search.fulfillmentLabel') }}</legend>
+            <button
+              type="button"
+              class="inline-flex h-full flex-1 items-center justify-center rounded-md px-2.5 text-xs font-medium transition-colors focus-visible:ring-2 focus-visible:ring-ring focus-visible:outline-none motion-reduce:transition-none sm:flex-none"
+              :class="fulfillmentMode === 'automatic' ? 'bg-background text-foreground shadow-xs' : 'text-muted-foreground hover:text-foreground'"
+              :aria-pressed="fulfillmentMode === 'automatic'"
+              @click="selectAutomaticFulfillment"
+            >
+              {{ t('bookRequests.search.fulfillmentAutomatic') }}
+            </button>
+            <button
+              type="button"
+              class="inline-flex h-full flex-1 items-center justify-center rounded-md px-2.5 text-xs font-medium transition-colors focus-visible:ring-2 focus-visible:ring-ring focus-visible:outline-none motion-reduce:transition-none sm:flex-none"
+              :class="
+                fulfillmentMode === 'choose_release' ? 'bg-background text-foreground shadow-xs' : 'text-muted-foreground hover:text-foreground'
+              "
+              :aria-pressed="fulfillmentMode === 'choose_release'"
+              @click="selectReleaseFulfillment"
+            >
+              {{ t('bookRequests.search.fulfillmentChooseRelease') }}
+            </button>
+          </fieldset>
+
+          <template v-if="showDestination">
+            <div class="flex w-full items-center gap-1.5 sm:w-auto">
+              <label for="request-library" class="sr-only">{{ t('bookRequests.search.libraryLabel') }}</label>
+              <select
+                id="request-library"
+                :value="targetLibraryId ?? ''"
+                class="h-9 min-w-0 flex-1 rounded-md border border-input bg-card px-3 text-sm text-foreground focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 focus-visible:outline-none sm:max-w-[15rem] sm:min-w-[11rem] sm:flex-none"
+                @change="handleLibraryChange"
+              >
+                <!-- Names the instance default rather than saying nothing, so leaving this alone
+                     is a visible choice instead of a request going somewhere unstated. -->
+                <option value="">{{ unpickedDestinationLabel }}</option>
+                <option v-for="library in libraries" :key="library.id" :value="library.id">{{ library.name }}</option>
+              </select>
+            </div>
+
+            <template v-if="settlesOnCreate && folders.length > 1">
+              <label for="request-folder" class="sr-only">{{ t('bookRequests.search.folderLabel') }}</label>
+              <select
+                id="request-folder"
+                :value="targetFolderId ?? ''"
+                class="h-9 w-full rounded-md border border-input bg-card px-3 text-sm text-foreground focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 focus-visible:outline-none sm:w-auto sm:max-w-[15rem] sm:min-w-[11rem]"
+                @change="handleFolderChange"
+              >
+                <option v-for="folder in folders" :key="folder.id" :value="folder.id">{{ folder.path }}</option>
+              </select>
+            </template>
+          </template>
+
+          <!-- Always offered, unlike the destination: the language decides what gets grabbed. -->
+          <div class="flex w-full items-center gap-1.5 sm:w-auto">
+            <label for="request-language" class="sr-only">{{ t('bookRequests.search.languageLabel') }}</label>
+            <select
+              id="request-language"
+              :value="language ?? ''"
+              class="h-9 min-w-0 flex-1 rounded-md border border-input bg-card px-3 text-sm text-foreground focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 focus-visible:outline-none sm:max-w-[15rem] sm:min-w-[11rem] sm:flex-none"
+              @change="handleLanguageChange"
+            >
+              <option value="">{{ t('bookRequests.search.languageAny') }}</option>
+              <option v-for="option in languageOptions" :key="option.code" :value="option.code">{{ option.name }}</option>
+            </select>
+
+            <!-- Asking for the same language every time is a preference, not a decision. -->
+            <button
+              v-if="language !== null"
+              type="button"
+              class="inline-flex h-9 w-9 shrink-0 items-center justify-center rounded-md border border-input bg-card transition-colors focus-visible:ring-[3px] focus-visible:ring-ring/50 focus-visible:outline-none disabled:opacity-60 motion-reduce:transition-none"
+              :class="isLanguagePinned ? 'text-primary' : 'text-muted-foreground hover:text-foreground focus-visible:text-foreground'"
+              :aria-pressed="isLanguagePinned"
+              :aria-label="t('bookRequests.search.languageDefaultToggleLabel')"
+              :title="isLanguagePinned ? t('bookRequests.search.languageDefaultClearHint') : t('bookRequests.search.languageDefaultSetHint')"
+              :disabled="savingLanguage"
+              @click="toggleLanguageDefault"
+            >
+              <Pin :size="15" :class="isLanguagePinned ? 'fill-current' : undefined" aria-hidden="true" />
+            </button>
+          </div>
+
+          <!--
+            Collapsed by default: the common path is type, search, press Request, and neither of
+            these is needed for it. The summary is what keeps a set preference from disappearing
+            along with the panel that holds it.
+          -->
+          <button
+            type="button"
+            class="inline-flex h-9 items-center gap-1.5 rounded-md px-2 text-xs font-medium text-muted-foreground transition-colors hover:text-foreground focus-visible:text-foreground focus-visible:ring-2 focus-visible:ring-ring focus-visible:outline-none motion-reduce:transition-none"
+            :aria-expanded="optionsOpen"
+            aria-controls="request-more-options"
+            @click="toggleOptions"
+          >
+            <SlidersHorizontal :size="13" aria-hidden="true" />
+            {{ optionsOpen ? t('bookRequests.search.fewerOptions') : t('bookRequests.search.moreOptions') }}
+            <span v-if="!optionsOpen && optionsSummary" class="text-primary">{{ optionsSummary }}</span>
+          </button>
+
+          <button
+            v-if="showManualSearchOverride"
+            type="button"
+            class="inline-flex h-9 items-center gap-1.5 rounded-md px-2 text-xs font-medium text-muted-foreground transition-colors hover:text-foreground focus-visible:text-foreground focus-visible:ring-2 focus-visible:ring-ring focus-visible:outline-none disabled:opacity-60 motion-reduce:transition-none"
+            :disabled="freeTextBusy || destinationMissing"
+            @click="startFreeTextSearch"
+          >
+            <Search :size="13" aria-hidden="true" />
+            {{ t('bookRequests.search.manualSearchAction') }}
+          </button>
+        </div>
+
+        <div v-show="optionsOpen" id="request-more-options" class="grid gap-3 border-t border-border bg-muted px-3 py-3">
+          <fieldset class="grid gap-1.5">
+            <legend class="text-xs font-medium text-foreground">{{ t('bookRequests.search.preferredFormatsLabel') }}</legend>
+            <p class="text-xs text-muted-foreground">{{ t('bookRequests.search.preferredFormatsHint') }}</p>
+            <div class="mt-0.5 flex flex-wrap gap-1.5">
+              <button
+                v-for="format in mediaFormats"
+                :key="format"
+                type="button"
+                class="inline-flex h-7 items-center rounded-full border px-2.5 text-xs font-medium transition-colors focus-visible:ring-2 focus-visible:ring-ring focus-visible:outline-none motion-reduce:transition-none"
+                :class="
+                  isPreferredFormat(format)
+                    ? 'border-primary bg-primary/12 text-primary'
+                    : 'border-input bg-card text-muted-foreground hover:text-foreground focus-visible:text-foreground'
+                "
+                :aria-pressed="isPreferredFormat(format)"
+                :aria-label="t('bookRequests.search.formatToggleAria', { format: format.toUpperCase() })"
+                @click="togglePreferredFormat(format)"
+              >
+                {{ format.toUpperCase() }}
+              </button>
+            </div>
+          </fieldset>
+
+          <div class="grid gap-1.5">
+            <label for="request-note" class="text-xs font-medium text-foreground">{{ t('bookRequests.search.noteLabel') }}</label>
+            <textarea
+              id="request-note"
+              v-model="note"
+              rows="2"
+              maxlength="2000"
+              class="w-full resize-y rounded-md border border-input bg-card px-3 py-2 text-sm text-foreground placeholder:text-muted-foreground focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50 focus-visible:outline-none"
+              :placeholder="t('bookRequests.search.notePlaceholder')"
+            ></textarea>
+          </div>
+        </div>
+      </div>
+    </form>
+
+    <p v-if="destinationMissing" class="text-sm text-muted-foreground">{{ t('bookRequests.search.libraryRequired') }}</p>
+
+    <p v-if="isStreaming" role="status" class="sr-only">{{ t('bookRequests.search.searching') }}</p>
+
+    <!--
+      One card, on the same edges as the search card above it. The escape hatch is the answer to an
+      empty search rather than a second notice about it, so it shares this block instead of adding a
+      second one indented to its own left edge. It is offered only to somebody who can fulfil the
+      request themselves: without the picker on the other side it would create a request an approver
+      could not identify.
+    -->
+    <div
+      v-else-if="hasSearched && groups.length === 0"
+      role="status"
+      class="flex flex-col gap-3 rounded-xl border border-border bg-card p-4 sm:flex-row sm:items-center sm:gap-5"
+    >
+      <div class="min-w-0 flex-1 space-y-0.5">
+        <p class="text-sm font-medium text-foreground">{{ t('bookRequests.search.noResultsTitle') }}</p>
+        <p class="text-sm text-muted-foreground">{{ noResultsHint }}</p>
+        <p v-if="freeTextNotice" class="pt-1 text-sm text-muted-foreground">{{ freeTextNotice }}</p>
+      </div>
+
+      <Button
+        v-if="showFreeTextOption"
+        variant="outline"
+        size="sm"
+        class="w-full shrink-0 sm:w-auto"
+        :disabled="freeTextBusy || destinationMissing"
+        @click="startFreeTextSearch"
+      >
+        {{ t('bookRequests.search.freeTextAction') }}
+      </Button>
+    </div>
+
+    <p v-if="interruptedMessage" role="status" class="text-sm text-muted-foreground">{{ interruptedMessage }}</p>
+
+    <!-- One row per work. The records behind it are a footnote on the row, not rows of their own. -->
+    <ul v-if="groups.length" class="space-y-2">
+      <li
+        v-for="group in groups"
+        :key="group.key"
+        class="flex flex-wrap items-center gap-3.5 rounded-lg border border-border bg-card p-3 transition-colors hover:border-ring/50 motion-reduce:transition-none"
+      >
+        <RequestCover
+          :src="group.coverUrl"
+          :fallback-sources="group.coverUrls.slice(1)"
+          :source-key="group.key"
+          :media-kind="mediaKind"
+          class="h-[74px] w-[50px]"
+          :icon-size="18"
+          @source-change="handleCoverSourceChange"
+        />
+
+        <div class="min-w-0 flex-1 space-y-1">
+          <p class="truncate text-[15px] font-semibold text-foreground">{{ group.title }}</p>
+          <p v-if="group.authors.length" class="truncate text-sm text-muted-foreground">{{ group.authors.join(', ') }}</p>
+
+          <div class="flex flex-wrap items-center gap-x-2 gap-y-1 text-xs text-muted-foreground">
+            <span class="tabular-nums">{{ group.publishedYear ?? t('bookRequests.search.yearUnknown') }}</span>
+
+            <span class="size-[3px] rounded-full bg-border" aria-hidden="true"></span>
+            <span
+              class="inline-flex items-center gap-1"
+              :title="sourceNames(group)"
+              :aria-label="t('bookRequests.search.sourcesLabel', { sources: sourceNames(group) })"
+              role="img"
+            >
+              <span
+                v-for="provider in group.providers"
+                :key="provider"
+                class="inline-flex size-6 items-center justify-center rounded-md border"
+                :style="providerSourceStyle(provider)"
+                :title="providerLabel(provider)"
+                aria-hidden="true"
+              >
+                <img
+                  v-if="providerIconPathSafe(provider) && !failedProviderIcons.has(provider)"
+                  :src="providerIconPathSafe(provider) ?? undefined"
+                  alt=""
+                  class="size-3.5 rounded-[2px] object-contain"
+                  loading="lazy"
+                  @error="handleProviderIconError(provider)"
+                />
+                <span v-else class="text-[8px] font-bold leading-none text-foreground">{{ providerFallback(provider) }}</span>
+              </span>
+            </span>
+
+            <button
+              type="button"
+              class="inline-flex h-6 items-center gap-1 rounded-full border border-border bg-background px-2 text-[11px] font-medium text-foreground transition-colors hover:bg-muted focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/40"
+              :aria-expanded="isMetadataExpanded(group)"
+              :aria-controls="`request-metadata-${group.key}`"
+              @click="toggleMetadataDetails(group)"
+            >
+              {{ identifierSummary(group) }}
+              <ChevronDown
+                :size="12"
+                class="transition-transform motion-reduce:transition-none"
+                :class="isMetadataExpanded(group) ? 'rotate-180' : ''"
+                aria-hidden="true"
+              />
+            </button>
+
+            <template v-if="group.availability?.ownedBookId">
+              <span class="size-[3px] rounded-full bg-border" aria-hidden="true"></span>
+              <span class="inline-flex items-center gap-1 rounded-full border border-success/40 bg-success/10 px-2 py-0.5 text-success">
+                <Library :size="12" aria-hidden="true" />
+                {{ t('bookRequests.search.alreadyInLibrary') }}
+              </span>
+            </template>
+            <template v-else-if="group.availability?.existingRequestId">
+              <span class="size-[3px] rounded-full bg-border" aria-hidden="true"></span>
+              <span class="inline-flex items-center gap-1 rounded-full border border-info/40 bg-info/10 px-2 py-0.5 text-info">
+                <component :is="group.availability.alreadySubscribed ? Check : Users" :size="12" aria-hidden="true" />
+                {{
+                  group.availability.alreadySubscribed ? t('bookRequests.search.alreadyRequestedByYou') : t('bookRequests.search.alreadyRequested')
+                }}
+              </span>
+            </template>
+          </div>
+        </div>
+
+        <div v-if="choosesRelease && !isJoinable(group)" class="flex shrink-0 items-center gap-1.5">
+          <Popover>
+            <PopoverTrigger as-child>
+              <Button
+                type="button"
+                variant="ghost"
+                size="icon-sm"
+                class="rounded-full text-muted-foreground"
+                :aria-label="t('bookRequests.search.identifiers.recommendationHelpLabel')"
+              >
+                <CircleHelp :size="15" aria-hidden="true" />
+              </Button>
+            </PopoverTrigger>
+            <PopoverContent align="end" class="w-80 max-w-[calc(100vw-2rem)] space-y-3">
+              <div>
+                <p class="text-sm font-semibold text-foreground">{{ t('bookRequests.search.identifiers.recommendationTitle') }}</p>
+                <p class="mt-1 text-xs text-muted-foreground">{{ recommendedSearchLabel(group) }}</p>
+              </div>
+              <ol class="list-decimal space-y-1 ps-4 text-xs text-muted-foreground">
+                <li>{{ t('bookRequests.search.identifiers.recommendationLanguage') }}</li>
+                <li>{{ t('bookRequests.search.identifiers.recommendationAgreement') }}</li>
+                <li>{{ t('bookRequests.search.identifiers.recommendationProvider') }}</li>
+                <li>{{ t('bookRequests.search.identifiers.recommendationRelevance') }}</li>
+                <li>{{ t('bookRequests.search.identifiers.recommendationYear') }}</li>
+                <li>{{ t('bookRequests.search.identifiers.recommendationStable') }}</li>
+              </ol>
+              <p class="text-xs text-muted-foreground">{{ t('bookRequests.search.identifiers.recommendationFallback') }}</p>
+            </PopoverContent>
+          </Popover>
+
+          <div class="inline-flex rounded-md shadow-xs">
+            <Button
+              size="sm"
+              class="rounded-e-none border-e border-primary-foreground/20"
+              :disabled="isRequestDisabled(group)"
+              @click="requestGroup(group)"
+            >
+              {{ t('bookRequests.search.chooseRelease') }}
+            </Button>
+            <DropdownMenu>
+              <DropdownMenuTrigger as-child>
+                <Button
+                  size="sm"
+                  class="rounded-s-none px-2"
+                  :disabled="isRequestDisabled(group)"
+                  :aria-label="t('bookRequests.search.identifiers.chooseSearch')"
+                >
+                  <ChevronDown :size="14" aria-hidden="true" />
+                </Button>
+              </DropdownMenuTrigger>
+              <DropdownMenuContent align="end" class="w-80 max-w-[calc(100vw-2rem)]">
+                <DropdownMenuLabel>{{ t('bookRequests.search.identifiers.searchByEdition') }}</DropdownMenuLabel>
+                <DropdownMenuItem
+                  v-for="choice in isbnSearchChoices(group)"
+                  :key="choice.isbn"
+                  class="items-center gap-3 py-2"
+                  @click="requestGroupChoice(group, choice.candidate, choice.isbn)"
+                >
+                  <span class="min-w-0 flex-1">
+                    <span class="block truncate font-mono text-xs text-foreground">{{ choice.isbn }}</span>
+                    <span class="block truncate text-xs text-muted-foreground">{{ searchChoiceProviders(choice) }}</span>
+                  </span>
+                  <span class="flex shrink-0 flex-col items-end text-xs font-medium">
+                    <span v-if="isRecommendedChoice(group, choice)" class="text-success">
+                      {{ t('bookRequests.search.identifiers.recommended') }}
+                    </span>
+                    <span class="text-primary">{{ t('bookRequests.search.identifiers.findRelease') }}</span>
+                  </span>
+                </DropdownMenuItem>
+                <DropdownMenuSeparator />
+                <DropdownMenuItem class="items-center gap-3 py-2" @click="requestTitleAuthor(group)">
+                  <span class="min-w-0 flex-1">
+                    <span class="block text-sm text-foreground">{{ t('bookRequests.search.identifiers.withoutIsbn') }}</span>
+                    <span class="block truncate text-xs text-muted-foreground">{{ group.title }} · {{ group.authors[0] }}</span>
+                  </span>
+                  <span class="text-xs font-medium text-primary">{{ t('bookRequests.search.identifiers.findRelease') }}</span>
+                </DropdownMenuItem>
+              </DropdownMenuContent>
+            </DropdownMenu>
+          </div>
+        </div>
+
+        <Button
+          v-else
+          size="sm"
+          class="shrink-0"
+          :variant="isJoinable(group) ? 'outline' : 'default'"
+          :disabled="isRequestDisabled(group)"
+          @click="requestGroup(group)"
+        >
+          {{ requestLabel(group) }}
+        </Button>
+
+        <div
+          v-if="isMetadataExpanded(group)"
+          :id="`request-metadata-${group.key}`"
+          class="basis-full rounded-lg border border-border bg-muted/30 p-3"
+        >
+          <div class="flex flex-wrap items-baseline justify-between gap-2">
+            <h3 class="text-xs font-semibold text-foreground">{{ t('bookRequests.search.identifiers.sourcesTitle') }}</h3>
+            <p class="text-xs text-muted-foreground">{{ searchScopeText(group) }}</p>
+          </div>
+          <div class="mt-2 overflow-x-auto">
+            <table class="w-full min-w-[40rem] text-start text-xs">
+              <thead class="text-muted-foreground">
+                <tr class="border-b border-border">
+                  <th scope="col" class="px-2 py-1.5 text-start font-medium">{{ t('bookRequests.search.identifiers.provider') }}</th>
+                  <th scope="col" class="px-2 py-1.5 text-start font-medium">{{ t('bookRequests.search.identifiers.providerTitle') }}</th>
+                  <th scope="col" class="px-2 py-1.5 text-start font-medium">{{ t('bookRequests.search.identifiers.isbn') }}</th>
+                  <th scope="col" class="px-2 py-1.5 text-start font-medium">{{ t('bookRequests.search.identifiers.year') }}</th>
+                  <th scope="col" class="px-2 py-1.5 text-start font-medium">{{ t('bookRequests.search.identifiers.language') }}</th>
+                  <th v-if="choosesRelease && !isJoinable(group)" scope="col" class="px-2 py-1.5 text-end font-medium">
+                    {{ t('bookRequests.search.identifiers.action') }}
+                  </th>
+                </tr>
+              </thead>
+              <tbody>
+                <tr
+                  v-for="candidate in group.candidates"
+                  :key="`${candidate.provider}:${candidate.providerId}`"
+                  class="border-b border-border/60 last:border-0"
+                >
+                  <td class="px-2 py-2 font-medium text-foreground">{{ candidateProviderLabel(candidate) }}</td>
+                  <td class="max-w-72 truncate px-2 py-2 text-foreground" :title="candidateDisplayTitle(candidate)">
+                    {{ candidateDisplayTitle(candidate) }}
+                  </td>
+                  <td class="px-2 py-2 font-mono text-foreground">{{ candidateIsbn(candidate) }}</td>
+                  <td class="px-2 py-2 tabular-nums text-muted-foreground">{{ candidateYear(candidate) }}</td>
+                  <td class="px-2 py-2 text-muted-foreground">{{ candidateLanguage(candidate) }}</td>
+                  <td v-if="choosesRelease && !isJoinable(group)" class="px-2 py-2 text-end">
+                    <Button
+                      type="button"
+                      variant="outline"
+                      size="sm"
+                      class="h-7"
+                      :disabled="isRequestDisabled(group)"
+                      @click="requestCandidate(group, candidate)"
+                    >
+                      {{ t('bookRequests.search.identifiers.findRelease') }}
+                    </Button>
+                  </td>
+                </tr>
+              </tbody>
+            </table>
+          </div>
+        </div>
+      </li>
+    </ul>
+  </div>
+</template>
diff --git a/client/src/features/book-requests/components/RequestSeedPanel.vue b/client/src/features/book-requests/components/RequestSeedPanel.vue
new file mode 100644
index 000000000..5c6ec0752
--- /dev/null
+++ b/client/src/features/book-requests/components/RequestSeedPanel.vue
@@ -0,0 +1,201 @@
+<script setup lang="ts">
+import { computed, ref, watch } from 'vue'
+import { useI18n } from 'vue-i18n'
+import type { BookRequestItem } from '@bookorbit/types'
+import { Button } from '@/components/ui/button'
+import ConfirmDialog from '@/components/ui/ConfirmDialog.vue'
+import { formatNumber } from '@/i18n/formatters'
+import { formatBytes } from '@/lib/formatting'
+import { useRequestSeedStatus } from '../composables/useRequestSeedStatus'
+
+const props = defineProps<{
+  request: BookRequestItem
+  busy: boolean
+  /**
+   * Moderating the queue. Decides both which endpoint serves the readout and whether the
+   * destructive control is offered: stopping a seed is a decision about shared infrastructure,
+   * where reading its state is not.
+   */
+  canManage: boolean
+}>()
+
+const emit = defineEmits<{
+  remove: [payload: { request: BookRequestItem; downloadId: number; deleteFiles: boolean }]
+}>()
+
+const { t } = useI18n()
+const { status, loading, failed, fetchStatus, reset } = useRequestSeedStatus(() => props.canManage)
+
+const confirming = ref(false)
+const deleteFiles = ref(false)
+const removalInFlight = ref(false)
+
+const download = computed(() => props.request.download)
+const isTorrentDownload = computed(() => download.value?.source === 'magnet' || download.value?.source === 'torrent_file')
+
+/**
+ * Ratio and seeding time are not two more figures: they are the two goals the client stops on, so
+ * whichever of them the client actually reported a target for is drawn as a fraction of it. A goal
+ * the client did not state leaves the number to stand on its own, because there is nothing to be a
+ * fraction of.
+ */
+interface SeedMeter {
+  key: 'ratio' | 'time'
+  label: string
+  value: string
+  percent: number | null
+}
+
+function meterPercent(current: number, goal: number): number {
+  return Math.max(0, Math.min(100, (current / goal) * 100))
+}
+
+const meters = computed<SeedMeter[]>(() => {
+  const current = status.value
+  if (!current) return []
+
+  const rows: SeedMeter[] = []
+
+  if (current.ratio !== null) {
+    const ratio = formatNumber(current.ratio, { minimumFractionDigits: 2, maximumFractionDigits: 2 })
+    const goal = current.ratioGoal !== null && current.ratioGoal > 0 ? current.ratioGoal : null
+    rows.push({
+      key: 'ratio',
+      label: t('bookRequests.seed.ratio'),
+      value: goal === null ? ratio : t('bookRequests.seed.ofGoal', { value: ratio, goal: formatNumber(goal, { maximumFractionDigits: 2 }) }),
+      percent: goal === null ? null : meterPercent(current.ratio, goal),
+    })
+  }
+
+  if (current.seedingTimeSeconds !== null) {
+    const hours = t('bookRequests.seed.hours', { value: formatNumber(current.seedingTimeSeconds / 3600, { maximumFractionDigits: 1 }) })
+    const goalMinutes = current.seedingTimeGoalMinutes !== null && current.seedingTimeGoalMinutes > 0 ? current.seedingTimeGoalMinutes : null
+    rows.push({
+      key: 'time',
+      label: t('bookRequests.seed.time'),
+      value:
+        goalMinutes === null
+          ? hours
+          : t('bookRequests.seed.ofGoal', {
+              value: hours,
+              goal: t('bookRequests.seed.hours', { value: formatNumber(goalMinutes / 60, { maximumFractionDigits: 1 }) }),
+            }),
+      percent: goalMinutes === null ? null : meterPercent(current.seedingTimeSeconds / 60, goalMinutes),
+    })
+  }
+
+  return rows
+})
+
+// A fresh request means a fresh read: a ratio from the request before this one is worse than none.
+watch(
+  [() => props.request.id, () => download.value?.id, () => download.value?.source],
+  ([id]) => {
+    deleteFiles.value = false
+    removalInFlight.value = false
+    reset()
+    if (isTorrentDownload.value) void fetchStatus(id)
+  },
+  { immediate: true },
+)
+
+/**
+ * The parent owns the removal call, so the only signal it finished is `busy` dropping again. A
+ * removal that is not re-read leaves the panel offering to remove a torrent that is already gone.
+ */
+watch(
+  () => props.busy,
+  (busy, wasBusy) => {
+    if (busy || !wasBusy || !removalInFlight.value) return
+    removalInFlight.value = false
+    if (download.value) void fetchStatus(props.request.id)
+  },
+)
+
+function handleRemove() {
+  confirming.value = true
+}
+
+function cancelRemove() {
+  confirming.value = false
+}
+
+function confirmRemove() {
+  if (download.value) {
+    removalInFlight.value = true
+    emit('remove', { request: props.request, downloadId: download.value.id, deleteFiles: deleteFiles.value })
+  }
+  confirming.value = false
+}
+</script>
+
+<template>
+  <section v-if="isTorrentDownload" class="space-y-3 rounded-lg border border-border bg-card p-4">
+    <h3 class="text-xs font-semibold tracking-wide text-muted-foreground uppercase">{{ t('bookRequests.seed.title') }}</h3>
+
+    <p v-if="download?.automated" class="text-sm text-muted-foreground">{{ t('bookRequests.seed.automated') }}</p>
+
+    <p v-if="loading" role="status" class="text-sm text-muted-foreground">{{ t('bookRequests.seed.loading') }}</p>
+    <p v-else-if="failed" role="status" class="text-sm text-muted-foreground">{{ t('bookRequests.seed.loadFailed') }}</p>
+    <p v-else-if="!status" role="status" class="text-sm text-muted-foreground">{{ t('bookRequests.seed.notInClient') }}</p>
+
+    <template v-else>
+      <!-- Whether it is still seeding is the whole question, so it leads and never rides on colour alone. -->
+      <div class="flex flex-wrap items-center justify-between gap-2">
+        <span
+          class="inline-flex items-center gap-1.5 rounded-full border px-2 py-0.5 text-xs font-medium"
+          :class="status.seeding ? 'border-success/40 bg-success/10 text-success' : 'border-border bg-muted text-muted-foreground'"
+        >
+          <span class="size-1.5 rounded-full bg-current" aria-hidden="true" />
+          {{ status.seeding ? t('bookRequests.seed.seeding') : t('bookRequests.seed.stopped') }}
+        </span>
+        <span v-if="status.downloadClientName" class="truncate text-xs text-muted-foreground">{{ status.downloadClientName }}</span>
+      </div>
+
+      <dl class="space-y-2.5">
+        <div v-for="meter in meters" :key="meter.key">
+          <div class="flex items-baseline justify-between gap-4">
+            <dt class="text-sm text-muted-foreground">{{ meter.label }}</dt>
+            <dd class="text-end text-sm text-foreground tabular-nums">{{ meter.value }}</dd>
+          </div>
+          <!-- Redundant to the figures beside it, which is exactly why it is hidden rather than labelled. -->
+          <div v-if="meter.percent !== null" data-testid="seed-meter" class="mt-1.5 h-1 overflow-hidden rounded-full bg-muted" aria-hidden="true">
+            <div
+              class="h-full rounded-full bg-primary transition-[width] duration-500 motion-reduce:transition-none"
+              :style="{ width: `${meter.percent}%` }"
+            />
+          </div>
+        </div>
+
+        <div v-if="status.uploadedBytes !== null" class="flex items-baseline justify-between gap-4">
+          <dt class="text-sm text-muted-foreground">{{ t('bookRequests.seed.uploaded') }}</dt>
+          <dd class="text-end text-sm text-foreground tabular-nums">{{ formatBytes(status.uploadedBytes) }}</dd>
+        </div>
+      </dl>
+
+      <!-- Separated, because a destructive control reading as one more row of the readout is how it gets clicked. -->
+      <div v-if="canManage" class="space-y-2.5 border-t border-border pt-3.5">
+        <p class="text-xs text-muted-foreground">{{ t('bookRequests.seed.removeHint') }}</p>
+
+        <label class="flex items-center gap-2 text-sm text-foreground">
+          <input v-model="deleteFiles" type="checkbox" class="h-3.5 w-3.5 rounded border-border accent-primary" />
+          {{ t('bookRequests.seed.deleteFiles') }}
+        </label>
+
+        <Button variant="destructive-outline" size="sm" :disabled="busy" @click="handleRemove">
+          {{ t('bookRequests.seed.remove') }}
+        </Button>
+      </div>
+    </template>
+
+    <ConfirmDialog
+      :open="confirming"
+      :title="t('bookRequests.seed.confirm.title')"
+      :description="deleteFiles ? t('bookRequests.seed.confirm.descriptionWithFiles') : t('bookRequests.seed.confirm.description')"
+      :confirm-label="t('bookRequests.seed.remove')"
+      :busy="busy"
+      @confirm="confirmRemove"
+      @cancel="cancelRemove"
+    />
+  </section>
+</template>
diff --git a/client/src/features/book-requests/components/RequestStatusBadge.vue b/client/src/features/book-requests/components/RequestStatusBadge.vue
new file mode 100644
index 000000000..4bc2c5e2d
--- /dev/null
+++ b/client/src/features/book-requests/components/RequestStatusBadge.vue
@@ -0,0 +1,53 @@
+<script setup lang="ts">
+import { computed } from 'vue'
+import { useI18n } from 'vue-i18n'
+import { Check, TriangleAlert } from '@lucide/vue'
+import type { BookRequestStatus } from '@bookorbit/types'
+
+const props = defineProps<{ status: BookRequestStatus }>()
+
+const { t } = useI18n()
+
+/**
+ * Eleven statuses across five tones. Status is spelled out in text beside the colour, and the two
+ * terminal tones carry an icon as well, so nothing here is signalled by colour alone.
+ */
+const TONES = {
+  waiting: 'border-warning/40 bg-warning/10 text-warning',
+  progress: 'border-info/40 bg-info/10 text-info',
+  done: 'border-success/40 bg-success/10 text-success',
+  failed: 'border-destructive/40 bg-destructive/10 text-destructive',
+  stopped: 'border-border bg-muted text-muted-foreground',
+} as const
+
+type Tone = keyof typeof TONES
+
+const STATUS_TONES: Record<BookRequestStatus, Tone> = {
+  pending: 'waiting',
+  approved: 'progress',
+  searching: 'progress',
+  grabbed: 'progress',
+  downloading: 'progress',
+  importing: 'progress',
+  needs_review: 'waiting',
+  available: 'done',
+  rejected: 'failed',
+  failed: 'failed',
+  cancelled: 'stopped',
+}
+
+const tone = computed(() => STATUS_TONES[props.status] ?? 'stopped')
+const label = computed(() => t(`bookRequests.status.${props.status}`))
+</script>
+
+<template>
+  <span
+    class="inline-flex h-[22px] shrink-0 items-center gap-1.5 rounded-full border px-2 text-xs font-medium whitespace-nowrap"
+    :class="TONES[tone]"
+  >
+    <Check v-if="tone === 'done'" :size="12" :stroke-width="2.5" aria-hidden="true" />
+    <TriangleAlert v-else-if="tone === 'failed'" :size="12" aria-hidden="true" />
+    <span v-else class="size-1.5 rounded-full bg-current" aria-hidden="true" />
+    {{ label }}
+  </span>
+</template>
diff --git a/client/src/features/book-requests/composables/useBookRequestDetail.ts b/client/src/features/book-requests/composables/useBookRequestDetail.ts
new file mode 100644
index 000000000..0a1b8e63b
--- /dev/null
+++ b/client/src/features/book-requests/composables/useBookRequestDetail.ts
@@ -0,0 +1,66 @@
+import { ref } from 'vue'
+import { api } from '@/lib/api'
+import type { BookRequestItem } from '@bookorbit/types'
+
+export type BookRequestDetailError = 'notFound' | 'forbidden' | 'loadFailed'
+
+interface FetchBookRequestOptions {
+  background?: boolean
+}
+
+/**
+ * One request, fetched by id. The detail page is reachable by link and survives a refresh, so it
+ * cannot assume the list already fetched the row it is showing.
+ */
+export function useBookRequestDetail() {
+  const request = ref<BookRequestItem | null>(null)
+  const loading = ref(false)
+  const error = ref<BookRequestDetailError | null>(null)
+  /**
+   * Bumped per fetch so an answer about the request that was open a moment ago cannot land on the
+   * one open now. The drawer is a function of the URL, and stepping through the queue asks for the
+   * next request before the previous answer has arrived.
+   */
+  let generation = 0
+
+  async function fetchRequest(id: number, options: FetchBookRequestOptions = {}): Promise<void> {
+    const current = ++generation
+    const preserveCurrentRequest = options.background === true && request.value?.id === id
+    if (!preserveCurrentRequest) loading.value = true
+    error.value = null
+
+    try {
+      const res = await api(`/api/v1/book-requests/${id}`)
+      if (current !== generation) return
+      if (res.status === 404) {
+        error.value = 'notFound'
+        return
+      }
+      // The server distinguishes "no such request" from "not yours", and so should the page: one
+      // is a dead link and the other is a request that exists and is somebody else's.
+      if (res.status === 403) {
+        error.value = 'forbidden'
+        return
+      }
+      if (!res.ok) {
+        if (!preserveCurrentRequest) error.value = 'loadFailed'
+        return
+      }
+      const payload = (await res.json()) as BookRequestItem
+      if (current !== generation) return
+      request.value = payload
+    } catch {
+      if (current === generation && !preserveCurrentRequest) error.value = 'loadFailed'
+    } finally {
+      if (current === generation && !preserveCurrentRequest) loading.value = false
+    }
+  }
+
+  function setRequest(updated: BookRequestItem): void {
+    // A fetch still in flight was asked before this, so its answer is the older one of the two.
+    generation++
+    request.value = updated
+  }
+
+  return { request, loading, error, fetchRequest, setRequest }
+}
diff --git a/client/src/features/book-requests/composables/useBookRequestProgress.ts b/client/src/features/book-requests/composables/useBookRequestProgress.ts
new file mode 100644
index 000000000..94c5fa07a
--- /dev/null
+++ b/client/src/features/book-requests/composables/useBookRequestProgress.ts
@@ -0,0 +1,158 @@
+import { onScopeDispose, ref } from 'vue'
+import { Socket } from 'socket.io-client'
+import { createAuthenticatedSocket } from '@/lib/socket'
+import type { BookRequestDownloadStatus, BookRequestItem, BookRequestProgressEvent } from '@bookorbit/types'
+
+/**
+ * One shared namespace connection for the whole page. Progress arrives as small events keyed on a
+ * request id, so a card can move without the list refetching on every tick; `changed` is the
+ * coarse signal for anything a percentage cannot express, such as a status transition.
+ */
+const progressByRequest = ref<Record<number, BookRequestProgressEvent>>({})
+const connected = ref(false)
+const changeListeners = new Set<() => void>()
+let socket: Socket | null = null
+let subscribers = 0
+let sweepHandle: ReturnType<typeof setInterval> | null = null
+/** Whether this socket may have missed events since the page's initial fetch. */
+let missedEvents = false
+
+/** An attempt in one of these is over, so a tick describing it is history rather than progress. */
+const SETTLED_DOWNLOAD_STATUSES = new Set<BookRequestDownloadStatus>(['imported', 'needs_review', 'failed'])
+
+/**
+ * How long a tick nobody has heard from again is kept.
+ *
+ * `pruneSettledProgress` only reaches rows a page still holds, and the map outlives every page:
+ * the sidebar subscribes at startup, so nothing tears it down. A request that was mid-download
+ * when its row was filtered out, paged past or dismissed leaves an entry behind that nothing ever
+ * looks at again. Generous, because a queued torrent can sit between ticks for a long time, and a
+ * live attempt refreshes its own entry on every one.
+ */
+const STALE_PROGRESS_MS = 30 * 60 * 1000
+/** A ceiling for the pathological case, so the map is bounded even inside the staleness window. */
+const MAX_PROGRESS_ENTRIES = 500
+
+/** When each request last said anything, which is the only clock a tick itself does not carry. */
+const lastTickAt = new Map<number, number>()
+
+function forget(requestId: number): void {
+  delete progressByRequest.value[requestId]
+  lastTickAt.delete(requestId)
+}
+
+/**
+ * Drops what nothing is watching any more: entries no tick has refreshed inside the window, and
+ * then, if the map is still over its ceiling, the quietest ones until it is not.
+ */
+function sweepStaleProgress(now: number): void {
+  for (const [requestId, seenAt] of lastTickAt) {
+    if (now - seenAt > STALE_PROGRESS_MS) forget(requestId)
+  }
+  if (lastTickAt.size <= MAX_PROGRESS_ENTRIES) return
+
+  const oldestFirst = [...lastTickAt.entries()].sort((left, right) => left[1] - right[1])
+  for (const [requestId] of oldestFirst.slice(0, lastTickAt.size - MAX_PROGRESS_ENTRIES)) forget(requestId)
+}
+
+function getSocket(): Socket {
+  if (socket) return socket
+
+  socket = createAuthenticatedSocket('/book-requests', {
+    reconnection: true,
+    reconnectionDelay: 1000,
+    reconnectionDelayMax: 10000,
+  })
+
+  socket.on('book-requests:progress', (event: BookRequestProgressEvent) => {
+    const now = Date.now()
+    if (SETTLED_DOWNLOAD_STATUSES.has(event.status)) {
+      forget(event.requestId)
+    } else {
+      progressByRequest.value[event.requestId] = event
+      lastTickAt.set(event.requestId, now)
+    }
+    sweepStaleProgress(now)
+  })
+
+  socket.on('book-requests:changed', () => {
+    for (const listener of changeListeners) listener()
+  })
+
+  socket.on('connect', () => {
+    connected.value = true
+    // The server replays nothing, so every event that landed while this socket was down is gone:
+    // a laptop that slept or a server that restarted mid-transfer leaves rows showing "downloading
+    // 97%" until somebody changes a filter or reloads. A reconnect is answered with the same
+    // coalesced refetch a `changed` broadcast gets, which is the only thing that catches them up.
+    if (!missedEvents) return
+    missedEvents = false
+    for (const listener of changeListeners) listener()
+  })
+
+  socket.on('disconnect', () => {
+    connected.value = false
+    missedEvents = true
+  })
+
+  socket.on('connect_error', () => {
+    connected.value = false
+    missedEvents = true
+  })
+
+  return socket
+}
+
+export function useBookRequestProgress() {
+  let disposed = false
+  subscribers++
+  if (!sweepHandle) {
+    sweepHandle = setInterval(() => sweepStaleProgress(Date.now()), Math.min(STALE_PROGRESS_MS, 5 * 60 * 1000))
+  }
+  getSocket()
+
+  onScopeDispose(() => {
+    if (disposed) return
+    disposed = true
+    subscribers--
+    if (subscribers > 0 || !socket) return
+    socket.disconnect()
+    socket = null
+    if (sweepHandle) clearInterval(sweepHandle)
+    sweepHandle = null
+    connected.value = false
+    missedEvents = false
+    progressByRequest.value = {}
+    lastTickAt.clear()
+  })
+
+  /**
+   * Cleanup is by scope alone, so this must be called during synchronous setup like any other
+   * lifecycle registration. There is deliberately no unsubscribe handle: two ways to stop
+   * listening is one more than any caller has ever needed, and returning one invites a call from
+   * outside a scope, where nothing would ever remove the listener.
+   */
+  function onRequestsChanged(fn: () => void): void {
+    changeListeners.add(fn)
+    onScopeDispose(() => changeListeners.delete(fn))
+  }
+
+  /**
+   * Drops the ticks that the rows just fetched have caught up with. The map lives for as long as
+   * the app does - the sidebar subscribes at startup, so it is never torn down by the last page
+   * unmounting - and without this it keeps one entry per request that ever downloaded.
+   *
+   * Only rows whose own attempt has settled are dropped, and only where the tick describes that
+   * same attempt, so a fetch that started before a fresh grab cannot evict its first tick.
+   */
+  function pruneSettledProgress(requests: readonly Pick<BookRequestItem, 'id' | 'download'>[]): void {
+    for (const request of requests) {
+      const download = request.download
+      const tick = progressByRequest.value[request.id]
+      if (!download || !tick || tick.downloadId !== download.id) continue
+      if (SETTLED_DOWNLOAD_STATUSES.has(download.status)) forget(request.id)
+    }
+  }
+
+  return { progressByRequest, connected, onRequestsChanged, pruneSettledProgress }
+}
diff --git a/client/src/features/book-requests/composables/useBookRequestSummary.ts b/client/src/features/book-requests/composables/useBookRequestSummary.ts
new file mode 100644
index 000000000..b9137c55a
--- /dev/null
+++ b/client/src/features/book-requests/composables/useBookRequestSummary.ts
@@ -0,0 +1,60 @@
+import { ref } from 'vue'
+import type { BookRequestSummary } from '@bookorbit/types'
+import { api } from '@/lib/api'
+
+const summary = ref<BookRequestSummary | null>(null)
+let fetchPromise: Promise<void> | null = null
+/** A forced refresh waiting on the fetch that was already in flight when it was asked for. */
+let queuedRefresh: Promise<void> | null = null
+let requestGeneration = 0
+
+export function resetBookRequestSummary(): void {
+  requestGeneration += 1
+  summary.value = null
+  fetchPromise = null
+  queuedRefresh = null
+}
+
+export function useBookRequestSummary() {
+  function fetchSummary(force = false): Promise<void> {
+    if (!force && summary.value) return Promise.resolve()
+    if (fetchPromise) return fetchPromise
+    const generation = requestGeneration
+    fetchPromise = api('/api/v1/book-requests/summary')
+      .then(async (res) => {
+        if (!res.ok) return
+        const next: BookRequestSummary = await res.json()
+        if (generation !== requestGeneration) return
+        summary.value = next
+      })
+      .catch(() => {
+        // The badge is supplementary, so a failed refresh leaves it hidden or stale.
+      })
+      .finally(() => {
+        if (generation === requestGeneration) fetchPromise = null
+      })
+    return fetchPromise
+  }
+
+  /**
+   * The counts as they are *after* whatever the caller just did.
+   *
+   * Joining the fetch already in flight would answer with counts the server produced before the
+   * action, and the badge would then sit on a pre-action number until something else moved. One
+   * fresh fetch is queued behind it instead, and every caller in the same window shares that one.
+   */
+  function refreshSummary(): Promise<void> {
+    if (!fetchPromise) return fetchSummary(true)
+    if (queuedRefresh) return queuedRefresh
+
+    const generation = requestGeneration
+    queuedRefresh = fetchPromise.then(() => {
+      queuedRefresh = null
+      if (generation !== requestGeneration) return
+      return fetchSummary(true)
+    })
+    return queuedRefresh
+  }
+
+  return { summary, fetchSummary, refreshSummary }
+}
diff --git a/client/src/features/book-requests/composables/useBookRequests.ts b/client/src/features/book-requests/composables/useBookRequests.ts
new file mode 100644
index 000000000..9ea32d63f
--- /dev/null
+++ b/client/src/features/book-requests/composables/useBookRequests.ts
@@ -0,0 +1,368 @@
+import { computed, onScopeDispose, ref } from 'vue'
+import { bookRequestActionErrorCode, bookRequestSubmitErrorCode, grabFailureCode } from '@bookorbit/types'
+import { api } from '@/lib/api'
+import { fulfilmentBase } from '../fulfilmentBase'
+import type {
+  BookRequestItem,
+  BookRequestActionErrorCode,
+  BookRequestFailureMeta,
+  BookRequestMediaKind,
+  BookRequestPage,
+  BookRequestRequesterOption,
+  BookRequestSortDirection,
+  BookRequestSortField,
+  BookRequestStatus,
+  BookRequestSubmitErrorCode,
+  BookRequestBulkResult,
+  BulkBookRequestsPayload,
+  BulkRejectBookRequestsPayload,
+  DecideBookRequestPayload,
+  FulfillBookRequestPayload,
+  GrabBookRequestPayload,
+  GrabFailureCode,
+  RemoveBookRequestDownloadPayload,
+  SelectReleaseUnitPayload,
+} from '@bookorbit/types'
+
+export type RequestScope = 'mine' | 'all'
+
+const PAGE_SIZE = 20
+
+export function useBookRequests(scope: RequestScope) {
+  const items = ref<BookRequestItem[]>([])
+  const total = ref(0)
+  const page = ref(1)
+  const status = ref<BookRequestStatus | ''>('')
+  const mediaKind = ref<BookRequestMediaKind | ''>('')
+  const requesterUserId = ref<number | ''>('')
+  const requesterOptions = ref<BookRequestRequesterOption[]>([])
+  let requesterOptionsInitialized = false
+  const includeDismissed = ref(false)
+  /** '' is "either", so the control has a third state rather than a checkbox that means two. */
+  const selfServe = ref<'' | 'true' | 'false'>('')
+  const sortBy = ref<BookRequestSortField>('createdAt')
+  const sortDir = ref<BookRequestSortDirection>('desc')
+  const loading = ref(false)
+  const initialized = ref(false)
+  const error = ref<string | null>(null)
+
+  const pageCount = computed(() => Math.max(1, Math.ceil(total.value / PAGE_SIZE)))
+  const basePath = scope === 'all' ? '/api/v1/admin/book-requests' : '/api/v1/book-requests'
+
+  /**
+   * Bumped per list fetch so a slow answer to an earlier question cannot land on a later one.
+   *
+   * Filters, sorts, pages and every change broadcast all ask this again, so several answers are
+   * routinely in flight at once and they do not come back in the order they were asked. Without
+   * this the page shows whichever finished last, which is a filter the user has already changed.
+   */
+  let fetchGeneration = 0
+  /**
+   * Bumped whenever the page writes a row itself, so a fetch that was already in flight when a
+   * decision landed discards its answer instead of putting the old status back.
+   */
+  let localEdits = 0
+
+  async function fetchRequests(): Promise<void> {
+    const generation = ++fetchGeneration
+    const edits = localEdits
+    loading.value = true
+    error.value = null
+    const query = new URLSearchParams({ page: String(page.value), limit: String(PAGE_SIZE) })
+    if (status.value) query.set('status', status.value)
+    if (mediaKind.value) query.set('mediaKind', mediaKind.value)
+    // Only the approver queue accepts a requester filter; the personal list refuses the parameter.
+    if (scope === 'all' && requesterUserId.value !== '') query.set('requesterUserId', String(requesterUserId.value))
+    if (includeDismissed.value) query.set('includeDismissed', 'true')
+    if (selfServe.value !== '') query.set('selfServe', selfServe.value)
+    query.set('sortBy', sortBy.value)
+    query.set('sortDir', sortDir.value)
+
+    try {
+      const res = await api(`${basePath}?${query}`)
+      if (generation !== fetchGeneration) return
+      if (!res.ok) {
+        error.value = 'loadFailed'
+        return
+      }
+      const payload = (await res.json()) as BookRequestPage
+      if (generation !== fetchGeneration || edits !== localEdits) return
+      items.value = payload.items
+      total.value = payload.total
+    } catch {
+      if (generation === fetchGeneration) error.value = 'loadFailed'
+    } finally {
+      // A newer fetch owns the spinner from here, so an older one must not put it away.
+      if (generation === fetchGeneration) {
+        loading.value = false
+        initialized.value = true
+      }
+    }
+  }
+
+  /** The requesters the filter offers, fetched once when the tab that has the filter first opens. */
+  async function fetchRequesterOptions(): Promise<void> {
+    if (scope !== 'all' || requesterOptionsInitialized) return
+    try {
+      const res = await api('/api/v1/admin/book-requests/requesters')
+      if (!res.ok) return
+      requesterOptions.value = (await res.json()) as BookRequestRequesterOption[]
+      requesterOptionsInitialized = true
+    } catch {
+      // The request list remains usable and the next tab visit retries this.
+    }
+  }
+
+  onScopeDispose(() => {
+    fetchGeneration += 1
+  })
+
+  /** Filters reset paging: page 3 of the old filter is rarely page 3 of the new one. */
+  async function applyFilters(): Promise<void> {
+    page.value = 1
+    await fetchRequests()
+  }
+
+  /**
+   * Clicking the column already sorted on flips its direction; a new column starts at the reading
+   * most people want first, which is newest for a date and A to Z for everything else.
+   */
+  async function applySort(field: BookRequestSortField): Promise<void> {
+    if (sortBy.value === field) sortDir.value = sortDir.value === 'asc' ? 'desc' : 'asc'
+    else {
+      sortBy.value = field
+      sortDir.value = field === 'createdAt' ? 'desc' : 'asc'
+    }
+    page.value = 1
+    await fetchRequests()
+  }
+
+  async function goToPage(next: number): Promise<void> {
+    const clamped = Math.min(Math.max(1, next), pageCount.value)
+    if (clamped === page.value) return
+    page.value = clamped
+    await fetchRequests()
+  }
+
+  /**
+   * Replaces one row in place so a decision does not flash the whole list.
+   *
+   * The generation moves with it. A list fetch started before the decision is answered with the
+   * row as it was, and landing afterwards it would put the old status back for as long as it takes
+   * the next fetch to disagree; a decision the user just made must outrank a question asked before
+   * it. The broadcast that follows every transition is what fetches the list again.
+   */
+  function replaceItem(updated: BookRequestItem): void {
+    const index = items.value.findIndex((item) => item.id === updated.id)
+    if (index === -1) return
+    items.value.splice(index, 1, updated)
+    localEdits++
+  }
+
+  /**
+   * Drops a row the list should no longer be holding. The total goes with it, so the pager does
+   * not keep claiming a page that is now one row shorter than it says.
+   */
+  function dropItem(id: number): void {
+    const index = items.value.findIndex((item) => item.id === id)
+    if (index === -1) return
+    items.value.splice(index, 1)
+    total.value = Math.max(0, total.value - 1)
+    localEdits++
+  }
+
+  return {
+    items,
+    total,
+    page,
+    pageCount,
+    status,
+    mediaKind,
+    requesterUserId,
+    requesterOptions,
+    includeDismissed,
+    selfServe,
+    sortBy,
+    sortDir,
+    loading,
+    initialized,
+    error,
+    fetchRequests,
+    fetchRequesterOptions,
+    applyFilters,
+    applySort,
+    goToPage,
+    replaceItem,
+    dropItem,
+  }
+}
+
+/**
+ * A rejected action carries the reason in the body, and for a grab that reason is the tracker's own
+ * sentence about this one release. Dropping it leaves the operator with a toast that says only that
+ * something failed, which for a refusal they could act on is the least useful thing to show.
+ */
+async function postRequest(path: string, body?: unknown): Promise<ActionOutcome> {
+  const res = await api(path, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify(body ?? {}),
+  })
+  if (!res.ok) {
+    const payload = (await res.json().catch(() => null)) as {
+      message?: string | string[]
+      errorCode?: unknown
+      errorMeta?: BookRequestFailureMeta
+    } | null
+    const message = Array.isArray(payload?.message) ? payload.message.join('. ') : payload?.message
+    const errorCode =
+      grabFailureCode(payload?.errorCode) ?? bookRequestActionErrorCode(payload?.errorCode) ?? bookRequestSubmitErrorCode(payload?.errorCode)
+    return {
+      item: null,
+      reason: message?.trim() ? message.trim() : null,
+      errorCode,
+      errorMeta: payload?.errorMeta ?? null,
+    }
+  }
+  return { item: (await res.json()) as BookRequestItem, reason: null, errorCode: null, errorMeta: null }
+}
+
+/**
+ * One action's own outcome.
+ *
+ * Returned rather than only stashed on the composable, because a row's refusal belongs to that
+ * row. Two rows acted on at once used to share one `lastReason`, so whichever call answered last
+ * described both and the first row's toast quoted the second row's tracker.
+ */
+export interface ActionOutcome {
+  item: BookRequestItem | null
+  reason: string | null
+  errorCode: GrabFailureCode | BookRequestActionErrorCode | BookRequestSubmitErrorCode | null
+  errorMeta?: BookRequestFailureMeta | null
+}
+
+/** The same, for the one action that answers 204 and so has no row to hand back. */
+export interface DeleteOutcome {
+  ok: boolean
+  reason: string | null
+}
+
+/** A 204 carries no row to hand back, so success is the absence of a reason rather than an item. */
+async function deleteRequest(path: string): Promise<{ ok: boolean; reason: string | null }> {
+  const res = await api(path, { method: 'DELETE' })
+  if (res.ok) return { ok: true, reason: null }
+  const payload = (await res.json().catch(() => null)) as { message?: string | string[] } | null
+  const message = Array.isArray(payload?.message) ? payload.message.join('. ') : payload?.message
+  return { ok: false, reason: message?.trim() ? message.trim() : null }
+}
+
+export function useBookRequestActions(canManage: () => boolean) {
+  const basePath = () => fulfilmentBase(canManage())
+  /**
+   * Every row with an action in flight, not the last one started.
+   *
+   * A single id could only describe one action at a time, so acting on a second row while the
+   * first was still running re-enabled the first row's buttons the moment the second finished -
+   * mid-flight, and inviting a second click on work already under way.
+   */
+  const pendingIds = ref<Set<number>>(new Set())
+  /** A batch has no single row to mark busy, so it disables the bulk bar rather than a table row. */
+  const bulkPending = ref(false)
+  /** Why the last batch was refused, where the server said something worth repeating verbatim. */
+  const lastReason = ref<string | null>(null)
+
+  function isPending(id: number | null | undefined): boolean {
+    return id != null && pendingIds.value.has(id)
+  }
+
+  function markPending(id: number, pending: boolean) {
+    const next = new Set(pendingIds.value)
+    if (pending) next.add(id)
+    else next.delete(id)
+    pendingIds.value = next
+  }
+
+  async function run(id: number, path: string, body?: unknown): Promise<ActionOutcome> {
+    markPending(id, true)
+    try {
+      return await postRequest(path, body)
+    } finally {
+      markPending(id, false)
+    }
+  }
+
+  async function runDelete(id: number, path: string): Promise<DeleteOutcome> {
+    markPending(id, true)
+    try {
+      return await deleteRequest(path)
+    } finally {
+      markPending(id, false)
+    }
+  }
+
+  /**
+   * The batch reports per-row outcomes, so `null` here means the call itself failed rather than
+   * that nothing was applied. The two need different messages.
+   */
+  async function runBulk(path: string, payload: BulkBookRequestsPayload): Promise<BookRequestBulkResult | null> {
+    bulkPending.value = true
+    lastReason.value = null
+    try {
+      const res = await api(path, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(payload),
+      })
+      if (!res.ok) {
+        const payload = (await res.json().catch(() => null)) as { message?: string | string[] } | null
+        const message = Array.isArray(payload?.message) ? payload.message.join('. ') : payload?.message
+        lastReason.value = message?.trim() ? message.trim() : null
+        return null
+      }
+      return (await res.json()) as BookRequestBulkResult
+    } finally {
+      bulkPending.value = false
+    }
+  }
+
+  const approveMany = (ids: number[]) => runBulk('/api/v1/admin/book-requests/approve', { ids })
+  const dismissMany = (ids: number[]) => runBulk('/api/v1/book-requests/dismiss', { ids })
+  /** One sentence for the whole selection, since a batch is refused for one reason or none. */
+  const rejectMany = (ids: number[], decisionNote?: string) =>
+    runBulk('/api/v1/admin/book-requests/reject', { ids, ...(decisionNote ? { decisionNote } : {}) } satisfies BulkRejectBookRequestsPayload)
+
+  return {
+    pendingIds,
+    isPending,
+    bulkPending,
+    lastReason,
+    approve: (id: number, body: DecideBookRequestPayload) => run(id, `/api/v1/admin/book-requests/${id}/approve`, body),
+    reject: (id: number, body: DecideBookRequestPayload) => run(id, `/api/v1/admin/book-requests/${id}/reject`, body),
+    fulfill: (id: number, body: FulfillBookRequestPayload) => run(id, `/api/v1/admin/book-requests/${id}/fulfill`, body),
+    // The three a self-server may also call on their own row. Everything above them stays on the
+    // admin path, and the UI only offers those to a moderator.
+    grab: async (id: number, body: GrabBookRequestPayload) => {
+      const outcome = await run(id, `${basePath()}/${id}/grab`, body)
+      return { ...outcome, errorCode: grabFailureCode(outcome.errorCode) }
+    },
+    forceFile: (id: number) => run(id, `${basePath()}/${id}/force-file`),
+    /** The other answer to a held import: the release was the wrong book, so throw it away. */
+    discardImport: (id: number) => run(id, `${basePath()}/${id}/discard-import`),
+    removeDownload: (id: number, downloadId: number, body: RemoveBookRequestDownloadPayload) =>
+      run(id, `/api/v1/admin/book-requests/${id}/downloads/${downloadId}/remove`, body),
+    selectReleaseUnit: (id: number, downloadId: number, body: SelectReleaseUnitPayload) =>
+      run(id, `${basePath()}/${id}/downloads/${downloadId}/select-unit`, body),
+    approveMany,
+    rejectMany,
+    dismissMany,
+    /** The language the request asks for, which decides which releases can match it at all. */
+    setLanguage: (id: number, language: string | null) => run(id, `/api/v1/book-requests/${id}/language`, { language }),
+    cancelDownload: (id: number, downloadId: number) => run(id, `/api/v1/book-requests/${id}/downloads/${downloadId}/cancel`),
+    cancel: (id: number) => run(id, `/api/v1/book-requests/${id}/cancel`),
+    dismiss: (id: number) => run(id, `/api/v1/book-requests/${id}/dismiss`),
+    restore: (id: number) => run(id, `/api/v1/book-requests/${id}/restore`),
+    remove: (id: number) => runDelete(id, `/api/v1/admin/book-requests/${id}`),
+    /** Leaving a request somebody else made. 204, so there is no row to hand back afterwards. */
+    leave: (id: number) => runDelete(id, `/api/v1/book-requests/${id}/subscription`),
+  }
+}
diff --git a/client/src/features/book-requests/composables/useCandidateGroups.ts b/client/src/features/book-requests/composables/useCandidateGroups.ts
new file mode 100644
index 000000000..b50f27bd5
--- /dev/null
+++ b/client/src/features/book-requests/composables/useCandidateGroups.ts
@@ -0,0 +1,200 @@
+import { computed, type ComputedRef, type Ref } from 'vue'
+import { bookRequestWorkKey, canonicalizeBookRequestIsbn, languagesAgree } from '@bookorbit/types'
+import type { BookRequestAvailability, BookRequestMediaKind, MetadataCandidate, MetadataProviderKey } from '@bookorbit/types'
+import { candidateTitle } from './useRequestSubmission'
+
+/**
+ * One work, assembled from every provider that described it. A requester picks a book, not a
+ * metadata record, so the list shows works and keeps the records behind them.
+ */
+export interface CandidateGroup {
+  key: string
+  /** The record a request is built from: the most complete one the providers returned. */
+  candidate: MetadataCandidate
+  /** Every provider record behind the work row, retained so identifiers never disappear silently. */
+  candidates: MetadataCandidate[]
+  /** Distinct canonical ISBN-13 values after equivalent ISBN-10 values are folded in. */
+  isbns: string[]
+  /** ISBN editions ordered by the same evidence used for the primary action. */
+  isbnChoices: CandidateIsbnChoice[]
+  /** The exact edition used by the primary action, or null when only title and author are available. */
+  recommendedIsbnChoice: CandidateIsbnChoice | null
+  title: string
+  authors: string[]
+  coverUrl: string | null
+  coverUrls: string[]
+  publishedYear: number | null
+  providers: MetadataProviderKey[]
+  availability: BookRequestAvailability | null
+}
+
+export interface CandidateIsbnChoice {
+  isbn: string
+  candidate: MetadataCandidate
+  providers: MetadataProviderKey[]
+  languageRank: number
+  agreementCount: number
+  providerPriority: number
+  providerResultRank: number
+  yearDistance: number
+}
+
+/** A record with a cover and an ISBN says more about the book than a bare title and year. */
+function completeness(candidate: MetadataCandidate): number {
+  return (candidate.coverUrl ? 4 : 0) + (candidate.isbn13 ? 2 : 0) + (candidate.publishedYear ? 1 : 0)
+}
+
+function candidateLanguageRank(requestedLanguage: string | null | undefined, candidate: MetadataCandidate): number {
+  if (!requestedLanguage) return 1
+  if (!candidate.language) return 1
+  return languagesAgree(requestedLanguage, candidate.language) ? 2 : 0
+}
+
+function candidateYearDistance(workYear: number | null, candidate: MetadataCandidate): number {
+  return workYear !== null && candidate.publishedYear != null ? Math.abs(candidate.publishedYear - workYear) : Number.MAX_SAFE_INTEGER
+}
+
+function compareText(left: string, right: string): number {
+  return left < right ? -1 : left > right ? 1 : 0
+}
+
+/**
+ * The strongest claim any record in the group carries. Requesting one edition of a work claims the
+ * work, so an answer about one record answers for its siblings too.
+ */
+function mergeAvailability(members: MetadataCandidate[], getAvailability: (candidate: MetadataCandidate) => BookRequestAvailability | null) {
+  const known = members.map(getAvailability).filter((entry): entry is BookRequestAvailability => entry !== null)
+  if (known.length === 0) return null
+
+  const requested = known.find((entry) => entry.existingRequestId !== null)
+  return {
+    ownedBookId: known.find((entry) => entry.ownedBookId !== null)?.ownedBookId ?? null,
+    existingRequestId: requested?.existingRequestId ?? null,
+    existingRequestStatus: requested?.existingRequestStatus ?? null,
+    alreadySubscribed: known.some((entry) => entry.alreadySubscribed),
+  }
+}
+
+/**
+ * Collapses search results into the works they describe, keyed exactly as the server dedupes a
+ * request. Without this a title carried by five providers reads as five different books, and
+ * requesting one of them leaves the other four still offering a button that folds into it.
+ */
+export function useCandidateGroups(
+  results: Ref<MetadataCandidate[]> | ComputedRef<MetadataCandidate[]>,
+  mediaKind: Ref<BookRequestMediaKind>,
+  getAvailability: (candidate: MetadataCandidate) => BookRequestAvailability | null,
+  coverProviderOrder?: Ref<readonly MetadataProviderKey[]> | ComputedRef<readonly MetadataProviderKey[]>,
+  requestedLanguage?: Ref<string | null> | ComputedRef<string | null>,
+  resultProviderOrder?: Ref<readonly MetadataProviderKey[]> | ComputedRef<readonly MetadataProviderKey[]>,
+): { groups: ComputedRef<CandidateGroup[]> } {
+  const groups = computed<CandidateGroup[]>(() => {
+    const providerPriorities = new Map((resultProviderOrder?.value ?? []).map((provider, index) => [provider, index]))
+    const providerResultCounts = new Map<MetadataProviderKey, number>()
+    const providerResultRanks = new Map<MetadataCandidate, number>()
+
+    for (const candidate of results.value) {
+      const rank = providerResultCounts.get(candidate.provider) ?? 0
+      providerResultRanks.set(candidate, rank)
+      providerResultCounts.set(candidate.provider, rank + 1)
+    }
+
+    const providerPriority = (provider: MetadataProviderKey): number => providerPriorities.get(provider) ?? providerPriorities.size
+
+    // Insertion order carries the provider ranking the results already arrived in, so it is what
+    // orders the works too.
+    const byWork = new Map<string, MetadataCandidate[]>()
+    for (const candidate of results.value) {
+      const title = candidateTitle(candidate)
+      if (!title) continue
+      const key = bookRequestWorkKey(title, candidate.authors?.[0], mediaKind.value)
+      const members = byWork.get(key)
+      if (members) members.push(candidate)
+      else byWork.set(key, [candidate])
+    }
+
+    return [...byWork.entries()].map(([key, members]) => {
+      const ranked = [...members].sort(
+        (a, b) =>
+          completeness(b) - completeness(a) ||
+          providerPriority(a.provider) - providerPriority(b.provider) ||
+          (providerResultRanks.get(a) ?? Number.MAX_SAFE_INTEGER) - (providerResultRanks.get(b) ?? Number.MAX_SAFE_INTEGER) ||
+          compareText(a.provider, b.provider) ||
+          compareText(a.providerId, b.providerId),
+      )
+      const best = ranked[0]!
+      const years = members.map((member) => member.publishedYear).filter((year): year is number => year != null)
+      const workYear = years.length ? Math.min(...years) : null
+      const membersByIsbn = new Map<string, MetadataCandidate[]>()
+      for (const member of members) {
+        const isbn = canonicalizeBookRequestIsbn(member.isbn10, member.isbn13)
+        if (!isbn) continue
+        const matching = membersByIsbn.get(isbn)
+        if (matching) matching.push(member)
+        else membersByIsbn.set(isbn, [member])
+      }
+      const isbnChoices = [...membersByIsbn.entries()]
+        .map(([isbn, matching]): CandidateIsbnChoice => {
+          const rankedMatches = [...matching].sort(
+            (a, b) =>
+              candidateLanguageRank(requestedLanguage?.value, b) - candidateLanguageRank(requestedLanguage?.value, a) ||
+              providerPriority(a.provider) - providerPriority(b.provider) ||
+              (providerResultRanks.get(a) ?? Number.MAX_SAFE_INTEGER) - (providerResultRanks.get(b) ?? Number.MAX_SAFE_INTEGER) ||
+              candidateYearDistance(workYear, a) - candidateYearDistance(workYear, b) ||
+              compareText(a.provider, b.provider) ||
+              compareText(a.providerId, b.providerId),
+          )
+          const representative = rankedMatches[0]!
+          return {
+            isbn,
+            candidate: representative,
+            providers: [...new Set(matching.map((candidate) => candidate.provider))].sort(
+              (a, b) => providerPriority(a) - providerPriority(b) || compareText(a, b),
+            ),
+            languageRank: Math.max(...matching.map((candidate) => candidateLanguageRank(requestedLanguage?.value, candidate))),
+            agreementCount: new Set(matching.map((candidate) => candidate.provider)).size,
+            providerPriority: providerPriority(representative.provider),
+            providerResultRank: providerResultRanks.get(representative) ?? Number.MAX_SAFE_INTEGER,
+            yearDistance: Math.min(...matching.map((candidate) => candidateYearDistance(workYear, candidate))),
+          }
+        })
+        .sort(
+          (a, b) =>
+            b.languageRank - a.languageRank ||
+            b.agreementCount - a.agreementCount ||
+            a.providerPriority - b.providerPriority ||
+            a.providerResultRank - b.providerResultRank ||
+            a.yearDistance - b.yearDistance ||
+            compareText(a.isbn, b.isbn),
+        )
+      const coverPriorities = new Map((coverProviderOrder?.value ?? []).map((provider, index) => [provider, index]))
+      const coverUrls = [...members]
+        .sort((a, b) => {
+          const aPriority = coverPriorities.get(a.provider) ?? Number.MAX_SAFE_INTEGER
+          const bPriority = coverPriorities.get(b.provider) ?? Number.MAX_SAFE_INTEGER
+          return aPriority - bPriority || completeness(b) - completeness(a)
+        })
+        .flatMap((member) => (member.coverUrl ? [member.coverUrl] : []))
+        .filter((url, index, urls) => urls.indexOf(url) === index)
+
+      return {
+        key,
+        candidate: best,
+        candidates: members,
+        isbns: isbnChoices.map((choice) => choice.isbn),
+        isbnChoices,
+        recommendedIsbnChoice: isbnChoices[0] ?? null,
+        title: candidateTitle(best),
+        authors: best.authors ?? [],
+        coverUrl: coverUrls[0] ?? null,
+        coverUrls,
+        // The earliest edition dates the work; a reprint year only says when this record was made.
+        publishedYear: workYear,
+        providers: [...new Set(members.map((member) => member.provider))],
+        availability: mergeAvailability(members, getAvailability),
+      }
+    })
+  })
+
+  return { groups }
+}
diff --git a/client/src/features/book-requests/composables/useCoalescedRefresh.ts b/client/src/features/book-requests/composables/useCoalescedRefresh.ts
new file mode 100644
index 000000000..1e19ab58e
--- /dev/null
+++ b/client/src/features/book-requests/composables/useCoalescedRefresh.ts
@@ -0,0 +1,32 @@
+import { onScopeDispose } from 'vue'
+
+/**
+ * Turns a stream of triggers into at most one refresh per window.
+ *
+ * The pipeline broadcasts a change per transition, and one request moving from approved through to
+ * available is several of them within a couple of seconds. Every connected page answers each one
+ * with a list fetch and a summary, so a burst is worth collapsing. Leading edge, so a single change
+ * still lands immediately rather than a window late, and a trailing run always follows a burst so
+ * the last change is never the one that goes unread.
+ */
+export function useCoalescedRefresh(refresh: () => void, windowMs: number): () => void {
+  let handle: ReturnType<typeof setTimeout> | null = null
+  let lastRefreshAt = 0
+
+  onScopeDispose(() => {
+    if (handle) clearTimeout(handle)
+    handle = null
+  })
+
+  return () => {
+    if (handle) return
+    handle = setTimeout(
+      () => {
+        handle = null
+        lastRefreshAt = Date.now()
+        refresh()
+      },
+      Math.max(0, windowMs - (Date.now() - lastRefreshAt)),
+    )
+  }
+}
diff --git a/client/src/features/book-requests/composables/useDownloadClients.ts b/client/src/features/book-requests/composables/useDownloadClients.ts
new file mode 100644
index 000000000..02ba734d9
--- /dev/null
+++ b/client/src/features/book-requests/composables/useDownloadClients.ts
@@ -0,0 +1,237 @@
+import { ref } from 'vue'
+import { api } from '@/lib/api'
+import { fulfilmentBase } from '../fulfilmentBase'
+import type {
+  CreateDownloadClientPayload,
+  DownloadClientErrorCode,
+  DownloadClientItem,
+  DownloadClientListResult,
+  DownloadClientReconciliationResult,
+  DownloadClientSummary,
+  DownloadClientTestResult,
+  PathMappingHardlinkTestResult,
+  UpdateDownloadClientPayload,
+} from '@bookorbit/types'
+
+const BASE_PATH = '/api/v1/admin/download-clients'
+
+/**
+ * A failed call reports a stable code when the server sent one, so the page can say what went
+ * wrong in the reader's own language rather than forwarding an English sentence.
+ */
+export interface DownloadClientFailure {
+  errorCode: DownloadClientErrorCode | null
+  message: string | null
+}
+
+async function toFailure(res: Response): Promise<DownloadClientFailure> {
+  try {
+    const body = (await res.json()) as { message?: string | string[]; errorCode?: string }
+    const message = Array.isArray(body.message) ? (body.message[0] ?? null) : (body.message ?? null)
+    return { errorCode: (body.errorCode as DownloadClientErrorCode | undefined) ?? null, message }
+  } catch {
+    return { errorCode: null, message: null }
+  }
+}
+
+const NETWORK_FAILURE: DownloadClientFailure = { errorCode: null, message: null }
+
+export function useDownloadClients() {
+  const clients = ref<DownloadClientItem[]>([])
+  /** False when `BOOK_REQUEST_ENCRYPTION_KEY` is unset, which is what refuses a saved password. */
+  const encryptionConfigured = ref(true)
+  const loading = ref(false)
+  const saving = ref(false)
+  const loadFailed = ref(false)
+  const reconciliation = ref<Record<number, DownloadClientReconciliationResult | undefined>>({})
+  const reconcilingIds = ref<Set<number>>(new Set())
+
+  function markReconciling(id: number, active: boolean) {
+    const next = new Set(reconcilingIds.value)
+    if (active) next.add(id)
+    else next.delete(id)
+    reconcilingIds.value = next
+  }
+
+  /**
+   * `silent` refreshes the list without blanking the panel. The loading flag swaps the whole
+   * section for a spinner, which after a test or a save reads as the page reloading and throws
+   * away the reader's scroll position, so it is only for the first load.
+   */
+  async function fetchClients({ silent = false }: { silent?: boolean } = {}): Promise<void> {
+    if (!silent) loading.value = true
+    loadFailed.value = false
+    try {
+      const res = await api(BASE_PATH)
+      if (!res.ok) {
+        loadFailed.value = true
+        return
+      }
+      const result = (await res.json()) as DownloadClientListResult
+      clients.value = result.clients
+      encryptionConfigured.value = result.encryptionConfigured
+    } catch {
+      loadFailed.value = true
+    } finally {
+      loading.value = false
+    }
+  }
+
+  async function save(id: number | null, payload: CreateDownloadClientPayload | UpdateDownloadClientPayload): Promise<DownloadClientFailure | null> {
+    saving.value = true
+    try {
+      const res = await api(id === null ? BASE_PATH : `${BASE_PATH}/${id}`, {
+        method: id === null ? 'POST' : 'PUT',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(payload),
+      })
+      if (!res.ok) return await toFailure(res)
+      await fetchClients({ silent: true })
+      return null
+    } catch {
+      return NETWORK_FAILURE
+    } finally {
+      saving.value = false
+    }
+  }
+
+  async function remove(id: number): Promise<boolean> {
+    saving.value = true
+    try {
+      const res = await api(`${BASE_PATH}/${id}`, { method: 'DELETE' })
+      if (!res.ok) return false
+      await fetchClients({ silent: true })
+      return true
+    } catch {
+      return false
+    } finally {
+      saving.value = false
+    }
+  }
+
+  async function test(id: number): Promise<DownloadClientTestResult> {
+    try {
+      const res = await api(`${BASE_PATH}/${id}/test`, { method: 'POST' })
+      // A failed test answers 502 carrying its reason, so both outcomes are read the same way.
+      const result: DownloadClientTestResult = res.ok
+        ? ((await res.json()) as DownloadClientTestResult)
+        : { success: false, error: (await toFailure(res)).message ?? undefined }
+      // The server stamps the row either way, so the card is refreshed either way: that stamp is
+      // where the reason is kept once this toast is gone.
+      await fetchClients({ silent: true })
+      return result
+    } catch {
+      return { success: false }
+    }
+  }
+
+  /** The mapping is named by id: the server probes the directory it stored, never one sent to it. */
+  async function testPathMapping(id: number, mappingId: number): Promise<PathMappingHardlinkTestResult> {
+    const unavailable = { localPathExists: false, bookDockPathExists: false, hardlinkWorks: false }
+    try {
+      const res = await api(`${BASE_PATH}/${id}/test-path-mapping`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ mappingId }),
+      })
+      if (!res.ok) return { ...unavailable, error: (await toFailure(res)).message ?? undefined }
+      return (await res.json()) as PathMappingHardlinkTestResult
+    } catch {
+      return unavailable
+    }
+  }
+
+  async function reconcile(id: number): Promise<DownloadClientFailure | null> {
+    markReconciling(id, true)
+    try {
+      const res = await api(`${BASE_PATH}/${id}/reconciliation`)
+      if (!res.ok) return await toFailure(res)
+      reconciliation.value = { ...reconciliation.value, [id]: (await res.json()) as DownloadClientReconciliationResult }
+      return null
+    } catch {
+      return NETWORK_FAILURE
+    } finally {
+      markReconciling(id, false)
+    }
+  }
+
+  async function adopt(clientId: number, infoHash: string, downloadId: number): Promise<DownloadClientFailure | null> {
+    markReconciling(clientId, true)
+    try {
+      const res = await api(`${BASE_PATH}/${clientId}/reconciliation/${encodeURIComponent(infoHash)}/adopt`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ downloadId }),
+      })
+      if (!res.ok) return await toFailure(res)
+      return await reconcile(clientId)
+    } catch {
+      return NETWORK_FAILURE
+    } finally {
+      markReconciling(clientId, false)
+    }
+  }
+
+  async function removeOrphan(clientId: number, infoHash: string): Promise<DownloadClientFailure | null> {
+    markReconciling(clientId, true)
+    try {
+      const res = await api(`${BASE_PATH}/${clientId}/reconciliation/${encodeURIComponent(infoHash)}`, {
+        method: 'DELETE',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ deleteFiles: false }),
+      })
+      if (!res.ok) return await toFailure(res)
+      return await reconcile(clientId)
+    } catch {
+      return NETWORK_FAILURE
+    } finally {
+      markReconciling(clientId, false)
+    }
+  }
+
+  return {
+    clients,
+    encryptionConfigured,
+    loading,
+    saving,
+    loadFailed,
+    reconciliation,
+    reconcilingIds,
+    fetchClients,
+    save,
+    remove,
+    test,
+    testPathMapping,
+    reconcile,
+    adopt,
+    removeOrphan,
+  }
+}
+
+/**
+ * The fulfiller-facing half: names and ids only. Kept separate from `useDownloadClients` because
+ * reading the list does not imply permission to manage the rows, and the requests page must not
+ * 403 its way into an empty client list. Which endpoint serves it depends on whether the viewer
+ * moderates the queue or only fulfils their own.
+ */
+export function useDownloadClientSummaries(canManage: () => boolean) {
+  const basePath = () => fulfilmentBase(canManage())
+  const clients = ref<DownloadClientSummary[]>([])
+  const loadFailed = ref(false)
+
+  async function fetchClients(): Promise<void> {
+    loadFailed.value = false
+    try {
+      const res = await api(`${basePath()}/download-clients`)
+      if (!res.ok) {
+        loadFailed.value = true
+        return
+      }
+      clients.value = (await res.json()) as DownloadClientSummary[]
+    } catch {
+      loadFailed.value = true
+    }
+  }
+
+  return { clients, loadFailed, fetchClients }
+}
diff --git a/client/src/features/book-requests/composables/useFulfilmentPicker.ts b/client/src/features/book-requests/composables/useFulfilmentPicker.ts
new file mode 100644
index 000000000..de56b9075
--- /dev/null
+++ b/client/src/features/book-requests/composables/useFulfilmentPicker.ts
@@ -0,0 +1,142 @@
+import { onScopeDispose, ref } from 'vue'
+import { api } from '@/lib/api'
+import type { BookCard, BookDockFile, BookDockFilesPage, BookQuery, BooksPage } from '@bookorbit/types'
+
+const RESULT_LIMIT = 6
+const DEBOUNCE_MS = 300
+
+export type FulfilmentSource = 'book' | 'dockFile'
+
+export interface FulfilmentChoice {
+  source: FulfilmentSource
+  id: number
+}
+
+/**
+ * Search behind the "close this request" step.
+ *
+ * The endpoint has always taken a `matchedBookId` or a `bookDockFileId`, and the drawer asked the
+ * operator to type them: "Book ID, e.g. 128". Nobody knows those numbers. This turns both into a
+ * search over the thing being named, and the numeric id never reaches the screen.
+ */
+export function useFulfilmentPicker() {
+  const source = ref<FulfilmentSource>('book')
+  const query = ref('')
+  const books = ref<BookCard[]>([])
+  const dockFiles = ref<BookDockFile[]>([])
+  const searching = ref(false)
+  const selected = ref<FulfilmentChoice | null>(null)
+
+  let timer: ReturnType<typeof setTimeout> | null = null
+  let controller: AbortController | null = null
+  let generation = 0
+
+  async function runSearch(term: string, gen: number): Promise<void> {
+    const requestController = new AbortController()
+    controller = requestController
+    searching.value = true
+
+    try {
+      if (source.value === 'book') {
+        const body: BookQuery = { q: term, sort: [{ field: 'title', dir: 'asc' }], pagination: { page: 0, size: RESULT_LIMIT } }
+        const res = await api('/api/v1/books/query', {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify(body),
+          signal: requestController.signal,
+        })
+        if (gen !== generation) return
+        if (!res.ok) throw new Error(`HTTP ${res.status}`)
+        const data = (await res.json()) as BooksPage
+        if (gen !== generation) return
+        books.value = data.items
+      } else {
+        const params = new URLSearchParams({ search: term, page: '1', limit: String(RESULT_LIMIT), sort: 'createdAt', order: 'desc' })
+        const res = await api(`/api/v1/book-dock/files?${params}`, { signal: requestController.signal })
+        if (gen !== generation) return
+        if (!res.ok) throw new Error(`HTTP ${res.status}`)
+        const data = (await res.json()) as BookDockFilesPage
+        if (gen !== generation) return
+        dockFiles.value = data.items
+      }
+    } catch {
+      if (gen !== generation || requestController.signal.aborted) return
+      books.value = []
+      dockFiles.value = []
+    } finally {
+      if (gen === generation) searching.value = false
+    }
+  }
+
+  /** Debounced, because this runs against the whole library and fires on every keystroke. */
+  function search(term: string): void {
+    query.value = term
+    if (timer) clearTimeout(timer)
+    controller?.abort()
+    generation += 1
+    const gen = generation
+
+    const trimmed = term.trim()
+    if (!trimmed) {
+      books.value = []
+      dockFiles.value = []
+      searching.value = false
+      return
+    }
+
+    // Set here rather than in `runSearch`: between the keystroke and the timer firing there are no
+    // results and no search, which the panel reads as "nothing matched" and shows for 300ms on
+    // every single keystroke. The search is pending from the moment there is a term to search for.
+    searching.value = true
+    timer = setTimeout(() => {
+      void runSearch(trimmed, gen)
+    }, DEBOUNCE_MS)
+  }
+
+  // A drawer closed mid-keystroke leaves a timer that fires into a torn-down scope, and its
+  // request outlives the panel that asked for it.
+  onScopeDispose(() => {
+    if (timer) clearTimeout(timer)
+    controller?.abort()
+    generation += 1
+  })
+
+  /** Switching source drops the selection: a book id is not a dock file id and must not survive. */
+  function setSource(next: FulfilmentSource): void {
+    if (source.value === next) return
+    source.value = next
+    selected.value = null
+    books.value = []
+    dockFiles.value = []
+    if (query.value.trim()) search(query.value)
+  }
+
+  function select(choice: FulfilmentChoice): void {
+    selected.value = choice.id === selected.value?.id && choice.source === selected.value?.source ? null : choice
+  }
+
+  function isSelected(choice: FulfilmentChoice): boolean {
+    return selected.value?.source === choice.source && selected.value?.id === choice.id
+  }
+
+  function reset(): void {
+    if (timer) clearTimeout(timer)
+    controller?.abort()
+    generation += 1
+    source.value = 'book'
+    query.value = ''
+    books.value = []
+    dockFiles.value = []
+    selected.value = null
+    searching.value = false
+  }
+
+  /** Exactly the shape the fulfil endpoint takes, so the page never rebuilds it by hand. */
+  function toPayload(): { matchedBookId?: number; bookDockFileId?: number } | null {
+    const choice = selected.value
+    if (!choice) return null
+    return choice.source === 'book' ? { matchedBookId: choice.id } : { bookDockFileId: choice.id }
+  }
+
+  return { source, query, books, dockFiles, searching, selected, search, setSource, select, isSelected, reset, toPayload }
+}
diff --git a/client/src/features/book-requests/composables/useIndexers.ts b/client/src/features/book-requests/composables/useIndexers.ts
new file mode 100644
index 000000000..a56a0d6a5
--- /dev/null
+++ b/client/src/features/book-requests/composables/useIndexers.ts
@@ -0,0 +1,203 @@
+import { ref } from 'vue'
+import { api } from '@/lib/api'
+import type {
+  CreateIndexerPayload,
+  IndexerAdapterDescriptor,
+  IndexerAdapterListResult,
+  IndexerErrorCode,
+  IndexerItem,
+  IndexerListResult,
+  IndexerPluginFailure,
+  IndexerTestResult,
+  PluginInspection,
+  PluginInstallResult,
+  UpdateIndexerPayload,
+} from '@bookorbit/types'
+
+const BASE_PATH = '/api/v1/admin/request-indexers'
+
+/**
+ * A failed call reports a stable code when the server sent one, so the page can say what went
+ * wrong in the reader's own language rather than forwarding an English sentence.
+ */
+export interface IndexerFailure {
+  errorCode: IndexerErrorCode | null
+  message: string | null
+}
+
+const NETWORK_FAILURE: IndexerFailure = { errorCode: null, message: null }
+
+async function toFailure(res: Response): Promise<IndexerFailure> {
+  try {
+    const body = (await res.json()) as { message?: string | string[]; errorCode?: string }
+    const message = Array.isArray(body.message) ? (body.message[0] ?? null) : (body.message ?? null)
+    return { errorCode: (body.errorCode as IndexerErrorCode | undefined) ?? null, message }
+  } catch {
+    return { errorCode: null, message: null }
+  }
+}
+
+export function useIndexers() {
+  const indexers = ref<IndexerItem[]>([])
+  /**
+   * What this install can offer, read at runtime rather than compiled in: an adapter loaded from
+   * the plugin directory is not knowable at build time.
+   */
+  const adapters = ref<IndexerAdapterDescriptor[]>([])
+  /** Plugins that would not load. Shown, because one that silently vanishes cannot be debugged. */
+  const pluginFailures = ref<IndexerPluginFailure[]>([])
+  /** False when `BOOK_REQUEST_ENCRYPTION_KEY` is unset, which is what refuses a saved credential. */
+  const encryptionConfigured = ref(true)
+  const loading = ref(false)
+  const saving = ref(false)
+  const loadFailed = ref(false)
+
+  /**
+   * `silent` refreshes the list without blanking the panel. The loading flag swaps the whole
+   * section for a spinner, which after a test or a save reads as the page reloading and throws
+   * away the reader's scroll position, so it is only for the first load.
+   *
+   * `withAdapters` follows `silent` because which adapters exist is fixed for the life of the
+   * process, so a refresh after testing or saving a row has nothing to learn from asking again.
+   * Installing or removing a plugin is the exception: it changes the adapter list itself, and it
+   * is the one refresh that must not blank the panel it was started from.
+   */
+  async function fetchIndexers({ silent = false, withAdapters = !silent }: { silent?: boolean; withAdapters?: boolean } = {}): Promise<void> {
+    if (!silent) loading.value = true
+    loadFailed.value = false
+    try {
+      const res = await api(BASE_PATH)
+      if (!res.ok) {
+        loadFailed.value = true
+        return
+      }
+      const result = (await res.json()) as IndexerListResult
+      indexers.value = result.indexers
+      encryptionConfigured.value = result.encryptionConfigured
+      if (withAdapters) await fetchAdapters()
+    } catch {
+      loadFailed.value = true
+    } finally {
+      loading.value = false
+    }
+  }
+
+  async function fetchAdapters(): Promise<void> {
+    const res = await api(`${BASE_PATH}/adapters`)
+    if (!res.ok) {
+      loadFailed.value = true
+      return
+    }
+    const result = (await res.json()) as IndexerAdapterListResult
+    adapters.value = result.adapters
+    pluginFailures.value = result.pluginFailures
+  }
+
+  /** Undefined for a row whose adapter this build no longer provides, which the panel says. */
+  function adapterFor(type: string): IndexerAdapterDescriptor | undefined {
+    return adapters.value.find((adapter) => adapter.type === type)
+  }
+
+  async function save(id: number | null, payload: CreateIndexerPayload | UpdateIndexerPayload): Promise<IndexerFailure | null> {
+    saving.value = true
+    try {
+      const res = await api(id === null ? BASE_PATH : `${BASE_PATH}/${id}`, {
+        method: id === null ? 'POST' : 'PUT',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(payload),
+      })
+      if (!res.ok) return await toFailure(res)
+      await fetchIndexers({ silent: true })
+      return null
+    } catch {
+      return NETWORK_FAILURE
+    } finally {
+      saving.value = false
+    }
+  }
+
+  async function remove(id: number): Promise<boolean> {
+    saving.value = true
+    try {
+      const res = await api(`${BASE_PATH}/${id}`, { method: 'DELETE' })
+      if (!res.ok) return false
+      await fetchIndexers({ silent: true })
+      return true
+    } catch {
+      return false
+    } finally {
+      saving.value = false
+    }
+  }
+
+  async function test(id: number): Promise<IndexerTestResult> {
+    try {
+      const res = await api(`${BASE_PATH}/${id}/test`, { method: 'POST' })
+      // A failed test answers 502 carrying its reason, so both outcomes are read the same way.
+      const result: IndexerTestResult = res.ok
+        ? ((await res.json()) as IndexerTestResult)
+        : { success: false, error: (await toFailure(res)).message ?? undefined }
+      // The server stamps the row either way, so the card is refreshed either way: that stamp is
+      // where the reason is kept once this toast is gone.
+      await fetchIndexers({ silent: true })
+      return result
+    } catch {
+      return { success: false }
+    }
+  }
+
+  /**
+   * Reads an uploaded plugin without installing it. The server runs it in a process of its own and
+   * reports only what it declares, so this is a look rather than a commitment.
+   */
+  async function inspectPlugin(file: File): Promise<{ inspection: PluginInspection | null; error: string | null }> {
+    return sendPlugin<PluginInspection>(`${BASE_PATH}/plugins/inspect`, file)
+  }
+
+  /**
+   * The same file again rather than a token for the one just inspected, so the bytes that were
+   * reviewed and the bytes that land are the same by construction.
+   */
+  async function installPlugin(file: File): Promise<{ inspection: PluginInstallResult | null; error: string | null }> {
+    return sendPlugin<PluginInstallResult>(`${BASE_PATH}/plugins`, file)
+  }
+
+  async function sendPlugin<T extends PluginInspection>(url: string, file: File): Promise<{ inspection: T | null; error: string | null }> {
+    const body = new FormData()
+    body.append('file', file)
+    try {
+      const res = await api(url, { method: 'POST', body })
+      if (!res.ok) return { inspection: null, error: (await toFailure(res)).message }
+      return { inspection: (await res.json()) as T, error: null }
+    } catch {
+      return { inspection: null, error: null }
+    }
+  }
+
+  async function removePlugin(type: string): Promise<boolean> {
+    try {
+      const res = await api(`${BASE_PATH}/plugins/${encodeURIComponent(type)}`, { method: 'DELETE' })
+      return res.ok
+    } catch {
+      return false
+    }
+  }
+
+  return {
+    indexers,
+    adapters,
+    pluginFailures,
+    adapterFor,
+    encryptionConfigured,
+    loading,
+    saving,
+    loadFailed,
+    fetchIndexers,
+    save,
+    remove,
+    test,
+    inspectPlugin,
+    installPlugin,
+    removePlugin,
+  }
+}
diff --git a/client/src/features/book-requests/composables/useReleaseFacetGroups.ts b/client/src/features/book-requests/composables/useReleaseFacetGroups.ts
new file mode 100644
index 000000000..8da1fd0af
--- /dev/null
+++ b/client/src/features/book-requests/composables/useReleaseFacetGroups.ts
@@ -0,0 +1,160 @@
+import { computed, type Ref } from 'vue'
+import { useI18n } from 'vue-i18n'
+import type { IndexerColor } from '@bookorbit/types'
+
+import { sourceChipClass } from '../sourceColors'
+import type { ReleaseFilters } from './useReleaseFilters'
+
+export interface FacetOption {
+  id: string
+  label: string
+  count: number | null
+  active: boolean
+  className?: string
+  select: () => void
+}
+
+export interface FacetGroup {
+  key: string
+  label: string
+  options: FacetOption[]
+}
+
+/**
+ * The filter rail as data rather than four near-identical markup blocks, because the rail and the
+ * wrapping bar it becomes below 2xl are the same list rendered twice over.
+ *
+ * A group appears only where it could change the list: one option is a control that can do
+ * nothing but empty the rows it is already showing.
+ */
+export function useReleaseFacetGroups(filters: ReleaseFilters, colorByIndexer: Ref<Map<number, IndexerColor | null>>, allFreeleech: Ref<boolean>) {
+  const { t } = useI18n()
+
+  const facetGroups = computed<FacetGroup[]>(() => {
+    const groups: FacetGroup[] = []
+
+    if (filters.availableSortKeys.value.length > 1) {
+      groups.push({
+        key: 'sort',
+        label: t('bookRequests.releases.sortBy'),
+        options: filters.availableSortKeys.value.map((key) => ({
+          id: `sort-${key}`,
+          label: t(`bookRequests.releases.sort.${key}`),
+          count: null,
+          active: filters.sortKey.value === key,
+          select: () => filters.selectSort(key),
+        })),
+      })
+    }
+
+    if (filters.languageFacets.value.length > 1) {
+      groups.push({
+        key: 'language',
+        label: t('bookRequests.releases.language'),
+        options: filters.languageFacets.value.map((facet) => ({
+          id: `language-${facet.value}`,
+          label: facet.value,
+          count: facet.count,
+          active: filters.language.value === facet.value,
+          select: () => filters.selectLanguage(facet.value),
+        })),
+      })
+    }
+
+    if (filters.formatFacets.value.length > 1) {
+      groups.push({
+        key: 'format',
+        label: t('bookRequests.releases.format'),
+        options: filters.formatFacets.value.map((facet) => ({
+          id: `format-${facet.value}`,
+          label: facet.value,
+          count: facet.count,
+          active: filters.format.value === facet.value,
+          select: () => filters.selectFormat(facet.value),
+        })),
+      })
+    }
+
+    if (filters.fileFacets.value.length > 1) {
+      groups.push({
+        key: 'files',
+        label: t('bookRequests.releases.files'),
+        options: filters.fileFacets.value.map((facet) => ({
+          id: `files-${facet.layout}`,
+          label: t(`bookRequests.releases.fileLayout.${facet.layout}`),
+          count: facet.count,
+          active: filters.fileLayout.value === facet.layout,
+          select: () => filters.selectFileLayout(facet.layout),
+        })),
+      })
+    }
+
+    // Channels and the bitrate floor share one group rather than opening a second: they are the same
+    // question about the same encode, and the rail is what an approver reads before the rows.
+    const audioOptions: FacetOption[] = [
+      ...(filters.channelFacets.value.length > 1
+        ? filters.channelFacets.value.map((facet) => ({
+            id: `audio-${facet.channels}`,
+            label: t(`bookRequests.releases.channels.${facet.channels === 1 ? 'mono' : 'stereo'}`),
+            count: facet.count,
+            active: filters.channels.value === facet.channels,
+            select: () => filters.selectChannels(facet.channels),
+          }))
+        : []),
+      ...filters.bitrateFacets.value.map((facet) => ({
+        id: `bitrate-${facet.step}`,
+        label: t('bookRequests.releases.bitrateAtLeast', { rate: facet.step }),
+        count: facet.count,
+        active: filters.minBitrate.value === facet.step,
+        select: () => filters.selectMinBitrate(facet.step),
+      })),
+    ]
+    if (audioOptions.length > 0) {
+      groups.push({ key: 'audio', label: t('bookRequests.releases.audio'), options: audioOptions })
+    }
+
+    const flagOptions: FacetOption[] = []
+    if (filters.freeleechCount.value > 0 && !allFreeleech.value) {
+      flagOptions.push({
+        id: 'flag-freeleech',
+        label: t('bookRequests.releases.freeleech'),
+        count: filters.freeleechCount.value,
+        active: filters.freeleechOnly.value,
+        select: filters.toggleFreeleech,
+      })
+    }
+    // Only where such a release is actually present. These rows are dead ends for an account that is
+    // not VIP, and offering to hide none of them says nothing.
+    if (filters.vipOnlyCount.value > 0) {
+      flagOptions.push({
+        id: 'flag-vip',
+        label: t('bookRequests.releases.hideVipOnly'),
+        count: filters.vipOnlyCount.value,
+        active: filters.hideVipOnly.value,
+        select: filters.toggleHideVipOnly,
+      })
+    }
+    if (flagOptions.length > 0) {
+      groups.push({ key: 'flags', label: t('bookRequests.releases.flags'), options: flagOptions })
+    }
+
+    if (filters.sourceFacets.value.length > 1) {
+      groups.push({
+        key: 'source',
+        label: t('bookRequests.releases.indexer'),
+        options: filters.sourceFacets.value.map((facet) => ({
+          id: `source-${facet.indexerId}`,
+          label: facet.name,
+          count: facet.count,
+          active: filters.source.value === facet.indexerId,
+          className: sourceChipClass(colorByIndexer.value.get(facet.indexerId)),
+          select: () => filters.selectSource(facet.indexerId),
+        })),
+      })
+    }
+
+    return groups
+  })
+
+  return { facetGroups }
+}
diff --git a/client/src/features/book-requests/composables/useReleaseFilters.ts b/client/src/features/book-requests/composables/useReleaseFilters.ts
new file mode 100644
index 000000000..7d8bb2334
--- /dev/null
+++ b/client/src/features/book-requests/composables/useReleaseFilters.ts
@@ -0,0 +1,298 @@
+import { computed, ref, watch, type Ref } from 'vue'
+import { classifyFileLayout, compareByTier } from '@bookorbit/types'
+import type { ReleaseCandidateItem, ReleaseFileLayout } from '@bookorbit/types'
+
+import { facetsOf, formatKeys, languageKey } from '../releaseFacets'
+
+export const RELEASE_SORT_KEYS = ['score', 'seeders', 'size', 'bitrate', 'added'] as const
+export type ReleaseSortKey = (typeof RELEASE_SORT_KEYS)[number]
+
+/** Which filter a facet count must ignore so a chip never hides its own options. */
+export type ReleaseFilterKey = 'language' | 'format' | 'audio' | 'files' | 'flags' | 'source'
+
+/** The rungs an audiobook encode actually lands on; anything between them separates nothing. */
+const BITRATE_STEPS = [64, 96, 128] as const
+
+/**
+ * Which releases the picker shows, in what order, and what its filter chips may offer.
+ *
+ * Sorting and filtering stay client-side. The list is already capped and in hand, and a round
+ * trip would re-run the search against every tracker, spending rate limit to reorder rows.
+ */
+export function useReleaseFilters(releases: Ref<ReleaseCandidateItem[]>) {
+  const sortKey = ref<ReleaseSortKey>('score')
+  const language = ref<string | null>(null)
+  const format = ref<string | null>(null)
+  const channels = ref<number | null>(null)
+  const fileLayout = ref<ReleaseFileLayout | null>(null)
+  /** A floor rather than a band: an approver wants "this good or better", never "exactly this". */
+  const minBitrate = ref(0)
+  const freeleechOnly = ref(false)
+  const hideVipOnly = ref(false)
+  const source = ref<number | null>(null)
+
+  function passesLanguage(release: ReleaseCandidateItem): boolean {
+    return language.value === null || languageKey(release.language) === language.value
+  }
+
+  function passesFormat(release: ReleaseCandidateItem): boolean {
+    return format.value === null || formatKeys(release).includes(format.value)
+  }
+
+  function passesChannels(release: ReleaseCandidateItem): boolean {
+    return channels.value === null || release.audio?.channels === channels.value
+  }
+
+  /** A release whose source states no count is neither layout, so it fails either choice. */
+  function passesFiles(release: ReleaseCandidateItem): boolean {
+    return fileLayout.value === null || classifyFileLayout(release.fileCount) === fileLayout.value
+  }
+
+  function passesBitrate(release: ReleaseCandidateItem): boolean {
+    if (minBitrate.value === 0) return true
+    return (release.audio?.bitrateKbps ?? -1) >= minBitrate.value
+  }
+
+  function passesFlags(release: ReleaseCandidateItem): boolean {
+    if (freeleechOnly.value && !release.freeleech) return false
+    return !(hideVipOnly.value && release.vipOnly)
+  }
+
+  function passesSource(release: ReleaseCandidateItem): boolean {
+    return source.value === null || release.indexerId === source.value
+  }
+
+  /**
+   * Every filter except the one being counted, so a chip never offers a combination with no rows and
+   * counting a facet never hides its own options. One predicate rather than the seven near-identical
+   * filter chains the four-facet version had already grown to.
+   */
+  function passesAllExcept(release: ReleaseCandidateItem, except?: ReleaseFilterKey): boolean {
+    if (except !== 'language' && !passesLanguage(release)) return false
+    if (except !== 'format' && !passesFormat(release)) return false
+    if (except !== 'audio' && !passesChannels(release)) return false
+    if (except !== 'audio' && !passesBitrate(release)) return false
+    if (except !== 'files' && !passesFiles(release)) return false
+    if (except !== 'flags' && !passesFlags(release)) return false
+    if (except !== 'source' && !passesSource(release)) return false
+    return true
+  }
+
+  /** A release that states nothing on the sorted axis sorts last rather than as a zero. */
+  function orderOf(release: ReleaseCandidateItem): number {
+    switch (sortKey.value) {
+      case 'seeders':
+        return release.seeders ?? -1
+      case 'size':
+        return release.sizeBytes ?? -1
+      case 'bitrate':
+        return release.audio?.bitrateKbps ?? -1
+      case 'added':
+        return release.publishedAt ? Date.parse(release.publishedAt) : -1
+      default:
+        return release.score
+    }
+  }
+
+  const visibleReleases = computed(() =>
+    releases.value
+      .filter((release) => passesAllExcept(release))
+      // Safe to sort in place: filter already returned a fresh array. Tier leads every ordering,
+      // including the explicit ones: an approver who sorts by size is asking to reorder within what
+      // they said they wanted, not to be shown a release the profile ranked below it. Score keeps
+      // the server's tie-break on seeders, and the others fall back to score so equal sizes or dates
+      // do not reorder themselves between renders.
+      .sort((a, b) => compareByTier(a.tier, b.tier) || orderOf(b) - orderOf(a) || b.score - a.score || (b.seeders ?? -1) - (a.seeders ?? -1)),
+  )
+
+  const hasFilter = computed(
+    () =>
+      language.value !== null ||
+      format.value !== null ||
+      channels.value !== null ||
+      fileLayout.value !== null ||
+      minBitrate.value > 0 ||
+      freeleechOnly.value ||
+      hideVipOnly.value ||
+      source.value !== null,
+  )
+  const showFacets = computed(() => releases.value.length > 1)
+
+  /**
+   * The first row is only the best match while the list is still in score order and unfiltered.
+   * Sorted by size or filtered down, row one is whatever that ordering put there, and calling it
+   * the best match would be a claim the score never made.
+   */
+  const marksBest = computed(() => sortKey.value === 'score' && !hasFilter.value && visibleReleases.value.length > 0)
+
+  /**
+   * Hoisting one release out of a tie picks a winner the score did not. Saying how many others
+   * matched it keeps that honest, because the scorer weighs neither size nor edition.
+   */
+  const tiedWithBest = computed(() => {
+    const best = visibleReleases.value[0]
+    if (!best) return 0
+    return visibleReleases.value.filter((release) => release.score === best.score).length - 1
+  })
+
+  /** Stated by at least one release, so a row that omits it is saying something by omitting it. */
+  const anySeeders = computed(() => releases.value.some((release) => release.seeders !== null))
+
+  /**
+   * An axis nothing varies on sorts nothing. Project Gutenberg publishes no swarm and no audio, so
+   * offering "seeders" and "bitrate" there is three controls that cannot change the order.
+   */
+  const availableSortKeys = computed<ReleaseSortKey[]>(() =>
+    RELEASE_SORT_KEYS.filter((key) => {
+      switch (key) {
+        case 'seeders':
+          return anySeeders.value
+        case 'size':
+          return releases.value.some((release) => release.sizeBytes !== null)
+        case 'bitrate':
+          return releases.value.some((release) => release.audio?.bitrateKbps != null)
+        case 'added':
+          return releases.value.some((release) => release.publishedAt !== null)
+        default:
+          return true
+      }
+    }),
+  )
+
+  /** A refetch can drop the axis being sorted on; leaving it selected shows no active control. */
+  watch(availableSortKeys, (keys) => {
+    if (keys.length > 0 && !keys.includes(sortKey.value)) sortKey.value = 'score'
+  })
+
+  function candidatesFor(except: ReleaseFilterKey): ReleaseCandidateItem[] {
+    return releases.value.filter((release) => passesAllExcept(release, except))
+  }
+
+  const languageFacets = computed(() => facetsOf(candidatesFor('language'), (release) => languageKey(release.language)))
+  const formatFacets = computed(() => facetsOf(candidatesFor('format'), formatKeys))
+  const channelFacets = computed(() =>
+    facetsOf(candidatesFor('audio'), (release) => (release.audio?.channels ? String(release.audio.channels) : null)).map((facet) => ({
+      ...facet,
+      channels: Number(facet.value),
+    })),
+  )
+  const fileFacets = computed(() =>
+    facetsOf(candidatesFor('files'), (release) => classifyFileLayout(release.fileCount)).map((facet) => ({
+      ...facet,
+      layout: facet.value as ReleaseFileLayout,
+    })),
+  )
+  /**
+   * Only the steps some release could actually satisfy. A fixed ladder would offer "128k or better"
+   * on a list whose best encode is 64k, which is a control that can only ever empty the list.
+   */
+  const bitrateFacets = computed(() => {
+    const candidates = candidatesFor('audio')
+    return BITRATE_STEPS.map((step) => ({
+      step,
+      count: candidates.filter((release) => (release.audio?.bitrateKbps ?? -1) >= step).length,
+    })).filter((facet) => facet.count > 0 && facet.count < candidates.length)
+  })
+  const freeleechCount = computed(() => candidatesFor('flags').filter((release) => release.freeleech).length)
+  const vipOnlyCount = computed(() => candidatesFor('flags').filter((release) => release.vipOnly).length)
+  const sourceFacets = computed(() =>
+    facetsOf(candidatesFor('source'), (release) => String(release.indexerId)).map((facet) => ({
+      ...facet,
+      indexerId: Number(facet.value),
+      name: releases.value.find((release) => release.indexerId === Number(facet.value))?.indexerName ?? facet.value,
+    })),
+  )
+
+  function selectSort(key: ReleaseSortKey) {
+    sortKey.value = key
+  }
+
+  function selectLanguage(value: string) {
+    language.value = language.value === value ? null : value
+  }
+
+  function selectFormat(value: string) {
+    format.value = format.value === value ? null : value
+  }
+
+  function selectChannels(value: number) {
+    channels.value = channels.value === value ? null : value
+  }
+
+  function selectFileLayout(value: ReleaseFileLayout) {
+    fileLayout.value = fileLayout.value === value ? null : value
+  }
+
+  function selectMinBitrate(value: number) {
+    minBitrate.value = minBitrate.value === value ? 0 : value
+  }
+
+  function selectSource(value: number) {
+    source.value = source.value === value ? null : value
+  }
+
+  function toggleFreeleech() {
+    freeleechOnly.value = !freeleechOnly.value
+  }
+
+  function toggleHideVipOnly() {
+    hideVipOnly.value = !hideVipOnly.value
+  }
+
+  function clearFilters() {
+    language.value = null
+    format.value = null
+    channels.value = null
+    fileLayout.value = null
+    minBitrate.value = 0
+    freeleechOnly.value = false
+    hideVipOnly.value = false
+    source.value = null
+  }
+
+  /** Everything a new request resets, which is the ordering as well as the chips. */
+  function resetFilters() {
+    sortKey.value = 'score'
+    clearFilters()
+  }
+
+  return {
+    sortKey,
+    language,
+    format,
+    channels,
+    fileLayout,
+    minBitrate,
+    freeleechOnly,
+    hideVipOnly,
+    source,
+    visibleReleases,
+    hasFilter,
+    showFacets,
+    marksBest,
+    tiedWithBest,
+    anySeeders,
+    availableSortKeys,
+    languageFacets,
+    formatFacets,
+    channelFacets,
+    fileFacets,
+    bitrateFacets,
+    freeleechCount,
+    vipOnlyCount,
+    sourceFacets,
+    selectSort,
+    selectLanguage,
+    selectFormat,
+    selectChannels,
+    selectFileLayout,
+    selectMinBitrate,
+    selectSource,
+    toggleFreeleech,
+    toggleHideVipOnly,
+    clearFilters,
+    resetFilters,
+  }
+}
+
+export type ReleaseFilters = ReturnType<typeof useReleaseFilters>
diff --git a/client/src/features/book-requests/composables/useReleaseGrab.ts b/client/src/features/book-requests/composables/useReleaseGrab.ts
new file mode 100644
index 000000000..d47a9cae0
--- /dev/null
+++ b/client/src/features/book-requests/composables/useReleaseGrab.ts
@@ -0,0 +1,150 @@
+import { ref, type Ref } from 'vue'
+import { useI18n } from 'vue-i18n'
+import { useRoute, useRouter } from 'vue-router'
+import { toast } from 'vue-sonner'
+import { findGrabRefusal, releaseInspectionBlocksGrab } from '@bookorbit/types'
+import type {
+  BookRequestItem,
+  GrabBookRequestPayload,
+  GrabFailureCode,
+  GrabRefusal,
+  ReleaseCandidateItem,
+  ReleaseFileInspection,
+} from '@bookorbit/types'
+
+/** Only the refusals that rule another release out get a note; the rest are about one row. */
+const REFUSAL_KEYS: Partial<Record<GrabFailureCode, string>> = {
+  GRAB_SOURCE_REFUSED: 'sourceRefused',
+  GRAB_SOURCE_UNAVAILABLE: 'sourceUnavailable',
+  GRAB_VIP_REQUIRED: 'vipRequired',
+  GRAB_CLIENT_REFUSED: 'clientRefused',
+  GRAB_CLIENT_UNAVAILABLE: 'clientUnavailable',
+}
+
+/** The refusal travels back with the call it belongs to, so one grab cannot describe another. */
+export interface ReleaseGrabOutcome {
+  item: BookRequestItem | null
+  reason: string | null
+  errorCode: GrabFailureCode | null
+}
+
+export interface ReleaseGrabOptions {
+  request: Ref<BookRequestItem | null>
+  requestId: Ref<number>
+  grab: (id: number, body: GrabBookRequestPayload) => Promise<ReleaseGrabOutcome>
+  setRequest: (value: BookRequestItem) => void
+  inspectRelease: (requestId: number, release: ReleaseCandidateItem) => Promise<ReleaseFileInspection | null>
+  /** Opens a row's file list, which is where a blocked inspection explains itself. */
+  setFilesExpanded: (release: ReleaseCandidateItem, expanded: boolean) => void
+  /** Whether this release's source joins a swarm, which decides if a client refusal generalises. */
+  seedsBack: (release: ReleaseCandidateItem) => boolean
+}
+
+/**
+ * Sending a release, and remembering what this visit was already told.
+ *
+ * A tracker that refuses one release refuses the rest of its list the same way, and clicking down
+ * a source's rows to collect the same 406 four times is the part worth taking off the approver.
+ */
+export function useReleaseGrab(options: ReleaseGrabOptions) {
+  const { t } = useI18n()
+  const route = useRoute()
+  const router = useRouter()
+  const { request, requestId, grab, setRequest, inspectRelease, setFilesExpanded, seedsBack } = options
+
+  const manualOpen = ref(false)
+  const refusals = ref<GrabRefusal[]>([])
+  /**
+   * One release at a time, from the click rather than from the request.
+   *
+   * Inspecting a release is a tracker round trip of up to twenty-five seconds, and only the
+   * inspecting row was disabled for it: a second Send during that window started its own
+   * inspection and went on to its own grab, and `submitGrab` re-checks nothing. Two releases were
+   * sent for one request. The request's own busy flag is no help, because neither grab has been
+   * called yet while the inspections run.
+   */
+  const grabbing = ref(false)
+
+  function openManual() {
+    manualOpen.value = true
+  }
+
+  function closeManual() {
+    manualOpen.value = false
+  }
+
+  /** A fresh search is also how an approver retries a source that was merely slow. */
+  function forgetRefusals() {
+    refusals.value = []
+  }
+
+  /** A sent release leaves nothing to pick, so the drawer pops back to the request it belongs to. */
+  async function sendGrab(body: GrabBookRequestPayload) {
+    if (!request.value) return
+    const outcome = await grab(request.value.id, body)
+    if (!outcome.item) {
+      rememberRefusal(body, outcome.errorCode)
+      toast.error(t('bookRequests.errors.grabFailed'), outcome.reason ? { description: outcome.reason } : undefined)
+      return
+    }
+    setRequest(outcome.item)
+    manualOpen.value = false
+    toast.success(t('bookRequests.toasts.grabbed'))
+    void router.push({ name: 'book-request-detail', params: { id: request.value.id }, query: route.query })
+  }
+
+  async function submitGrab(body: GrabBookRequestPayload) {
+    if (grabbing.value) return
+    grabbing.value = true
+    try {
+      await sendGrab(body)
+    } finally {
+      grabbing.value = false
+    }
+  }
+
+  /**
+   * Held from the click rather than from the send: the inspection in between is the window a
+   * second click used to slip through.
+   */
+  async function handleGrab(release: ReleaseCandidateItem): Promise<void> {
+    if (grabbing.value) return
+    grabbing.value = true
+    try {
+      const inspection = await inspectRelease(requestId.value, release)
+      if (!inspection || releaseInspectionBlocksGrab(inspection.status)) {
+        setFilesExpanded(release, true)
+        return
+      }
+      await sendGrab({ indexerId: release.indexerId, releaseGuid: release.guid })
+    } finally {
+      grabbing.value = false
+    }
+  }
+
+  function handleManualGrab(payload: { request: BookRequestItem; body: GrabBookRequestPayload }) {
+    void submitGrab(payload.body)
+  }
+
+  /** Only a refusal the server classified; anything else says nothing about the other releases. */
+  function rememberRefusal(body: GrabBookRequestPayload, code: GrabFailureCode | null) {
+    if (!code) return
+    refusals.value = [...refusals.value, { indexerId: body.indexerId ?? null, code }]
+  }
+
+  function refusalFor(release: ReleaseCandidateItem): GrabRefusal | null {
+    return findGrabRefusal({ indexerId: release.indexerId, vipOnly: release.vipOnly, seedsBack: seedsBack(release) }, refusals.value)
+  }
+
+  function isRefused(release: ReleaseCandidateItem): boolean {
+    return refusalFor(release) !== null
+  }
+
+  function refusalText(release: ReleaseCandidateItem): string | null {
+    const refusal = refusalFor(release)
+    const key = refusal ? REFUSAL_KEYS[refusal.code] : undefined
+    return key ? t(`bookRequests.releases.refused.${key}`) : null
+  }
+
+  return { manualOpen, grabbing, refusals, openManual, closeManual, forgetRefusals, submitGrab, handleGrab, handleManualGrab, isRefused, refusalText }
+}
diff --git a/client/src/features/book-requests/composables/useReleasePicker.ts b/client/src/features/book-requests/composables/useReleasePicker.ts
new file mode 100644
index 000000000..38536d59e
--- /dev/null
+++ b/client/src/features/book-requests/composables/useReleasePicker.ts
@@ -0,0 +1,234 @@
+import { ref } from 'vue'
+import { api } from '@/lib/api'
+import { fulfilmentBase } from '../fulfilmentBase'
+import type {
+  IndexerSearchStatus,
+  InspectBookRequestReleasePayload,
+  ReleaseCandidateItem,
+  ReleaseFileInspection,
+  ReleaseSearchCriteria,
+  ReleaseSearchOverrides,
+  ReleaseSearchResult,
+} from '@bookorbit/types'
+
+/** A title and author search has no ISBN to key an attempt by, so it gets a reserved name. */
+export const TITLE_AUTHOR_SEARCH_KEY = 'titleAuthor'
+
+/** The key one search ran under, which is the ISBN it used or the title and author fallback. */
+export function searchAttemptKey(activeIsbn: string | null): string {
+  return activeIsbn ?? TITLE_AUTHOR_SEARCH_KEY
+}
+
+/**
+ * The ranked cross-indexer release list for one request. The server does the searching, scoring
+ * and caching; this only asks, and asks again with `refresh` when the approver wants a fresh hit
+ * on the trackers rather than the cached list.
+ */
+export function useReleasePicker(canManage: () => boolean) {
+  const basePath = () => fulfilmentBase(canManage())
+  const releases = ref<ReleaseCandidateItem[]>([])
+  const indexers = ref<IndexerSearchStatus[]>([])
+  const criteria = ref<ReleaseSearchCriteria | null>(null)
+  /** Enabled indexers that do not carry this medium and were never searched. Not failures. */
+  const uncoveredIndexerCount = ref(0)
+  /**
+   * What the instance had to search with. Zero enabled means nothing was searched at all, which
+   * the picker cannot work out any other way: the indexer list is admin-only, and an approver who
+   * cannot open settings is exactly who ends up staring at an empty list.
+   */
+  const enabledIndexerCount = ref(0)
+  const configuredIndexerCount = ref(0)
+  const profileActive = ref(false)
+  const cached = ref(false)
+  const loading = ref(false)
+  const loadFailed = ref(false)
+  const searched = ref(false)
+  /**
+   * What this visit has already searched, keyed by `searchAttemptKey` and valued by how many
+   * releases came back. Every alternate ISBN on a request usually carries the same provider label,
+   * so without this the keys the approver has already spent are indistinguishable from the ones
+   * they have not. Local to the picker and dropped on reset; nothing about it is worth persisting.
+   */
+  const attempts = ref(new Map<string, number>())
+  const inspections = ref(new Map<string, ReleaseFileInspection>())
+  const inspecting = ref(new Set<string>())
+  /**
+   * Keyed by release, valued by what the tracker said. A refusal is usually a sentence worth
+   * repeating verbatim - "VIP torrent and you are not VIP or higher" tells an approver exactly
+   * what to do next, where "could not read the file list" tells them nothing.
+   */
+  const inspectionFailed = ref(new Map<string, string | null>())
+  const pendingInspections = new Map<string, Promise<ReleaseFileInspection | null>>()
+  let inspectionGeneration = 0
+  /**
+   * Bumped per search so an answer to an earlier one cannot land on a later one. A tracker search
+   * can take the better part of a minute, which is long enough for the approver to step to another
+   * request or to search again with different terms before the first one comes back.
+   */
+  let searchGeneration = 0
+
+  async function fetchReleases(requestId: number, options: { refresh?: boolean; overrides?: ReleaseSearchOverrides } = {}): Promise<boolean> {
+    const generation = ++searchGeneration
+    loading.value = true
+    loadFailed.value = false
+    clearInspections()
+    try {
+      const custom = options.overrides !== undefined
+      const url = `${basePath()}/${requestId}/releases${custom ? '/search' : options.refresh ? '?refresh=true' : ''}`
+      const res = custom
+        ? await api(url, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(options.overrides),
+          })
+        : await api(url)
+      if (generation !== searchGeneration) return false
+      if (!res.ok) {
+        loadFailed.value = true
+        return false
+      }
+      const result = (await res.json()) as ReleaseSearchResult
+      if (generation !== searchGeneration) return false
+      releases.value = result.releases
+      criteria.value = result.criteria
+      indexers.value = result.indexers
+      uncoveredIndexerCount.value = result.uncoveredIndexerCount
+      enabledIndexerCount.value = result.enabledIndexerCount
+      configuredIndexerCount.value = result.configuredIndexerCount
+      profileActive.value = result.profileActive
+      cached.value = result.cached
+      searched.value = true
+      attempts.value = new Map(attempts.value).set(searchAttemptKey(result.criteria.activeIsbn), result.releases.length)
+      return true
+    } catch {
+      if (generation === searchGeneration) loadFailed.value = true
+      return false
+    } finally {
+      // A newer search owns the spinner from here, so an older one must not put it away.
+      if (generation === searchGeneration) loading.value = false
+    }
+  }
+
+  async function inspectRelease(requestId: number, release: ReleaseCandidateItem): Promise<ReleaseFileInspection | null> {
+    const key = releaseKey(release)
+    const existing = inspections.value.get(key)
+    if (existing) return existing
+    const pending = pendingInspections.get(key)
+    if (pending) return pending
+
+    const generation = inspectionGeneration
+    setMembership(inspecting, key, true)
+    clearFailure(inspectionFailed, key)
+    const operation = performInspection(requestId, release, key, generation)
+    pendingInspections.set(key, operation)
+    void operation.finally(() => {
+      if (pendingInspections.get(key) !== operation) return
+      pendingInspections.delete(key)
+      setMembership(inspecting, key, false)
+    })
+    return operation
+  }
+
+  async function performInspection(
+    requestId: number,
+    release: ReleaseCandidateItem,
+    key: string,
+    generation: number,
+  ): Promise<ReleaseFileInspection | null> {
+    try {
+      const res = await api(`${basePath()}/${requestId}/releases/inspect`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ indexerId: release.indexerId, releaseGuid: release.guid } satisfies InspectBookRequestReleasePayload),
+      })
+      if (generation !== inspectionGeneration) return null
+      if (!res.ok) {
+        recordFailure(inspectionFailed, key, await readErrorMessage(res))
+        return null
+      }
+      const result = (await res.json()) as ReleaseFileInspection
+      inspections.value = new Map(inspections.value).set(key, result)
+      return result
+    } catch {
+      // A transport failure has no server sentence to pass on, so the generic copy stands.
+      if (generation === inspectionGeneration) recordFailure(inspectionFailed, key, null)
+      return null
+    }
+  }
+
+  function reset(): void {
+    searchGeneration++
+    releases.value = []
+    criteria.value = null
+    indexers.value = []
+    uncoveredIndexerCount.value = 0
+    enabledIndexerCount.value = 0
+    configuredIndexerCount.value = 0
+    profileActive.value = false
+    cached.value = false
+    loadFailed.value = false
+    searched.value = false
+    attempts.value = new Map()
+    clearInspections()
+  }
+
+  function clearInspections(): void {
+    inspectionGeneration++
+    inspections.value = new Map()
+    inspecting.value = new Set()
+    inspectionFailed.value = new Map()
+    pendingInspections.clear()
+  }
+
+  return {
+    releases,
+    criteria,
+    indexers,
+    uncoveredIndexerCount,
+    enabledIndexerCount,
+    configuredIndexerCount,
+    profileActive,
+    cached,
+    loading,
+    loadFailed,
+    searched,
+    attempts,
+    inspections,
+    inspecting,
+    inspectionFailed,
+    fetchReleases,
+    inspectRelease,
+    reset,
+  }
+}
+
+function releaseKey(release: ReleaseCandidateItem): string {
+  return `${release.indexerId}:${release.guid}`
+}
+
+function recordFailure(target: { value: Map<string, string | null> }, key: string, reason: string | null): void {
+  const next = new Map(target.value)
+  next.set(key, reason)
+  target.value = next
+}
+
+function clearFailure(target: { value: Map<string, string | null> }, key: string): void {
+  if (!target.value.has(key)) return
+  const next = new Map(target.value)
+  next.delete(key)
+  target.value = next
+}
+
+/** Nest puts the reason in `message`, as a string or as a list of validation failures. */
+async function readErrorMessage(res: Response): Promise<string | null> {
+  const payload = (await res.json().catch(() => null)) as { message?: string | string[] } | null
+  const message = Array.isArray(payload?.message) ? payload.message.join('. ') : payload?.message
+  return message?.trim() ? message.trim() : null
+}
+
+function setMembership(target: { value: Set<string> }, key: string, present: boolean): void {
+  const next = new Set(target.value)
+  if (present) next.add(key)
+  else next.delete(key)
+  target.value = next
+}
diff --git a/client/src/features/book-requests/composables/useReleaseSearchEditor.ts b/client/src/features/book-requests/composables/useReleaseSearchEditor.ts
new file mode 100644
index 000000000..dc85a80d4
--- /dev/null
+++ b/client/src/features/book-requests/composables/useReleaseSearchEditor.ts
@@ -0,0 +1,248 @@
+import { computed, ref, watch, type Ref } from 'vue'
+import { useI18n } from 'vue-i18n'
+import { canonicalizeBookRequestIsbn, MAX_BOOK_REQUEST_SEARCH_ISBNS, normalizeBookRequestIsbn } from '@bookorbit/types'
+import type { BookRequestItem, ReleaseSearchCriteria, ReleaseSearchOverrides } from '@bookorbit/types'
+
+import { searchAttemptKey, TITLE_AUTHOR_SEARCH_KEY } from './useReleasePicker'
+
+/** What the server will accept, checked here so a typo comes back as a field error, not a 400. */
+const MAX_SEARCH_AUTHORS = 50
+const MAX_SEARCH_AUTHOR_LENGTH = 255
+const MAX_SEARCH_FORMATS = 20
+const MAX_SEARCH_FORMAT_LENGTH = 20
+
+export interface ReleaseSearchEditorOptions {
+  request: Ref<BookRequestItem | null>
+  criteria: Ref<ReleaseSearchCriteria | null>
+  /** How many releases each key this visit has already spent came back with. */
+  attempts: Ref<Map<string, number>>
+  requestId: Ref<number>
+  fetchReleases: (id: number, options?: { overrides?: ReleaseSearchOverrides }) => Promise<boolean>
+  /** Run before every search this editor starts, for the row state a new list invalidates. */
+  beforeSearch: () => void
+}
+
+/**
+ * The key a release search runs under, and the form for changing it.
+ *
+ * Two things rather than one: the ISBN chips re-run the same criteria under a different key, while
+ * the form edits the criteria themselves. Both end in `fetchReleases`, and both have to say what a
+ * key already returned, so the panel does not offer the approver a key it has already spent.
+ */
+export function useReleaseSearchEditor(options: ReleaseSearchEditorOptions) {
+  const { t } = useI18n()
+  const { request, criteria, attempts, requestId, fetchReleases, beforeSearch } = options
+
+  const searchEditing = ref(false)
+  const originalCriteria = ref<ReleaseSearchCriteria | null>(null)
+  const searchTitle = ref('')
+  const searchAuthors = ref('')
+  const searchIsbnOptions = ref<string[]>([])
+  const selectedSearchIsbn = ref<string | null>(null)
+  const customSearchIsbn = ref('')
+  const searchLanguage = ref('')
+  const searchFormats = ref('')
+  const searchEditError = ref<string | null>(null)
+
+  const alternativeIsbns = computed(() => criteria.value?.isbns.filter((isbn) => isbn !== criteria.value?.activeIsbn) ?? [])
+  const titleAuthorAttempt = computed(() => attemptLabel(attempts.value.get(TITLE_AUTHOR_SEARCH_KEY)))
+  /** The one key this search ran under, which is what the panel states above the source list. */
+  const activeKeyText = computed(() => (criteria.value ? (criteria.value.activeIsbn ?? titleAuthorKey(criteria.value)) : ''))
+
+  watch(request, (value) => {
+    if (value && originalCriteria.value === null) originalCriteria.value = requestSearchCriteria(value)
+  })
+
+  /** Not any one indexer's string: the key itself, which is what the approver chose to search. */
+  function titleAuthorKey(value: ReleaseSearchCriteria): string {
+    return [value.title, value.authors[0]].filter(Boolean).join(', ')
+  }
+
+  function requestSearchCriteria(value: BookRequestItem): ReleaseSearchCriteria {
+    const isbns = [
+      canonicalizeBookRequestIsbn(value.isbn10, value.isbn13),
+      ...value.metadataSources.map((source) => canonicalizeBookRequestIsbn(source.isbn10, source.isbn13)),
+    ].filter((isbn): isbn is string => isbn !== null)
+    return {
+      title: value.title,
+      authors: [...value.authors],
+      isbn10: value.isbn10,
+      isbn13: value.isbn13,
+      activeIsbn: isbns[0] ?? null,
+      isbns: [...new Set(isbns)].slice(0, MAX_BOOK_REQUEST_SEARCH_ISBNS),
+      mediaKind: value.mediaKind,
+      language: value.language,
+      preferredFormats: [...value.preferredFormats],
+    }
+  }
+
+  function criteriaOverrides(value: ReleaseSearchCriteria): ReleaseSearchOverrides {
+    return {
+      title: value.title,
+      authors: [...value.authors],
+      isbn: value.activeIsbn,
+      language: value.language,
+      preferredFormats: [...value.preferredFormats],
+    }
+  }
+
+  function loadSearchEditor(value: ReleaseSearchCriteria): void {
+    searchTitle.value = value.title
+    searchAuthors.value = value.authors.join('\n')
+    searchIsbnOptions.value = [...value.isbns]
+    selectedSearchIsbn.value = value.activeIsbn
+    customSearchIsbn.value = ''
+    searchLanguage.value = value.language ?? ''
+    searchFormats.value = value.preferredFormats.join(', ')
+    searchEditError.value = null
+  }
+
+  function toggleSearchEditor(): void {
+    searchEditing.value = !searchEditing.value
+    if (searchEditing.value && criteria.value) loadSearchEditor(criteria.value)
+  }
+
+  function resetSearchEditor(): void {
+    if (originalCriteria.value) loadSearchEditor(originalCriteria.value)
+  }
+
+  function selectSearchIsbn(isbn: string): void {
+    selectedSearchIsbn.value = isbn
+  }
+
+  function selectTitleAuthorSearch(): void {
+    selectedSearchIsbn.value = null
+  }
+
+  function canonicalizeTypedIsbn(value: string): string | null {
+    const normalized = normalizeBookRequestIsbn(value)
+    if (normalized?.length === 10) return canonicalizeBookRequestIsbn(normalized, null)
+    return canonicalizeBookRequestIsbn(null, normalized)
+  }
+
+  function consumeCustomSearchIsbn(): boolean {
+    const raw = customSearchIsbn.value.trim()
+    if (!raw) return true
+    const canonical = canonicalizeTypedIsbn(raw)
+    if (!canonical) {
+      searchEditError.value = t('bookRequests.releases.criteria.invalidIsbn', { isbn: raw })
+      return false
+    }
+    if (!searchIsbnOptions.value.includes(canonical)) searchIsbnOptions.value = [...searchIsbnOptions.value, canonical]
+    selectedSearchIsbn.value = canonical
+    customSearchIsbn.value = ''
+    searchEditError.value = null
+    return true
+  }
+
+  function addCustomSearchIsbn(): void {
+    consumeCustomSearchIsbn()
+  }
+
+  async function handleCustomSearchSubmit(event: Event): Promise<void> {
+    event.preventDefault()
+    const title = searchTitle.value.trim()
+    if (!title) {
+      searchEditError.value = t('bookRequests.releases.criteria.titleRequired')
+      return
+    }
+    if (!consumeCustomSearchIsbn()) return
+
+    const authors = searchAuthors.value
+      .split('\n')
+      .map((author) => author.trim())
+      .filter(Boolean)
+    const preferredFormats = searchFormats.value
+      .split(/[\n,]/)
+      .map((format) => format.trim())
+      .filter(Boolean)
+    if (authors.length > MAX_SEARCH_AUTHORS || authors.some((author) => author.length > MAX_SEARCH_AUTHOR_LENGTH)) {
+      searchEditError.value = t('bookRequests.releases.criteria.authorsInvalid')
+      return
+    }
+    if (preferredFormats.length > MAX_SEARCH_FORMATS || preferredFormats.some((format) => format.length > MAX_SEARCH_FORMAT_LENGTH)) {
+      searchEditError.value = t('bookRequests.releases.criteria.formatsInvalid')
+      return
+    }
+
+    const overrides: ReleaseSearchOverrides = {
+      title,
+      authors,
+      isbn: selectedSearchIsbn.value,
+      language: searchLanguage.value.trim() || null,
+      preferredFormats,
+    }
+
+    beforeSearch()
+    if (await fetchReleases(requestId.value, { overrides })) searchEditing.value = false
+  }
+
+  /**
+   * What this visit already learned about a key. Every alternate ISBN on a request tends to carry
+   * the same provider label - four "Google Books" chips separate nothing - so once a key has been
+   * spent, what it returned is the only thing that tells the approver which one to try next.
+   */
+  function attemptLabel(count: number | undefined): string | null {
+    if (count === undefined) return null
+    return count === 0 ? t('bookRequests.releases.criteria.keyTried') : t('bookRequests.releases.criteria.keyTriedCount', { count })
+  }
+
+  function isbnKeyLabel(isbn: string): string {
+    return attemptLabel(attempts.value.get(searchAttemptKey(isbn))) ?? isbnSourceText(isbn)
+  }
+
+  function isbnSourceText(isbn: string): string {
+    const labels = request.value?.metadataSources
+      .filter((source) => canonicalizeBookRequestIsbn(source.isbn10, source.isbn13) === isbn)
+      .map((source) => source.providerLabel)
+      .filter((label, index, values) => values.indexOf(label) === index)
+    return labels?.length ? labels.join(', ') : t('bookRequests.releases.criteria.customIsbnSource')
+  }
+
+  async function runAlternativeIsbnSearch(isbn: string): Promise<void> {
+    if (!criteria.value) return
+    beforeSearch()
+    await fetchReleases(requestId.value, { overrides: { ...criteriaOverrides(criteria.value), isbn } })
+  }
+
+  async function runTitleAuthorSearch(): Promise<void> {
+    if (!criteria.value) return
+    beforeSearch()
+    await fetchReleases(requestId.value, { overrides: { ...criteriaOverrides(criteria.value), isbn: null } })
+  }
+
+  /** A new request in the same drawer has its own criteria, so nothing here carries over. */
+  function resetSearchEditorState(): void {
+    originalCriteria.value = null
+    searchEditing.value = false
+  }
+
+  return {
+    searchEditing,
+    originalCriteria,
+    searchTitle,
+    searchAuthors,
+    searchIsbnOptions,
+    selectedSearchIsbn,
+    customSearchIsbn,
+    searchLanguage,
+    searchFormats,
+    searchEditError,
+    alternativeIsbns,
+    titleAuthorAttempt,
+    activeKeyText,
+    criteriaOverrides,
+    canonicalizeTypedIsbn,
+    toggleSearchEditor,
+    resetSearchEditor,
+    selectSearchIsbn,
+    selectTitleAuthorSearch,
+    addCustomSearchIsbn,
+    handleCustomSearchSubmit,
+    isbnKeyLabel,
+    isbnSourceText,
+    runAlternativeIsbnSearch,
+    runTitleAuthorSearch,
+    resetSearchEditorState,
+  }
+}
diff --git a/client/src/features/book-requests/composables/useRequestAttempts.ts b/client/src/features/book-requests/composables/useRequestAttempts.ts
new file mode 100644
index 000000000..0f39bacff
--- /dev/null
+++ b/client/src/features/book-requests/composables/useRequestAttempts.ts
@@ -0,0 +1,54 @@
+import { ref } from 'vue'
+import { api } from '@/lib/api'
+import { fulfilmentBase } from '../fulfilmentBase'
+import type { BookRequestDownloadItem } from '@bookorbit/types'
+
+/**
+ * Every release a request has been sent to, refusals included.
+ *
+ * Read on demand rather than carried on the request: the queue only ever shows the current
+ * attempt, and the earlier ones are of interest to one person looking at one request. What makes
+ * them worth a call at all is the refusals - a request that downloaded from its second source
+ * looks unremarkable on its own row, and nothing else records that the first one said no.
+ */
+export function useRequestAttempts(canManage: () => boolean) {
+  const basePath = () => fulfilmentBase(canManage())
+  const attempts = ref<BookRequestDownloadItem[]>([])
+  const loading = ref(false)
+  const failed = ref(false)
+  /** Bumped per fetch, so stepping to the next request cannot be answered with the last one's. */
+  let generation = 0
+
+  async function fetchAttempts(requestId: number): Promise<void> {
+    const current = ++generation
+    loading.value = true
+    failed.value = false
+    try {
+      const res = await api(`${basePath()}/${requestId}/attempts`)
+      if (current !== generation) return
+      if (!res.ok) {
+        failed.value = true
+        attempts.value = []
+        return
+      }
+      const payload = (await res.json()) as BookRequestDownloadItem[]
+      if (current !== generation) return
+      attempts.value = payload
+    } catch {
+      if (current !== generation) return
+      failed.value = true
+      attempts.value = []
+    } finally {
+      if (current === generation) loading.value = false
+    }
+  }
+
+  function reset(): void {
+    generation++
+    attempts.value = []
+    failed.value = false
+    loading.value = false
+  }
+
+  return { attempts, loading, failed, fetchAttempts, reset }
+}
diff --git a/client/src/features/book-requests/composables/useRequestAutomation.ts b/client/src/features/book-requests/composables/useRequestAutomation.ts
new file mode 100644
index 000000000..40647bfec
--- /dev/null
+++ b/client/src/features/book-requests/composables/useRequestAutomation.ts
@@ -0,0 +1,64 @@
+import { ref } from 'vue'
+import { api } from '@/lib/api'
+import { DEFAULT_BOOK_REQUEST_AUTOMATION_SETTINGS } from '@bookorbit/types'
+import type { BookRequestAutomationSettings, UpdateBookRequestAutomationSettingsPayload } from '@bookorbit/types'
+
+const BASE_PATH = '/api/v1/admin/book-request-automation'
+
+/**
+ * The instance-level automation knobs. Held behind `ManageAppSettings`, so this is only ever
+ * reached from the settings page, never from the requests page an approver works in.
+ */
+export function useRequestAutomation() {
+  const settings = ref<BookRequestAutomationSettings>({ ...DEFAULT_BOOK_REQUEST_AUTOMATION_SETTINGS })
+  const loading = ref(false)
+  const loadFailed = ref(false)
+
+  async function fetchSettings(): Promise<void> {
+    loading.value = true
+    loadFailed.value = false
+    try {
+      const res = await api(BASE_PATH)
+      if (!res.ok) {
+        loadFailed.value = true
+        return
+      }
+      settings.value = (await res.json()) as BookRequestAutomationSettings
+    } catch {
+      loadFailed.value = true
+    } finally {
+      loading.value = false
+    }
+  }
+
+  /** Sends only what changed, and adopts whatever the server says the settings now are. */
+  async function put(payload: UpdateBookRequestAutomationSettingsPayload): Promise<boolean> {
+    try {
+      const res = await api(BASE_PATH, {
+        method: 'PUT',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(payload),
+      })
+      if (!res.ok) return false
+      settings.value = (await res.json()) as BookRequestAutomationSettings
+      return true
+    } catch {
+      return false
+    }
+  }
+
+  /**
+   * One save at a time. Each sends only the knob that moved and adopts the whole reply, so letting
+   * two overlap would settle the panel on whichever reply landed last rather than on what was
+   * asked for. Queued rather than refused: refusing loses the change, and reads as a failed save.
+   */
+  let queue: Promise<unknown> = Promise.resolve()
+
+  function save(payload: UpdateBookRequestAutomationSettingsPayload): Promise<boolean> {
+    const done = queue.then(() => put(payload))
+    queue = done
+    return done
+  }
+
+  return { settings, loading, loadFailed, fetchSettings, save }
+}
diff --git a/client/src/features/book-requests/composables/useRequestDestinationDefault.ts b/client/src/features/book-requests/composables/useRequestDestinationDefault.ts
new file mode 100644
index 000000000..c339100ec
--- /dev/null
+++ b/client/src/features/book-requests/composables/useRequestDestinationDefault.ts
@@ -0,0 +1,205 @@
+import { ref } from 'vue'
+import {
+  BOOK_REQUEST_MEDIA_KINDS,
+  DEFAULT_BOOK_REQUEST_PREFERENCES,
+  emptyResolvedRequestDestinations,
+  NO_REQUEST_DESTINATION,
+  NO_RESOLVED_REQUEST_DESTINATION,
+  REQUEST_LANGUAGE_CODES,
+  toRequestLanguage,
+  type BookRequestMediaKind,
+  type BookRequestPreferences,
+  type RequestDestination,
+  type ResolvedRequestDestination,
+  type ResolvedRequestDestinations,
+} from '@bookorbit/types'
+import { api } from '@/lib/api'
+import { formatLanguageName } from '@/i18n/formatters'
+
+const PREFERENCES_ENDPOINT = '/api/v1/user-preferences/book-requests'
+const DEFAULTS_ENDPOINT = '/api/v1/book-requests/default-destinations'
+
+const destinations = ref<ResolvedRequestDestinations>(emptyResolvedRequestDestinations())
+const defaultLanguage = ref<string | null>(DEFAULT_BOOK_REQUEST_PREFERENCES.defaultLanguage)
+const isSaving = ref(false)
+
+let hasLoadedDefaults = false
+let inFlightDefaults: Promise<boolean> | null = null
+let hasLoadedPreferences = false
+let inFlightPreferences: Promise<boolean> | null = null
+
+interface DestinationLibrary {
+  id: number
+  folders: { id: number }[]
+}
+
+function normalizeId(value: unknown): number | null {
+  return typeof value === 'number' && Number.isInteger(value) && value > 0 ? value : null
+}
+
+/** A code the matcher does not know is a filter nothing satisfies, so it is dropped rather than kept. */
+function normalizeLanguageCode(value: unknown): string | null {
+  return typeof value === 'string' ? toRequestLanguage(value) : null
+}
+
+function current(): BookRequestPreferences {
+  return { defaultLanguage: defaultLanguage.value }
+}
+
+/**
+ * The server already checked that these still name something; this only settles the shape, so a
+ * malformed body reads as "no default" rather than as a destination made of undefined.
+ */
+function normalizeDestinations(value: Partial<ResolvedRequestDestinations> | undefined): ResolvedRequestDestinations {
+  const next = emptyResolvedRequestDestinations()
+  for (const mediaKind of BOOK_REQUEST_MEDIA_KINDS) {
+    const libraryId = normalizeId(value?.[mediaKind]?.libraryId)
+    if (libraryId === null) continue
+    const libraryName = value?.[mediaKind]?.libraryName
+    next[mediaKind] = {
+      libraryId,
+      libraryName: typeof libraryName === 'string' ? libraryName : null,
+      folderId: normalizeId(value?.[mediaKind]?.folderId),
+    }
+  }
+  return next
+}
+
+async function fetchDefaults(): Promise<boolean> {
+  try {
+    const response = await api(DEFAULTS_ENDPOINT)
+    if (!response.ok) return false
+
+    destinations.value = normalizeDestinations((await response.json()) as Partial<ResolvedRequestDestinations>)
+    hasLoadedDefaults = true
+    return true
+  } catch {
+    return false
+  }
+}
+
+async function fetchPreferences(): Promise<boolean> {
+  try {
+    const response = await api(PREFERENCES_ENDPOINT)
+    if (!response.ok) return false
+
+    const body = (await response.json()) as { settings?: Partial<BookRequestPreferences> }
+    defaultLanguage.value = normalizeLanguageCode(body.settings?.defaultLanguage)
+    hasLoadedPreferences = true
+    return true
+  } catch {
+    return false
+  }
+}
+
+async function persist(settings: BookRequestPreferences): Promise<boolean> {
+  const previous = current()
+  defaultLanguage.value = settings.defaultLanguage
+  isSaving.value = true
+
+  try {
+    const response = await api(PREFERENCES_ENDPOINT, {
+      method: 'PUT',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ settings } satisfies { settings: BookRequestPreferences }),
+    })
+    if (!response.ok) {
+      defaultLanguage.value = previous.defaultLanguage
+      return false
+    }
+    hasLoadedPreferences = true
+    return true
+  } catch {
+    defaultLanguage.value = previous.defaultLanguage
+    return false
+  } finally {
+    isSaving.value = false
+  }
+}
+
+/**
+ * Where a request of each medium lands when nobody picks anywhere: the operator's instance
+ * default, resolved server-side and read here only so the form can say so.
+ *
+ * Read-only, and no longer a per-user pin. The pin answered the same question one person at a
+ * time, so every requester had to find it, and two mechanisms with an invisible precedence rule
+ * between them was worse than one. Keying it on the medium made it worse still: a pin whose state
+ * flips when you touch the segmented control beside it is not a control anyone can trust.
+ */
+export function useRequestDestinationDefault() {
+  async function load(): Promise<boolean> {
+    if (hasLoadedDefaults) return true
+    inFlightDefaults ??= fetchDefaults().finally(() => {
+      inFlightDefaults = null
+    })
+    return inFlightDefaults
+  }
+
+  function defaultFor(mediaKind: BookRequestMediaKind): ResolvedRequestDestination {
+    return destinations.value[mediaKind] ?? NO_RESOLVED_REQUEST_DESTINATION
+  }
+
+  /**
+   * Where a destination picker starts: what the request already carries, then the only library
+   * there is when there is no choice.
+   *
+   * The instance default is deliberately not selected here. It can name a library this user
+   * cannot browse, so it must not become the value of a select they are expected to read and
+   * change; it is shown as the placeholder instead, and applied by the server when nothing was
+   * picked.
+   */
+  function resolveDestination(
+    libraries: readonly DestinationLibrary[],
+    carried: RequestDestination = NO_REQUEST_DESTINATION,
+    allowOnlyLibrary = true,
+  ): RequestDestination {
+    const onlyLibraryId = allowOnlyLibrary && libraries.length === 1 ? (libraries[0]?.id ?? null) : null
+    const libraryId = carried.libraryId ?? onlyLibraryId
+    const firstFolderId = libraries.find((library) => library.id === libraryId)?.folders[0]?.id ?? null
+
+    return { libraryId, folderId: carried.folderId ?? firstFolderId }
+  }
+
+  return { destinations, load, defaultFor, resolveDestination }
+}
+
+/**
+ * The language a new request asks for. The only thing this category still stores: destinations
+ * moved to the instance default, and a reading language has no instance-level answer.
+ */
+export function useRequestLanguageDefault() {
+  async function load(): Promise<boolean> {
+    if (hasLoadedPreferences) return true
+    inFlightPreferences ??= fetchPreferences().finally(() => {
+      inFlightPreferences = null
+    })
+    return inFlightPreferences
+  }
+
+  function setDefault(language: string | null): Promise<boolean> {
+    return persist({ ...current(), defaultLanguage: normalizeLanguageCode(language) })
+  }
+
+  /**
+   * What a new request should ask for: the pinned language, then whatever fallback the caller
+   * offers, which is the reader's own interface language.
+   *
+   * Deliberately not the language of the edition being requested. Taking that is exactly what
+   * turned a request for a book into a request for a translation nobody chose.
+   */
+  function resolveLanguage(fallback: string | null | undefined): string | null {
+    return defaultLanguage.value ?? normalizeLanguageCode(fallback)
+  }
+
+  return { defaultLanguage, isSaving, load, setDefault, resolveLanguage }
+}
+
+/**
+ * The languages a request may ask for, named in the reader's own language and sorted by that name
+ * rather than by code, so the list reads in their alphabet instead of English's.
+ *
+ * Only codes the release matcher can compare, so nothing offered here can silently match nothing.
+ */
+export function requestLanguageOptions(locale: string): { code: string; name: string }[] {
+  return REQUEST_LANGUAGE_CODES.map((code) => ({ code, name: formatLanguageName(code) })).sort((a, b) => a.name.localeCompare(b.name, locale))
+}
diff --git a/client/src/features/book-requests/composables/useRequestListDensity.ts b/client/src/features/book-requests/composables/useRequestListDensity.ts
new file mode 100644
index 000000000..a669d7a01
--- /dev/null
+++ b/client/src/features/book-requests/composables/useRequestListDensity.ts
@@ -0,0 +1,38 @@
+import { ref } from 'vue'
+
+/**
+ * There is one list. The choice is how tall its rows are, not which component draws them: cards
+ * and the table carried the same fields, so keeping both meant two places for every new action.
+ */
+export type RequestListDensity = 'comfortable' | 'compact'
+
+const STORAGE_KEY = 'bookorbit.requests.density'
+
+function readStored(): RequestListDensity {
+  try {
+    // Anything else, including the `cards` and `table` this key used to hold, lands on the default.
+    return localStorage.getItem(STORAGE_KEY) === 'compact' ? 'compact' : 'comfortable'
+  } catch {
+    // Private browsing and blocked storage both throw here; the default is still usable.
+    return 'comfortable'
+  }
+}
+
+/**
+ * Module-level so the choice holds while moving between the two list tabs, rather than resetting
+ * every time the panel remounts.
+ */
+const density = ref<RequestListDensity>(readStored())
+
+export function useRequestListDensity() {
+  function setDensity(next: RequestListDensity): void {
+    density.value = next
+    try {
+      localStorage.setItem(STORAGE_KEY, next)
+    } catch {
+      // A preference that cannot be persisted still applies for this session.
+    }
+  }
+
+  return { density, setDensity }
+}
diff --git a/client/src/features/book-requests/composables/useRequestQueue.ts b/client/src/features/book-requests/composables/useRequestQueue.ts
new file mode 100644
index 000000000..2c2bbea1e
--- /dev/null
+++ b/client/src/features/book-requests/composables/useRequestQueue.ts
@@ -0,0 +1,27 @@
+import { computed, type Ref } from 'vue'
+import type { BookRequestItem } from '@bookorbit/types'
+
+/**
+ * The stepper walks the list exactly as it is shown, in its current filter and sort order, so the
+ * position it reports can never disagree with the table behind it. It stops at both ends: wrapping
+ * from the last row back to the first reads as a bug when the count says you are at the end.
+ */
+export function useRequestQueue(items: Ref<BookRequestItem[]>, currentId: Ref<number | null>) {
+  const index = computed(() => (currentId.value === null ? -1 : items.value.findIndex((request) => request.id === currentId.value)))
+  const total = computed(() => items.value.length)
+
+  /**
+   * Zero when the open request is not in the list at all, which happens when a filter or a
+   * dismissal drops it out from under a drawer that is still open on it. The stepper hides rather
+   * than claiming a position the list cannot show.
+   */
+  const position = computed(() => index.value + 1)
+
+  const hasPrevious = computed(() => index.value > 0)
+  const hasNext = computed(() => index.value >= 0 && index.value < total.value - 1)
+
+  const previousId = computed(() => (hasPrevious.value ? (items.value[index.value - 1]?.id ?? null) : null))
+  const nextId = computed(() => (hasNext.value ? (items.value[index.value + 1]?.id ?? null) : null))
+
+  return { index, position, total, hasPrevious, hasNext, previousId, nextId }
+}
diff --git a/client/src/features/book-requests/composables/useRequestReview.ts b/client/src/features/book-requests/composables/useRequestReview.ts
new file mode 100644
index 000000000..a2a84f830
--- /dev/null
+++ b/client/src/features/book-requests/composables/useRequestReview.ts
@@ -0,0 +1,55 @@
+import { ref } from 'vue'
+import { api } from '@/lib/api'
+import { fulfilmentBase } from '../fulfilmentBase'
+import type { BookRequestReview } from '@bookorbit/types'
+
+/**
+ * What landed in the Book Dock for a held request, and how it scored against what was asked for.
+ *
+ * Fetched separately from the request rather than carried on it: the list renders every row and
+ * this costs a dock read, a unit-file read and a settings read for the one row someone opened.
+ */
+export function useRequestReview(canManage: () => boolean) {
+  const basePath = () => fulfilmentBase(canManage())
+  const review = ref<BookRequestReview | null>(null)
+  const loading = ref(false)
+  const failed = ref(false)
+  /** Bumped per fetch, so stepping to the next request cannot be answered with the last one's. */
+  let generation = 0
+
+  async function fetchReview(id: number): Promise<void> {
+    const current = ++generation
+    loading.value = true
+    failed.value = false
+
+    try {
+      const res = await api(`${basePath()}/${id}/review`)
+      if (current !== generation) return
+      if (!res.ok) {
+        // A request that left `needs_review` while the drawer was open answers 400 here. That is
+        // not an error worth showing: the panel simply no longer applies.
+        review.value = null
+        failed.value = res.status >= 500
+        return
+      }
+      const payload = (await res.json()) as BookRequestReview
+      if (current !== generation) return
+      review.value = payload
+    } catch {
+      if (current !== generation) return
+      review.value = null
+      failed.value = true
+    } finally {
+      if (current === generation) loading.value = false
+    }
+  }
+
+  function reset(): void {
+    generation++
+    review.value = null
+    loading.value = false
+    failed.value = false
+  }
+
+  return { review, loading, failed, fetchReview, reset }
+}
diff --git a/client/src/features/book-requests/composables/useRequestSeedStatus.ts b/client/src/features/book-requests/composables/useRequestSeedStatus.ts
new file mode 100644
index 000000000..8497a9f44
--- /dev/null
+++ b/client/src/features/book-requests/composables/useRequestSeedStatus.ts
@@ -0,0 +1,49 @@
+import { ref } from 'vue'
+import { api } from '@/lib/api'
+import { fulfilmentBase } from '../fulfilmentBase'
+import type { BookRequestSeedStatus } from '@bookorbit/types'
+
+/**
+ * Read live from the download client when someone looks, rather than stored. A seed outlives its
+ * import by weeks, so polling every finished download to keep a ratio fresh would be an
+ * ever-growing number of client calls for a number nobody is reading.
+ */
+export function useRequestSeedStatus(canManage: () => boolean) {
+  const basePath = () => fulfilmentBase(canManage())
+  const status = ref<BookRequestSeedStatus | null>(null)
+  const loading = ref(false)
+  const failed = ref(false)
+  /** Bumped per fetch, so stepping to the next request cannot be answered with the last one's. */
+  let generation = 0
+
+  async function fetchStatus(requestId: number): Promise<void> {
+    const current = ++generation
+    loading.value = true
+    failed.value = false
+    status.value = null
+    try {
+      const res = await api(`${basePath()}/${requestId}/seed`)
+      if (current !== generation) return
+      if (!res.ok) {
+        failed.value = true
+        return
+      }
+      const body = (await res.text()).trim()
+      if (current !== generation) return
+      status.value = body ? (JSON.parse(body) as BookRequestSeedStatus) : null
+    } catch {
+      if (current === generation) failed.value = true
+    } finally {
+      if (current === generation) loading.value = false
+    }
+  }
+
+  function reset(): void {
+    generation++
+    status.value = null
+    failed.value = false
+    loading.value = false
+  }
+
+  return { status, loading, failed, fetchStatus, reset }
+}
diff --git a/client/src/features/book-requests/composables/useRequestSourceStatus.ts b/client/src/features/book-requests/composables/useRequestSourceStatus.ts
new file mode 100644
index 000000000..98a50e2aa
--- /dev/null
+++ b/client/src/features/book-requests/composables/useRequestSourceStatus.ts
@@ -0,0 +1,48 @@
+import { computed, ref } from 'vue'
+import { api } from '@/lib/api'
+import type { BookRequestSourceStatus } from '@bookorbit/types'
+
+const ENDPOINT = '/api/v1/book-requests/source-status'
+
+/**
+ * Whether this instance can search for a release at all.
+ *
+ * Its own endpoint rather than a field on the request summary: that one is cached against the
+ * request change version, and switching an indexer off changes nothing about any request, so the
+ * banner would keep saying the old thing until somebody happened to file one.
+ *
+ * A failed load stays silent. This drives a warning, and a warning nobody can act on because the
+ * fetch failed is worse than no warning: the release picker still states the same fact from the
+ * search result it already has.
+ */
+export function useRequestSourceStatus() {
+  const status = ref<BookRequestSourceStatus | null>(null)
+
+  /** No source is switched on, so nothing will be searched no matter what is requested. */
+  const noSourcesEnabled = computed(() => status.value !== null && status.value.enabled === 0)
+  /** Of those, the ones that are one toggle away from working rather than one setup away. */
+  const noSourcesConfigured = computed(() => noSourcesEnabled.value && status.value?.configured === 0)
+
+  async function fetchSourceStatus(): Promise<void> {
+    try {
+      const res = await api(ENDPOINT)
+      if (!res.ok) return
+      status.value = toStatus(await res.json())
+    } catch {
+      // Deliberately silent; see above.
+    }
+  }
+
+  return { status, noSourcesEnabled, noSourcesConfigured, fetchSourceStatus }
+}
+
+/**
+ * Only a body carrying both counts becomes a status. Anything else stays null, which reads as "not
+ * answered yet" everywhere this is used, so a shape nobody expected shows no banner rather than
+ * accusing a working instance of having no sources.
+ */
+function toStatus(body: unknown): BookRequestSourceStatus | null {
+  const value = body as Partial<BookRequestSourceStatus> | null
+  if (typeof value?.configured !== 'number' || typeof value.enabled !== 'number') return null
+  return { configured: value.configured, enabled: value.enabled }
+}
diff --git a/client/src/features/book-requests/composables/useRequestSubmission.ts b/client/src/features/book-requests/composables/useRequestSubmission.ts
new file mode 100644
index 000000000..3aa66804a
--- /dev/null
+++ b/client/src/features/book-requests/composables/useRequestSubmission.ts
@@ -0,0 +1,379 @@
+import { onUnmounted, ref, watch } from 'vue'
+import { api } from '@/lib/api'
+import { bookRequestSubmitErrorCode } from '@bookorbit/types'
+import type {
+  BookRequestAvailability,
+  BookRequestFailureMeta,
+  BookRequestMediaKind,
+  BookRequestMetadataSource,
+  BookRequestSubmitErrorCode,
+  BookRequestSubmitResult,
+  CreateBookRequestPayload,
+  MetadataCandidate,
+} from '@bookorbit/types'
+
+/** Stands in for a candidate key while a free-text submission is in flight; there is no candidate. */
+const FREE_TEXT_KEY = '__free_text__'
+
+/** Providers stream in; annotate in bounded batches rather than one call per arriving result. */
+const ANNOTATE_BATCH_LIMIT = 50
+
+/**
+ * A search streams a dozen providers in over several seconds, and the results array changes
+ * identity on every arrival. Coalescing the arrivals inside this window is what keeps that from
+ * becoming one availability round trip per candidate.
+ */
+const ANNOTATE_COALESCE_MS = 150
+
+/**
+ * Why the server refused, in the two forms it can answer with.
+ *
+ * `code` is the one the form renders: every rule this instance applies has one, so the reason is
+ * translated rather than repeated in English. `message` survives only as the fallback for a
+ * refusal nothing has classified, which is what an unrecognised code and a validation error both
+ * come back as.
+ */
+export interface SubmitFailure {
+  code: BookRequestSubmitErrorCode | null
+  meta: BookRequestFailureMeta | null
+  message: string | null
+}
+
+const UNCLASSIFIED_FAILURE: SubmitFailure = { code: null, meta: null, message: null }
+
+async function submitFailure(res: Response): Promise<SubmitFailure> {
+  try {
+    const body = (await res.json()) as { message?: string | string[]; errorCode?: unknown; errorMeta?: BookRequestFailureMeta }
+    const message = Array.isArray(body.message) ? body.message[0] : body.message
+    return { code: bookRequestSubmitErrorCode(body.errorCode), meta: body.errorMeta ?? null, message: message ?? null }
+  } catch {
+    return UNCLASSIFIED_FAILURE
+  }
+}
+
+/**
+ * What to show somebody whose submission was refused, in their language where the server said
+ * enough for that to be possible.
+ *
+ * The code wins wherever there is one: the sentence beside it is English written at the point of
+ * refusal and was only ever the fallback. It is still the right fallback, because a validation
+ * error naming the field beats "that did not work".
+ *
+ * `t` is injected so this stays a pure function of the failure, testable without standing up i18n.
+ */
+export function submitFailureText(failure: SubmitFailure | null, t: (key: string, named: Record<string, unknown>) => string): string | null {
+  if (!failure) return null
+  if (failure.code) return t(`bookRequests.submitError.${failure.code}`, failure.meta ?? {})
+  return failure.message
+}
+
+export function candidateKey(candidate: MetadataCandidate): string {
+  return `${candidate.provider}:${candidate.providerId}`
+}
+
+export function candidateTitle(candidate: MetadataCandidate): string {
+  return candidate.displayTitle ?? candidate.title ?? ''
+}
+
+/**
+ * A candidate's series index is a label ("01", "1.5"); a request stores a whole number. A request
+ * for book 1.5 is still a request for that book, so narrow rather than refuse the submission.
+ */
+function requestSeriesIndex(candidate: MetadataCandidate): number | null {
+  if (candidate.seriesIndex == null) return null
+  const parsed = Number.parseFloat(candidate.seriesIndex)
+  return Number.isFinite(parsed) ? Math.trunc(parsed) : null
+}
+
+export function useRequestSubmission() {
+  const availability = ref<Record<string, BookRequestAvailability>>({})
+  /**
+   * Why the last submission was refused, so the page can say the specific reason rather than
+   * replacing it with "that did not work". A self-serve request can be turned down for reasons
+   * only the server knows: too many downloads already in flight, or a destination the requester
+   * cannot reach.
+   */
+  const lastFailure = ref<SubmitFailure | null>(null)
+  const submitting = ref<string | null>(null)
+  const mediaKind = ref<BookRequestMediaKind>('ebook')
+
+  /** Claimed keys, in flight or already answered, so a candidate is never asked about twice. */
+  let claimed = new Set<string>()
+  let queue: MetadataCandidate[] = []
+  let coalesceHandle: ReturnType<typeof setTimeout> | null = null
+  let draining = false
+  /** Bumped whenever the question changes, so an answer to the old one is discarded. */
+  let generation = 0
+
+  /**
+   * Queues a page of candidates for "already in your library" and "already requested". Results
+   * arriving one provider at a time collapse into a small number of batched round trips.
+   */
+  function annotate(candidates: MetadataCandidate[]): void {
+    for (const candidate of candidates) {
+      const key = candidateKey(candidate)
+      if (!candidateTitle(candidate) || claimed.has(key)) continue
+      claimed.add(key)
+      queue.push(candidate)
+    }
+    if (queue.length === 0 || coalesceHandle !== null) return
+
+    coalesceHandle = setTimeout(() => {
+      coalesceHandle = null
+      void drainQueue()
+    }, ANNOTATE_COALESCE_MS)
+  }
+
+  /** One batch in flight at a time; later arrivals join the queue rather than opening a request. */
+  async function drainQueue(): Promise<void> {
+    if (draining) return
+    draining = true
+    try {
+      while (queue.length) {
+        const batch = queue.splice(0, ANNOTATE_BATCH_LIMIT)
+        const asked = generation
+        const answered = await fetchAvailability(batch)
+
+        // The media kind changed while this was in flight, so the answer is to the wrong question.
+        if (generation !== asked) return
+        if (!answered) continue
+
+        const next = { ...availability.value }
+        batch.forEach((candidate, index) => {
+          const result = answered[index]
+          if (result) next[candidateKey(candidate)] = result
+        })
+        availability.value = next
+      }
+    } finally {
+      draining = false
+    }
+  }
+
+  async function fetchAvailability(batch: MetadataCandidate[]): Promise<BookRequestAvailability[] | null> {
+    try {
+      const res = await api('/api/v1/book-requests/availability', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          items: batch.map((c) => ({
+            title: candidateTitle(c),
+            author: c.authors?.[0],
+            isbn13: c.isbn13,
+            providerKey: c.provider,
+            providerId: c.providerId,
+            mediaKind: mediaKind.value,
+          })),
+        }),
+      })
+      if (res.ok) return (await res.json()) as BookRequestAvailability[]
+      // A 4xx is deterministic - the same batch would be refused again - so the keys stay claimed.
+      // A 5xx is the server having a bad moment, and holding the claim would drop the "already
+      // requested" and "in your library" badges from every result for the rest of the visit.
+      if (res.status >= 500) for (const candidate of batch) claimed.delete(candidateKey(candidate))
+      return null
+    } catch {
+      // A dropped connection is not deterministic either, so the next arrival asks again.
+      for (const candidate of batch) claimed.delete(candidateKey(candidate))
+      return null
+    }
+  }
+
+  /** A different medium is a different question, so every annotation is recomputed. */
+  watch(mediaKind, () => {
+    generation += 1
+    availability.value = {}
+    claimed = new Set()
+    queue = []
+    if (coalesceHandle !== null) clearTimeout(coalesceHandle)
+    coalesceHandle = null
+  })
+
+  onUnmounted(() => {
+    if (coalesceHandle !== null) clearTimeout(coalesceHandle)
+    coalesceHandle = null
+  })
+
+  function getAvailability(candidate: MetadataCandidate): BookRequestAvailability | null {
+    return availability.value[candidateKey(candidate)] ?? null
+  }
+
+  async function submit(
+    candidate: MetadataCandidate,
+    extra: {
+      targetLibraryId?: number | null
+      targetFolderId?: number | null
+      note?: string | null
+      preferredFormats?: string[]
+      language?: string | null
+      coverUrl?: string | null
+      selfServe?: boolean
+      isbn10?: string | null
+      isbn13?: string | null
+      providerKey?: string | null
+      providerId?: string | null
+      metadataSources?: BookRequestMetadataSource[]
+    },
+  ): Promise<BookRequestSubmitResult | null> {
+    const payload: CreateBookRequestPayload = {
+      title: candidateTitle(candidate),
+      mediaKind: mediaKind.value,
+      ...(extra.selfServe ? { selfServe: true } : {}),
+      subtitle: candidate.subtitle ?? null,
+      authors: candidate.authors ?? [],
+      seriesName: candidate.seriesName ?? null,
+      seriesIndex: requestSeriesIndex(candidate),
+      isbn10: extra.isbn10 !== undefined ? extra.isbn10 : (candidate.isbn10 ?? null),
+      isbn13: extra.isbn13 !== undefined ? extra.isbn13 : (candidate.isbn13 ?? null),
+      publishedYear: candidate.publishedYear ?? null,
+      // What the requester chose, not what the edition happened to be. Inheriting the edition's
+      // language silently is how a request for a book became a request for a translation.
+      language: extra.language ?? null,
+      coverUrl: normalizeCoverUrl(extra.coverUrl !== undefined ? extra.coverUrl : candidate.coverUrl),
+      providerKey: extra.providerKey !== undefined ? extra.providerKey : candidate.provider,
+      providerId: extra.providerId !== undefined ? extra.providerId : candidate.providerId,
+      metadataSources: extra.metadataSources ?? [],
+      targetLibraryId: extra.targetLibraryId ?? null,
+      targetFolderId: extra.targetFolderId ?? null,
+      note: extra.note ?? null,
+      preferredFormats: extra.preferredFormats ?? [],
+    }
+
+    submitting.value = candidateKey(candidate)
+    lastFailure.value = null
+    try {
+      const res = await api('/api/v1/book-requests', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(payload),
+      })
+      if (!res.ok) {
+        lastFailure.value = await submitFailure(res)
+        return null
+      }
+
+      const result = (await res.json()) as BookRequestSubmitResult
+      // Claim the key so a queued annotation cannot land on top of what we now know for certain.
+      claimed.add(candidateKey(candidate))
+      availability.value = {
+        ...availability.value,
+        [candidateKey(candidate)]: {
+          ownedBookId: getAvailability(candidate)?.ownedBookId ?? null,
+          existingRequestId: result.request.id,
+          existingRequestStatus: result.request.status,
+          alreadySubscribed: true,
+        },
+      }
+      return result
+    } catch {
+      // A network failure never reached the server, so there is no classified refusal to show. The
+      // caller falls back to its generic message on a null return; without this the promise
+      // rejected, the button simply un-disabled, and the person was told nothing at all.
+      lastFailure.value = UNCLASSIFIED_FAILURE
+      return null
+    } finally {
+      submitting.value = null
+    }
+  }
+
+  /**
+   * What the library and the queue already know about a title nobody searched a provider for.
+   *
+   * Free text has no provider id and usually no ISBN, so this is the weakest identity the dedupe
+   * rules ever see and it will miss matches a provider result would have caught. It is here to
+   * show a person what was found before they commit, not to decide anything.
+   */
+  async function checkFreeText(work: { title: string; author?: string | null }): Promise<BookRequestAvailability | null> {
+    const title = work.title.trim()
+    if (!title) return null
+
+    try {
+      const res = await api('/api/v1/book-requests/availability', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ items: [{ title, mediaKind: mediaKind.value, ...(work.author?.trim() ? { author: work.author.trim() } : {}) }] }),
+      })
+      if (!res.ok) return null
+      const [first] = (await res.json()) as BookRequestAvailability[]
+      return first ?? null
+    } catch {
+      return null
+    }
+  }
+
+  /**
+   * A request for a work no metadata provider returned. Everything the row carries is what the
+   * person typed, which is enough for the release search to score against and is the whole point:
+   * the provider catalogues are not the limit of what a tracker has.
+   */
+  async function submitFreeText(
+    work: { title: string; author?: string | null },
+    extra: {
+      targetLibraryId?: number | null
+      targetFolderId?: number | null
+      language?: string | null
+      selfServe?: boolean
+      note?: string | null
+      preferredFormats?: string[]
+    },
+  ): Promise<BookRequestSubmitResult | null> {
+    const title = work.title.trim()
+    if (!title) return null
+
+    const payload: CreateBookRequestPayload = {
+      title,
+      mediaKind: mediaKind.value,
+      authors: work.author?.trim() ? [work.author.trim()] : [],
+      targetLibraryId: extra.targetLibraryId ?? null,
+      targetFolderId: extra.targetFolderId ?? null,
+      language: extra.language ?? null,
+      note: extra.note ?? null,
+      preferredFormats: extra.preferredFormats ?? [],
+      ...(extra.selfServe ? { selfServe: true } : {}),
+    }
+
+    submitting.value = FREE_TEXT_KEY
+    lastFailure.value = null
+    try {
+      const res = await api('/api/v1/book-requests', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(payload),
+      })
+      if (!res.ok) {
+        lastFailure.value = await submitFailure(res)
+        return null
+      }
+      return (await res.json()) as BookRequestSubmitResult
+    } catch {
+      lastFailure.value = UNCLASSIFIED_FAILURE
+      return null
+    } finally {
+      submitting.value = null
+    }
+  }
+
+  return {
+    availability,
+    lastFailure,
+    submitting,
+    mediaKind,
+    annotate,
+    getAvailability,
+    submit,
+    submitFreeText,
+    checkFreeText,
+    candidateKey,
+    candidateTitle,
+  }
+}
+
+function normalizeCoverUrl(value: string | null | undefined): string | null {
+  if (!value) return null
+  try {
+    const protocol = new URL(value).protocol
+    return protocol === 'http:' || protocol === 'https:' ? value : null
+  } catch {
+    return null
+  }
+}
diff --git a/client/src/features/book-requests/fulfilmentBase.ts b/client/src/features/book-requests/fulfilmentBase.ts
new file mode 100644
index 000000000..fa22c2225
--- /dev/null
+++ b/client/src/features/book-requests/fulfilmentBase.ts
@@ -0,0 +1,21 @@
+/** Works on any request, and only a moderator may call it. */
+const ADMIN_BASE = '/api/v1/admin/book-requests'
+/** The same routes, restricted server-side to the requests that are the caller's to drive. */
+const SELF_BASE = '/api/v1/book-request-fulfilment'
+
+/**
+ * Which controller answers fulfilment calls for this viewer.
+ *
+ * The two expose the same route shapes on purpose, so the picker, the grab dialog and the attempts
+ * panel stay one component each rather than two. What differs is the scope the server enforces: a
+ * moderator may fulfil anything, a self-server only the row that is theirs to drive. Nothing here decides
+ * authorization; it decides which endpoint to ask, and the server answers whether it is allowed.
+ *
+ * A plain function of a boolean rather than a composable reading `usePermissions`. That import
+ * reaches `useAuth`, which imports the router, which touches `window` at module scope - and the
+ * composables that call this run under the node test environment, where there is no window. The
+ * components already know whether they can manage; they pass it down.
+ */
+export function fulfilmentBase(canManage: boolean): string {
+  return canManage ? ADMIN_BASE : SELF_BASE
+}
diff --git a/client/src/features/book-requests/releaseFacets.ts b/client/src/features/book-requests/releaseFacets.ts
new file mode 100644
index 000000000..5a134d023
--- /dev/null
+++ b/client/src/features/book-requests/releaseFacets.ts
@@ -0,0 +1,50 @@
+import type { ReleaseCandidateItem } from '@bookorbit/types'
+
+import { formatLanguageName } from '@/i18n/formatters'
+
+/**
+ * How the release picker groups a list into filter chips. Kept out of the panel so the rules can
+ * be tested against the code that actually ships rather than against a copy of it.
+ */
+
+/**
+ * Indexers spell the same language differently: MyAnonaMouse says "ENG" where Project Gutenberg
+ * says "en". Both render as "English", so faceting on the raw code produced two chips that looked
+ * identical and each hid the other's releases. Facets and filtering both key on the resolved name.
+ */
+export function languageKey(code: string | null): string | null {
+  if (!code) return null
+  return formatLanguageName(code.toLowerCase())
+}
+
+/** Same collision, one letter case apart: "epub" and "EPUB" are one format, not two. */
+export function formatKey(value: string | null): string | null {
+  return value ? value.toUpperCase() : null
+}
+
+/** Every format the release claims, in the order the server put them: preferred ones first. */
+export function formatKeys(release: ReleaseCandidateItem): string[] {
+  return release.formats.map((value) => value.toUpperCase())
+}
+
+export interface ReleaseFacet {
+  value: string
+  count: number
+}
+
+/**
+ * Counted against every other active filter, so a chip never offers a combination with no rows.
+ *
+ * A reader may return several values, and the release then counts under each of them: one book
+ * published as an epub, a mobi and an azw3 belongs under all three chips, and counting it under
+ * only the first is what hid it from a filter on a format it actually carries.
+ */
+export function facetsOf<T>(list: T[], read: (item: T) => string | string[] | null): ReleaseFacet[] {
+  const counts = new Map<string, number>()
+  for (const item of list) {
+    const value = read(item)
+    const values = value === null ? [] : Array.isArray(value) ? value : [value]
+    for (const one of new Set(values)) counts.set(one, (counts.get(one) ?? 0) + 1)
+  }
+  return [...counts.entries()].map(([value, count]) => ({ value, count })).sort((a, b) => b.count - a.count || a.value.localeCompare(b.value))
+}
diff --git a/client/src/features/book-requests/requestActionFailure.test.ts b/client/src/features/book-requests/requestActionFailure.test.ts
new file mode 100644
index 000000000..5dc85ad09
--- /dev/null
+++ b/client/src/features/book-requests/requestActionFailure.test.ts
@@ -0,0 +1,30 @@
+import { describe, expect, it } from 'vitest'
+
+import { localizedRequestActionFailure } from './requestActionFailure'
+
+describe('localizedRequestActionFailure', () => {
+  it('maps coded lifecycle failures with their translation parameters', () => {
+    expect(
+      localizedRequestActionFailure({
+        errorCode: 'BOOK_REQUEST_STALE_TRANSITION',
+        errorMeta: { action: 'approve', status: 'rejected' },
+        reason: null,
+      }),
+    ).toEqual({
+      key: 'bookRequests.actionError.BOOK_REQUEST_STALE_TRANSITION',
+      params: { action: 'approve', status: 'rejected' },
+    })
+  })
+
+  it('keeps submission refusals localizable on shared action paths', () => {
+    expect(localizedRequestActionFailure({ errorCode: 'SUBMIT_SELF_SERVE_LIMIT', errorMeta: { limit: 10 }, reason: null })).toEqual({
+      key: 'bookRequests.submitError.SUBMIT_SELF_SERVE_LIMIT',
+      params: { limit: 10 },
+    })
+  })
+
+  it('leaves external grab refusals to their original prose', () => {
+    expect(localizedRequestActionFailure({ errorCode: 'GRAB_SOURCE_REFUSED', errorMeta: null, reason: 'Tracker refused' })).toBeNull()
+    expect(localizedRequestActionFailure({ errorCode: null, errorMeta: null, reason: null })).toBeNull()
+  })
+})
diff --git a/client/src/features/book-requests/requestActionFailure.ts b/client/src/features/book-requests/requestActionFailure.ts
new file mode 100644
index 000000000..434e3ed9e
--- /dev/null
+++ b/client/src/features/book-requests/requestActionFailure.ts
@@ -0,0 +1,24 @@
+import { bookRequestActionErrorCode, bookRequestSubmitErrorCode } from '@bookorbit/types'
+import type { BookRequestFailureMeta } from '@bookorbit/types'
+
+export interface RequestActionFailure {
+  reason: string | null
+  errorCode: unknown
+  errorMeta?: BookRequestFailureMeta | null
+}
+
+export interface LocalizedRequestActionFailure {
+  key: string
+  params: BookRequestFailureMeta
+}
+
+/** App-authored refusals have stable copy; external tracker and client prose stays verbatim. */
+export function localizedRequestActionFailure(failure: RequestActionFailure): LocalizedRequestActionFailure | null {
+  const actionCode = bookRequestActionErrorCode(failure.errorCode)
+  if (actionCode) return { key: `bookRequests.actionError.${actionCode}`, params: failure.errorMeta ?? {} }
+
+  const submitCode = bookRequestSubmitErrorCode(failure.errorCode)
+  if (submitCode) return { key: `bookRequests.submitError.${submitCode}`, params: failure.errorMeta ?? {} }
+
+  return null
+}
diff --git a/client/src/features/book-requests/requestActions.ts b/client/src/features/book-requests/requestActions.ts
new file mode 100644
index 000000000..18290bd69
--- /dev/null
+++ b/client/src/features/book-requests/requestActions.ts
@@ -0,0 +1,63 @@
+import { isBookRequestFulfiller, isCancellableBookRequestStatus, isSettledBookRequestStatus } from '@bookorbit/types'
+import type { BookRequestItem } from '@bookorbit/types'
+
+/**
+ * Who may do what to a request, in one place. The list, the table and the detail page all offer
+ * the same three actions, and three copies of these rules is how a card ends up offering a button
+ * the endpoint refuses.
+ */
+
+/**
+ * The requester, a moderator, or the self-fulfiller who took the request on. The last of those is
+ * the only person who can stop a transfer they started on somebody else's row, so hiding the
+ * action from them would leave work that only runs forwards. `canSelfFulfil` is asked for the same
+ * reason the server asks: the permission can be taken away after the request was taken on.
+ */
+export function canCancelRequest(request: BookRequestItem, userId: number | null, canManage: boolean, canSelfFulfil = false): boolean {
+  const isOwner = userId !== null && request.userId === userId
+  const drives = canSelfFulfil && isBookRequestFulfiller(request, userId)
+  return (isOwner || canManage || drives) && isCancellableBookRequestStatus(request.status)
+}
+
+/** Hiding is personal, so anyone who can see a settled request may take it off their own list. */
+export function canDismissRequest(request: BookRequestItem): boolean {
+  return isSettledBookRequestStatus(request.status)
+}
+
+/**
+ * Whether ticking this row would let the bulk bar offer anything.
+ *
+ * Selection used to mean "pending", which on a list of twenty-two settled rows rendered a column
+ * of blanks under a dead select-all box and read as a broken control. A row earns a checkbox when
+ * at least one bulk action can reach it.
+ */
+export function canBulkActRequest(request: BookRequestItem, canManage: boolean): boolean {
+  if (canManage && request.status === 'pending') return true
+  return canDismissRequest(request) && !request.dismissed
+}
+
+/**
+ * Whether the signed-in user joined this request rather than making it, and so has something to
+ * leave. The fulfiller is excluded: their subscription is what makes their own work visible to
+ * them, and the server refuses for that reason too.
+ */
+export function canLeaveRequest(request: BookRequestItem, userId: number | null): boolean {
+  if (userId === null || request.userId === userId) return false
+  if (isBookRequestFulfiller(request, userId)) return false
+  return request.subscribers.some((subscriber) => subscriber.userId === userId)
+}
+
+/** Deleting takes the row from everyone, so it is a moderator action on a settled request only. */
+export function canDeleteRequest(request: BookRequestItem, canManage: boolean): boolean {
+  return canManage && isSettledBookRequestStatus(request.status)
+}
+
+/**
+ * Whether cancelling would also stop an active transfer, which is worth warning about. Read off
+ * the attempt rather than the request: a request can sit at `searching` with nothing grabbed yet.
+ * Mirrors the in-flight statuses the server removes on.
+ */
+export function cancelStopsATransfer(request: BookRequestItem): boolean {
+  const status = request.download?.status
+  return status === 'queued' || status === 'downloading' || status === 'completed' || status === 'importing'
+}
diff --git a/client/src/features/book-requests/requestDrawerContext.ts b/client/src/features/book-requests/requestDrawerContext.ts
new file mode 100644
index 000000000..a92444a7e
--- /dev/null
+++ b/client/src/features/book-requests/requestDrawerContext.ts
@@ -0,0 +1,19 @@
+import type { InjectionKey, Ref } from 'vue'
+
+/**
+ * What the list owns and the panels inside the drawer need: where the open request sits in the
+ * queue, and how to leave. Provided rather than passed as props because the panels are rendered by
+ * a nested `RouterView`, which would have to forward the same props to both of them.
+ */
+export interface RequestDrawerContext {
+  /** 1-based position in the list as shown, or 0 when the open request is not in it. */
+  position: Ref<number>
+  total: Ref<number>
+  hasPrevious: Ref<boolean>
+  hasNext: Ref<boolean>
+  goPrevious: () => void
+  goNext: () => void
+  close: () => void
+}
+
+export const REQUEST_DRAWER: InjectionKey<RequestDrawerContext> = Symbol('request-drawer')
diff --git a/client/src/features/book-requests/requestOutcome.ts b/client/src/features/book-requests/requestOutcome.ts
new file mode 100644
index 000000000..76e0f6293
--- /dev/null
+++ b/client/src/features/book-requests/requestOutcome.ts
@@ -0,0 +1,77 @@
+import type { BookRequestItem, BookRequestProgressEvent } from '@bookorbit/types'
+import { currentRequestProgress, REQUEST_PIPELINE_STEPS, requestPipelineState } from './requestPipeline'
+
+/**
+ * What the Outcome column says about a request, which is a different question from what its status
+ * is. The status chip names the state; this names the consequence, and the two together are what
+ * the old card was spreading across a stepper, a progress block and three trailing sentences.
+ */
+export type RequestOutcomeKind = 'progress' | 'failure' | 'settled' | 'waiting'
+
+/**
+ * What went wrong, in the reader's language where the server classified it.
+ *
+ * `statusReason` is English prose written at the point of failure, and most of the paths that
+ * write it have never classified anything. Where a code is present it wins, because the prose was
+ * only ever the fallback; where it is absent the prose is all there is, and showing English beats
+ * showing nothing.
+ *
+ * `t` is injected for the same reason `formatTime` is below: this stays a pure function of the
+ * request, testable without standing up i18n.
+ */
+export function requestFailureText(
+  request: Pick<BookRequestItem, 'statusReason' | 'failureCode' | 'failureMeta'>,
+  t: (key: string, named: Record<string, unknown>) => string,
+): string | null {
+  if (request.failureCode) return t(`bookRequests.handback.${request.failureCode}`, request.failureMeta ?? {})
+  return request.statusReason
+}
+
+export interface RequestOutcome {
+  kind: RequestOutcomeKind
+  /** Key under `bookRequests.outcome`, or null when the component renders its own body. */
+  key: string | null
+  params?: Record<string, string>
+}
+
+function isTransferring(request: BookRequestItem, live: BookRequestProgressEvent | null | undefined): boolean {
+  const status = currentRequestProgress(request, live)?.status ?? request.download?.status
+  return status === 'queued' || status === 'downloading'
+}
+
+/**
+ * `formatTime` is injected rather than imported so this stays a pure function of the request: the
+ * relative formatter is locale-reactive, and a helper that reached for it directly could not be
+ * tested without standing up i18n.
+ */
+export function requestOutcome(
+  request: BookRequestItem,
+  live: BookRequestProgressEvent | null | undefined,
+  formatTime: (iso: string) => string,
+): RequestOutcome {
+  if (isTransferring(request, live) && request.download) return { kind: 'progress', key: null }
+  if (request.status === 'failed') return { kind: 'failure', key: null }
+
+  const settled = formatTime(request.updatedAt)
+
+  switch (request.status) {
+    case 'available':
+      return request.targetLibraryName
+        ? { kind: 'settled', key: 'filedIn', params: { library: request.targetLibraryName, time: settled } }
+        : { kind: 'settled', key: 'filed', params: { time: settled } }
+    case 'rejected':
+      return { kind: 'settled', key: 'rejected', params: { time: settled } }
+    case 'cancelled':
+      return { kind: 'settled', key: 'cancelled', params: { time: settled } }
+    case 'pending':
+      return { kind: 'waiting', key: 'awaitingApproval' }
+    case 'needs_review':
+      return { kind: 'waiting', key: 'awaitingReview' }
+    default: {
+      // Everything left is mid-flight with nothing transferring yet, so the useful thing to say is
+      // which stage it is sitting on rather than repeating the status chip beside it.
+      const state = requestPipelineState(request, live)
+      return { kind: 'waiting', key: `atStage.${REQUEST_PIPELINE_STEPS[state.currentIndex]}` }
+    }
+  }
+}
diff --git a/client/src/features/book-requests/requestPipeline.ts b/client/src/features/book-requests/requestPipeline.ts
new file mode 100644
index 000000000..ac5744c5d
--- /dev/null
+++ b/client/src/features/book-requests/requestPipeline.ts
@@ -0,0 +1,128 @@
+import type { BookRequestItem, BookRequestProgressEvent, BookRequestStatus } from '@bookorbit/types'
+
+/**
+ * The five stages a request actually moves through, which is not the same list as its eleven
+ * statuses: `approved` and `searching` are both "looking for a release", and `grabbed` and
+ * `downloading` are both "the client has it".
+ */
+export const REQUEST_PIPELINE_STEPS = ['asked', 'approved', 'release', 'downloading', 'filed'] as const
+export type RequestPipelineStep = (typeof REQUEST_PIPELINE_STEPS)[number]
+
+/** What the step the request is sitting on means, which drives colour and the summary sentence. */
+export type RequestPipelineTone = 'waiting' | 'progress' | 'done' | 'failed' | 'stopped'
+
+export interface RequestPipelineState {
+  /** Zero-based index into REQUEST_PIPELINE_STEPS of the stage the request is sitting on. */
+  currentIndex: number
+  tone: RequestPipelineTone
+  /** The request stopped here rather than moving on, so later steps will never light up. */
+  halted: boolean
+}
+
+const STEP_INDEX = {
+  asked: 0,
+  approved: 1,
+  release: 2,
+  downloading: 3,
+  filed: 4,
+} as const satisfies Record<RequestPipelineStep, number>
+
+const DOWNLOAD_STATUS_RANK = {
+  queued: 0,
+  downloading: 1,
+  completed: 2,
+  importing: 3,
+  needs_review: 4,
+  imported: 4,
+  failed: 4,
+} as const
+
+const TERMINAL_REQUEST_STATUSES = new Set<BookRequestStatus>(['available', 'needs_review', 'failed', 'cancelled', 'rejected'])
+
+export type RequestPipelineInput = Pick<BookRequestItem, 'status' | 'download'>
+
+/** Ignore ticks from a prior attempt and ticks made obsolete by a later fetched download row. */
+export function currentRequestProgress(
+  request: RequestPipelineInput,
+  live: BookRequestProgressEvent | null | undefined,
+): BookRequestProgressEvent | null {
+  const download = request.download
+  if (!download || !live || live.downloadId !== download.id) return null
+
+  const liveRank = DOWNLOAD_STATUS_RANK[live.status]
+  const persistedRank = DOWNLOAD_STATUS_RANK[download.status]
+  return live.status === download.status || liveRank > persistedRank ? live : null
+}
+
+/** The state all request UI should show while its persisted row catches up with live transfer events. */
+export function requestPresentationStatus(request: RequestPipelineInput, live?: BookRequestProgressEvent | null): BookRequestStatus {
+  if (TERMINAL_REQUEST_STATUSES.has(request.status)) return request.status
+
+  const downloadStatus = currentRequestProgress(request, live)?.status ?? request.download?.status
+  switch (downloadStatus) {
+    case 'downloading':
+      return 'downloading'
+    case 'completed':
+    case 'importing':
+    case 'imported':
+      return 'importing'
+    case 'needs_review':
+      return 'needs_review'
+    case 'failed':
+      return 'failed'
+    default:
+      return request.status
+  }
+}
+
+const BY_STATUS: Record<Exclude<BookRequestStatus, 'failed' | 'cancelled'>, RequestPipelineState> = {
+  pending: { currentIndex: STEP_INDEX.approved, tone: 'waiting', halted: false },
+  approved: { currentIndex: STEP_INDEX.release, tone: 'progress', halted: false },
+  searching: { currentIndex: STEP_INDEX.release, tone: 'progress', halted: false },
+  grabbed: { currentIndex: STEP_INDEX.downloading, tone: 'progress', halted: false },
+  downloading: { currentIndex: STEP_INDEX.downloading, tone: 'progress', halted: false },
+  importing: { currentIndex: STEP_INDEX.filed, tone: 'progress', halted: false },
+  needs_review: { currentIndex: STEP_INDEX.filed, tone: 'waiting', halted: false },
+  available: { currentIndex: STEP_INDEX.filed, tone: 'done', halted: false },
+  rejected: { currentIndex: STEP_INDEX.approved, tone: 'stopped', halted: true },
+}
+
+/**
+ * Where a request sits, and whether it is still moving.
+ *
+ * `failed` and `cancelled` carry no stage of their own, so the stage is read off whether a grab
+ * ever happened: a request that failed with a download behind it died in transfer, and one that
+ * failed without a download never found a release to take. Saying "failed" alone is what the
+ * current card does, and it is the least useful thing it could say.
+ */
+export function requestPipelineState(request: RequestPipelineInput, live?: BookRequestProgressEvent | null): RequestPipelineState {
+  const status = requestPresentationStatus(request, live)
+  if (status === 'failed') {
+    return { currentIndex: request.download ? STEP_INDEX.downloading : STEP_INDEX.release, tone: 'failed', halted: true }
+  }
+  if (status === 'cancelled') {
+    return { currentIndex: request.download ? STEP_INDEX.downloading : STEP_INDEX.approved, tone: 'stopped', halted: true }
+  }
+  return BY_STATUS[status]
+}
+
+/**
+ * Whether drawing the five steps tells the reader anything.
+ *
+ * A finished request renders as five filled nodes reading "Filed" at the end, which is the status
+ * chip again in forty times the space. A cancelled or rejected one is the same. The stepper earns
+ * its room only while the request is still moving, or when it stopped somewhere worth naming.
+ */
+export function requestPipelineIsInformative(state: RequestPipelineState): boolean {
+  return state.tone !== 'done' && state.tone !== 'stopped'
+}
+
+export type RequestStepState = 'done' | 'current' | 'upcoming'
+
+/** `available` is the one status where the final step is behind the request rather than under it. */
+export function requestStepState(state: RequestPipelineState, index: number): RequestStepState {
+  if (state.tone === 'done') return 'done'
+  if (index < state.currentIndex) return 'done'
+  if (index === state.currentIndex) return 'current'
+  return 'upcoming'
+}
diff --git a/client/src/features/book-requests/sourceColors.ts b/client/src/features/book-requests/sourceColors.ts
new file mode 100644
index 000000000..bc154649e
--- /dev/null
+++ b/client/src/features/book-requests/sourceColors.ts
@@ -0,0 +1,61 @@
+import { INDEXER_COLORS, type IndexerColor } from '@bookorbit/types'
+
+/**
+ * Written out rather than built from the slug, because Tailwind reads these files as text: a class
+ * assembled at runtime is a class that was never generated. Every string here is a literal for
+ * that reason, and the token behind it is tuned per theme in `assets/theme/tokens.css`.
+ */
+const CHIP_CLASSES: Record<IndexerColor, string> = {
+  blue: 'border-[var(--pill-source-blue)]/40 bg-[var(--pill-source-blue)]/10 text-[var(--pill-source-blue)]',
+  indigo: 'border-[var(--pill-source-indigo)]/40 bg-[var(--pill-source-indigo)]/10 text-[var(--pill-source-indigo)]',
+  purple: 'border-[var(--pill-source-purple)]/40 bg-[var(--pill-source-purple)]/10 text-[var(--pill-source-purple)]',
+  pink: 'border-[var(--pill-source-pink)]/40 bg-[var(--pill-source-pink)]/10 text-[var(--pill-source-pink)]',
+  red: 'border-[var(--pill-source-red)]/40 bg-[var(--pill-source-red)]/10 text-[var(--pill-source-red)]',
+  orange: 'border-[var(--pill-source-orange)]/40 bg-[var(--pill-source-orange)]/10 text-[var(--pill-source-orange)]',
+  yellow: 'border-[var(--pill-source-yellow)]/40 bg-[var(--pill-source-yellow)]/10 text-[var(--pill-source-yellow)]',
+  lime: 'border-[var(--pill-source-lime)]/40 bg-[var(--pill-source-lime)]/10 text-[var(--pill-source-lime)]',
+  green: 'border-[var(--pill-source-green)]/40 bg-[var(--pill-source-green)]/10 text-[var(--pill-source-green)]',
+  teal: 'border-[var(--pill-source-teal)]/40 bg-[var(--pill-source-teal)]/10 text-[var(--pill-source-teal)]',
+}
+
+const DOT_CLASSES: Record<IndexerColor, string> = {
+  blue: 'bg-[var(--pill-source-blue)]',
+  indigo: 'bg-[var(--pill-source-indigo)]',
+  purple: 'bg-[var(--pill-source-purple)]',
+  pink: 'bg-[var(--pill-source-pink)]',
+  red: 'bg-[var(--pill-source-red)]',
+  orange: 'bg-[var(--pill-source-orange)]',
+  yellow: 'bg-[var(--pill-source-yellow)]',
+  lime: 'bg-[var(--pill-source-lime)]',
+  green: 'bg-[var(--pill-source-green)]',
+  teal: 'bg-[var(--pill-source-teal)]',
+}
+
+/**
+ * Protocol is not the operator's to assign: whether a grab joins a swarm or pulls a file decides
+ * what happens next, and it reads the same on every install.
+ */
+const PROTOCOL_CLASSES = {
+  torrent: 'border-[var(--pill-torrent)]/40 bg-[var(--pill-torrent)]/10 text-[var(--pill-torrent)]',
+  direct: 'border-[var(--pill-direct)]/40 bg-[var(--pill-direct)]/10 text-[var(--pill-direct)]',
+} as const
+
+/** What an uncoloured source wears, which is what every source wore before colours existed. */
+const NEUTRAL_CHIP = 'border-border text-muted-foreground'
+
+/** A value straight off the wire: a row written by a newer build can name a hue this one lacks. */
+export function isIndexerColor(value: unknown): value is IndexerColor {
+  return typeof value === 'string' && (INDEXER_COLORS as readonly string[]).includes(value)
+}
+
+export function sourceChipClass(color: IndexerColor | null | undefined): string {
+  return isIndexerColor(color) ? CHIP_CLASSES[color] : NEUTRAL_CHIP
+}
+
+export function sourceDotClass(color: IndexerColor | null | undefined): string {
+  return isIndexerColor(color) ? DOT_CLASSES[color] : 'bg-muted-foreground/40'
+}
+
+export function protocolChipClass(seedsBack: boolean): string {
+  return seedsBack ? PROTOCOL_CLASSES.torrent : PROTOCOL_CLASSES.direct
+}
diff --git a/client/src/features/book/composables/__tests__/useMetadataSearch.spec.ts b/client/src/features/book/composables/__tests__/useMetadataSearch.spec.ts
index b527d0820..6882b1f18 100644
--- a/client/src/features/book/composables/__tests__/useMetadataSearch.spec.ts
+++ b/client/src/features/book/composables/__tests__/useMetadataSearch.spec.ts
@@ -20,8 +20,14 @@ describe('useMetadataSearch', () => {
     apiMock.mockReset()
   })
 
-  function provider(key: MetadataProviderKey, selectedByFieldRules?: boolean): MetadataProviderInfo {
-    return { key, label: key, identifiable: true, ...(selectedByFieldRules !== undefined ? { selectedByFieldRules } : {}) }
+  function provider(key: MetadataProviderKey, selectedByFieldRules?: boolean, coverPriority?: number): MetadataProviderInfo {
+    return {
+      key,
+      label: key,
+      identifiable: true,
+      ...(selectedByFieldRules !== undefined ? { selectedByFieldRules } : {}),
+      ...(coverPriority !== undefined ? { coverPriority } : {}),
+    }
   }
 
   function candidate(providerKey: MetadataProviderKey, providerId: string): MetadataCandidate {
@@ -112,6 +118,24 @@ describe('useMetadataSearch', () => {
     })
   })
 
+  it('exposes the configured cover provider order independently of registry order', async () => {
+    apiMock.mockResolvedValue({
+      ok: true,
+      json: async () => [
+        provider(MetadataProviderKey.GOOGLE, undefined, 2),
+        provider(MetadataProviderKey.OPEN_LIBRARY, undefined, 1),
+        provider(MetadataProviderKey.AMAZON, undefined, 0),
+      ],
+    })
+
+    const scope = effectScope()
+    const state = scope.run(() => useMetadataSearch())!
+    await state.loadProviders()
+    scope.stop()
+
+    expect(state.coverProviderOrder.value).toEqual([MetadataProviderKey.AMAZON, MetadataProviderKey.OPEN_LIBRARY, MetadataProviderKey.GOOGLE])
+  })
+
   it('includes bookId in metadata stream searches', async () => {
     apiMock.mockResolvedValue({ ok: false })
 
diff --git a/client/src/features/book/composables/useMetadataSearch.ts b/client/src/features/book/composables/useMetadataSearch.ts
index 70102bddf..569c2d715 100644
--- a/client/src/features/book/composables/useMetadataSearch.ts
+++ b/client/src/features/book/composables/useMetadataSearch.ts
@@ -2,6 +2,7 @@ import { computed, onUnmounted, reactive, ref } from 'vue'
 import { api } from '@/lib/api'
 import { METADATA_PROVIDER_STATUS_EVENT } from '@bookorbit/types'
 import type {
+  ConcreteBookMediaKind,
   MetadataCandidate,
   MetadataProviderInfo,
   MetadataProviderKey,
@@ -15,6 +16,8 @@ export interface SearchParams {
   isbn?: string
   bookId?: number
   isAudiobook?: boolean
+  /** Narrows the search to the providers that serve one medium; the server derives isAudiobook from it. */
+  mediaKind?: ConcreteBookMediaKind
 }
 
 export function useMetadataSearch() {
@@ -62,6 +65,7 @@ export function useMetadataSearch() {
     if (params.isbn) query.set('isbn', params.isbn)
     if (params.bookId != null) query.set('bookId', String(params.bookId))
     if (params.isAudiobook != null) query.set('isAudiobook', String(params.isAudiobook))
+    if (params.mediaKind) query.set('mediaKind', params.mediaKind)
     const onlyProvider = providers.value.length === 1 ? providers.value[0] : undefined
     const requestedProviders = selectedProviders.value.length ? selectedProviders.value : onlyProvider ? [onlyProvider.key] : []
     if (requestedProviders.length) query.set('providers', requestedProviders.join(','))
@@ -154,6 +158,21 @@ export function useMetadataSearch() {
     return sortResults(filtered)
   })
 
+  const coverProviderOrder = computed(() =>
+    providers.value
+      .filter((provider) => provider.coverPriority !== undefined)
+      .sort((a, b) => a.coverPriority! - b.coverPriority!)
+      .map((provider) => provider.key),
+  )
+
+  const resultProviderOrder = computed(() => {
+    const available = new Set(providers.value.map((provider) => provider.key))
+    return [
+      ...PROVIDER_ORDER.filter((provider) => available.has(provider)),
+      ...providers.value.map((provider) => provider.key).filter((provider) => !PROVIDER_ORDER.includes(provider)),
+    ]
+  })
+
   function toggleProvider(key: MetadataProviderKey) {
     const idx = selectedProviders.value.indexOf(key)
     if (idx === -1) selectedProviders.value.push(key)
@@ -184,6 +203,8 @@ export function useMetadataSearch() {
 
   return {
     filteredResults,
+    coverProviderOrder,
+    resultProviderOrder,
     providerCounts,
     providerStatuses,
     interruptedProviders,
diff --git a/client/src/features/email/components/EmailSettings.vue b/client/src/features/email/components/EmailSettings.vue
index a79b40fa1..f1a9628d2 100644
--- a/client/src/features/email/components/EmailSettings.vue
+++ b/client/src/features/email/components/EmailSettings.vue
@@ -4,7 +4,7 @@ import { useI18n } from 'vue-i18n'
 import { Permission } from '@bookorbit/types'
 import ProvidersTab from './ProvidersTab.vue'
 import SettingsTabs from '@/features/settings/components/SettingsTabs.vue'
-import { useRouteTab } from '@/features/settings/composables/useRouteTab'
+import { useRouteTab } from '@/composables/useRouteTab'
 import RecipientsTab from './RecipientsTab.vue'
 import GroupsTab from './GroupsTab.vue'
 import TemplatesTab from './TemplatesTab.vue'
diff --git a/client/src/features/notifications/components/NotificationItem.spec.ts b/client/src/features/notifications/components/NotificationItem.spec.ts
index 5ec454f45..54043e8c9 100644
--- a/client/src/features/notifications/components/NotificationItem.spec.ts
+++ b/client/src/features/notifications/components/NotificationItem.spec.ts
@@ -1,39 +1,92 @@
 import { mount } from '@vue/test-utils'
-import { describe, expect, it } from 'vitest'
+import { describe, expect, it, vi } from 'vitest'
 import { createI18n } from 'vue-i18n'
 import { createMemoryHistory, createRouter } from 'vue-router'
 
-import type { NotificationItem } from '@bookorbit/types'
+import { NotificationType, type NotificationItem } from '@bookorbit/types'
 import en from '@/locales/en.json'
 import NotificationItemVue from './NotificationItem.vue'
 
+function notification(overrides: Partial<NotificationItem> = {}): NotificationItem {
+  return {
+    id: 1,
+    type: NotificationType.BookRequestSubmitted,
+    title: 'New book request',
+    message: 'Reader requested "Dune"',
+    actionUrl: '/requests',
+    meta: { requestId: 42 },
+    read: false,
+    count: 1,
+    createdAt: '2026-08-21T00:00:00.000Z',
+    updatedAt: '2026-08-21T00:00:00.000Z',
+    ...overrides,
+  }
+}
+
+async function mountItem(item: NotificationItem) {
+  const router = createRouter({
+    history: createMemoryHistory(),
+    routes: [
+      { path: '/', component: { template: '<div />' } },
+      { path: '/requests', component: { template: '<div />' } },
+    ],
+  })
+  await router.push('/')
+  await router.isReady()
+  const i18n = createI18n({ legacy: false, locale: 'en', fallbackLocale: 'en', messages: { en } })
+
+  const wrapper = mount(NotificationItemVue, {
+    props: { notification: item },
+    global: { plugins: [router, i18n] },
+  })
+
+  return { router, wrapper }
+}
+
 describe('NotificationItem', () => {
   it('renders a persisted notification type that is no longer in the registry', async () => {
-    const router = createRouter({
-      history: createMemoryHistory(),
-      routes: [{ path: '/', component: { template: '<div />' } }],
-    })
-    await router.push('/')
-    await router.isReady()
-    const i18n = createI18n({ legacy: false, locale: 'en', fallbackLocale: 'en', messages: { en } })
-    const notification: NotificationItem = {
-      id: 1,
-      type: 'legacy_notification_type' as NotificationItem['type'],
-      title: 'Legacy notification',
-      message: null,
-      actionUrl: null,
-      meta: null,
-      read: false,
-      count: 1,
-      createdAt: '2026-01-01T00:00:00.000Z',
-      updatedAt: '2026-01-01T00:00:00.000Z',
-    }
-
-    const wrapper = mount(NotificationItemVue, {
-      props: { notification },
-      global: { plugins: [router, i18n] },
-    })
+    const { wrapper } = await mountItem(
+      notification({
+        type: 'legacy_notification_type' as NotificationItem['type'],
+        title: 'Legacy notification',
+        message: null,
+        actionUrl: null,
+        meta: null,
+      }),
+    )
 
     expect(wrapper.text()).toContain('Legacy notification')
   })
+
+  /**
+   * The stored URL verbatim, query and all. The tab used to be re-derived here from the type,
+   * which was a second copy of a decision the server had already made and sent.
+   */
+  it('follows the action URL the server stored, including its query', async () => {
+    const { router, wrapper } = await mountItem(notification({ actionUrl: '/requests?tab=all' }))
+    const push = vi.spyOn(router, 'push')
+
+    await wrapper.findAll('button')[0].trigger('click')
+
+    expect(push).toHaveBeenCalledExactlyOnceWith('/requests?tab=all')
+  })
+
+  it.each([
+    [NotificationType.BookRequestSubmitted, 'text-success'],
+    [NotificationType.BookRequestRejected, 'text-warning'],
+    [NotificationType.BookRequestFailed, 'text-destructive'],
+  ])('renders %s with the request icon and its registered severity', async (type, severityClass) => {
+    const { wrapper } = await mountItem(notification({ type }))
+
+    expect(wrapper.find('.lucide-book-plus').exists()).toBe(true)
+    expect(wrapper.find('.lucide-book-plus').classes()).toContain(severityClass)
+  })
+
+  it('exposes separate native controls for opening and dismissing the notification', async () => {
+    const { wrapper } = await mountItem(notification())
+
+    expect(wrapper.findAll('button')).toHaveLength(2)
+    expect(wrapper.find('button[aria-label="Dismiss notification"]').exists()).toBe(true)
+    expect(wrapper.findAll('button')[0].element.tagName).toBe('BUTTON')
+  })
 })
diff --git a/client/src/features/notifications/components/NotificationItem.vue b/client/src/features/notifications/components/NotificationItem.vue
index cda7e5ebb..7f108263d 100644
--- a/client/src/features/notifications/components/NotificationItem.vue
+++ b/client/src/features/notifications/components/NotificationItem.vue
@@ -44,11 +44,12 @@ function handleClick() {
   if (!props.notification.read) {
     emit('read', props.notification.id)
   }
-  if (props.notification.actionUrl) {
-    if (props.notification.actionUrl.startsWith('/')) {
-      router.push(props.notification.actionUrl)
+  const actionUrl = props.notification.actionUrl
+  if (actionUrl) {
+    if (actionUrl.startsWith('/')) {
+      router.push(actionUrl)
     } else {
-      window.open(props.notification.actionUrl, '_blank')
+      window.open(actionUrl, '_blank')
     }
   }
 }
@@ -60,57 +61,56 @@ function handleDismiss(e: Event) {
 </script>
 
 <template>
-  <div
-    class="group relative flex w-full cursor-pointer items-start gap-3 rounded-lg border px-3 py-3 text-left transition-all hover:shadow-sm"
-    :class="
-      notification.read
-        ? 'border-border/30 bg-muted/20 hover:border-border/50 hover:bg-muted/40'
-        : 'border-border/60 bg-card shadow-sm hover:bg-muted/30'
-    "
-    role="button"
-    tabindex="0"
-    @click="handleClick"
-    @keydown.enter="handleClick"
-    @keydown.space.prevent="handleClick"
-  >
-    <div class="relative mt-0.5 shrink-0">
-      <div
-        class="flex items-center justify-center rounded-lg p-1.5"
-        :class="isFailed ? 'bg-destructive/10' : isWarning ? 'bg-amber-500/10' : 'bg-green-500/10'"
-      >
-        <component :is="icon" :size="15" :class="isFailed ? 'text-destructive' : isWarning ? 'text-amber-500' : 'text-green-500'" />
-      </div>
-      <span v-if="!notification.read" class="absolute -right-1 -top-1 h-2 w-2 rounded-full bg-primary ring-2 ring-background" />
-    </div>
-
-    <div class="min-w-0 flex-1">
-      <div class="flex items-start justify-between gap-2">
-        <p class="truncate text-sm leading-tight" :class="notification.read ? 'text-foreground' : 'font-semibold text-foreground'">
-          {{ notification.title }}
-        </p>
-        <div class="flex shrink-0 items-center gap-1.5">
-          <span
-            v-if="occurrences > 1"
-            class="rounded-full bg-muted px-1.5 py-0.5 text-[10px] font-semibold tabular-nums text-muted-foreground"
-            :aria-label="$t('notifications.occurrences', { count: occurrences })"
-          >
-            {{ $t('notifications.occurrencesShort', { count: occurrences }) }}
-          </span>
-          <span class="text-[11px] text-muted-foreground">{{ relativeTime }}</span>
+  <div class="group relative">
+    <button
+      type="button"
+      class="flex w-full cursor-pointer items-start gap-3 rounded-lg border px-3 py-3 pr-10 text-left transition-all hover:shadow-sm focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
+      :class="
+        notification.read
+          ? 'border-border/30 bg-muted/20 hover:border-border/50 hover:bg-muted/40'
+          : 'border-border/60 bg-card shadow-sm hover:bg-muted/30'
+      "
+      @click="handleClick"
+    >
+      <div class="relative mt-0.5 shrink-0">
+        <div
+          class="flex items-center justify-center rounded-lg p-1.5"
+          :class="isFailed ? 'bg-destructive/10' : isWarning ? 'bg-warning/10' : 'bg-success/10'"
+        >
+          <component :is="icon" :size="15" :class="isFailed ? 'text-destructive' : isWarning ? 'text-warning' : 'text-success'" />
         </div>
+        <span v-if="!notification.read" class="absolute -right-1 -top-1 h-2 w-2 rounded-full bg-primary ring-2 ring-background" />
       </div>
-      <p v-if="notification.message" class="mt-1 text-xs text-muted-foreground truncate">
-        {{ notification.message }}
-      </p>
-    </div>
+
+      <div class="min-w-0 flex-1">
+        <div class="flex items-start justify-between gap-2">
+          <p class="truncate text-sm leading-tight" :class="notification.read ? 'text-foreground' : 'font-semibold text-foreground'">
+            {{ notification.title }}
+          </p>
+          <div class="flex shrink-0 items-center gap-1.5">
+            <span
+              v-if="occurrences > 1"
+              class="rounded-full bg-muted px-1.5 py-0.5 text-[10px] font-semibold tabular-nums text-muted-foreground"
+              :aria-label="$t('notifications.occurrences', { count: occurrences })"
+            >
+              {{ $t('notifications.occurrencesShort', { count: occurrences }) }}
+            </span>
+            <span class="text-[11px] text-muted-foreground">{{ relativeTime }}</span>
+          </div>
+        </div>
+        <p v-if="notification.message" class="mt-1 truncate text-xs text-muted-foreground">
+          {{ notification.message }}
+        </p>
+      </div>
+    </button>
 
     <button
       type="button"
       :aria-label="$t('notifications.dismiss')"
-      class="mt-0.5 shrink-0 rounded-md p-1 text-muted-foreground opacity-0 transition-opacity hover:bg-muted hover:text-foreground focus-visible:opacity-100 group-hover:opacity-100"
+      class="absolute right-2 top-2 rounded-md p-1 text-muted-foreground opacity-0 transition-opacity hover:bg-muted hover:text-foreground focus-visible:opacity-100 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring group-hover:opacity-100"
       @click="handleDismiss"
     >
-      <X :size="14" />
+      <X :size="14" aria-hidden="true" />
     </button>
   </div>
 </template>
diff --git a/client/src/features/notifications/lib/notification-category-groups.ts b/client/src/features/notifications/lib/notification-category-groups.ts
index 62204c012..314e90838 100644
--- a/client/src/features/notifications/lib/notification-category-groups.ts
+++ b/client/src/features/notifications/lib/notification-category-groups.ts
@@ -1,10 +1,10 @@
-import { FileCog, FolderSync, HardDriveDownload, Mail, RefreshCw, ScanLine, Tags, Trophy, Users, type LucideIcon } from '@lucide/vue'
+import { BookPlus, FileCog, FolderSync, HardDriveDownload, Mail, RefreshCw, ScanLine, Tags, Trophy, Users, type LucideIcon } from '@lucide/vue'
 import type { NotificationCategory } from '@bookorbit/types'
 
 export const NOTIFICATION_CATEGORY_GROUPS = [
   { id: 'library', categories: ['scanning', 'metadata', 'authorEnrichment'] },
   { id: 'files', categories: ['fileWriteBack', 'fileRename', 'bulkRename', 'migration'] },
-  { id: 'integrations', categories: ['bookDock', 'email'] },
+  { id: 'integrations', categories: ['bookDock', 'bookRequests', 'email'] },
   { id: 'personal', categories: ['achievements'] },
 ] as const satisfies ReadonlyArray<{ id: string; categories: readonly NotificationCategory[] }>
 
@@ -17,6 +17,7 @@ export const NOTIFICATION_CATEGORY_ICONS: Record<NotificationCategory, LucideIco
   bulkRename: FileCog,
   migration: RefreshCw,
   bookDock: FolderSync,
+  bookRequests: BookPlus,
   email: Mail,
   achievements: Trophy,
 }
diff --git a/client/src/features/settings/ConnectionHealth.vue b/client/src/features/settings/ConnectionHealth.vue
new file mode 100644
index 000000000..841b5b8d3
--- /dev/null
+++ b/client/src/features/settings/ConnectionHealth.vue
@@ -0,0 +1,56 @@
+<script setup lang="ts">
+import { computed } from 'vue'
+import { useI18n } from 'vue-i18n'
+import { Check, TriangleAlert } from '@lucide/vue'
+import { formatDateTime, formatRelativeFromNow } from '@/i18n/formatters'
+
+const props = defineProps<{
+  lastTestedAt: string | null
+  lastTestOk: boolean | null
+  enabled: boolean
+}>()
+
+const { t } = useI18n()
+
+type Health = 'ok' | 'failed' | 'untested' | 'disabled'
+
+const TONES: Record<Health, string> = {
+  ok: 'border-success/40 bg-success/10 text-success',
+  failed: 'border-destructive/40 bg-destructive/10 text-destructive',
+  untested: 'border-border bg-muted text-muted-foreground',
+  disabled: 'border-border bg-muted text-muted-foreground',
+}
+
+/** Disabled outranks a stale green: a connection nobody will call is not "connected". */
+const health = computed<Health>(() => {
+  if (!props.enabled) return 'disabled'
+  if (props.lastTestedAt === null) return 'untested'
+  return props.lastTestOk ? 'ok' : 'failed'
+})
+
+const label = computed(() => t(`settings.system.requests.health.${health.value}`))
+
+/**
+ * "failed 6 minutes ago" beats a timestamp buried in a sentence: recency is the whole point of
+ * the fact, and the exact moment is one hover away.
+ */
+const relative = computed(() => (props.lastTestedAt === null ? null : formatRelativeFromNow(new Date(props.lastTestedAt))))
+const exact = computed(() => (props.lastTestedAt === null ? undefined : formatDateTime(new Date(props.lastTestedAt))))
+const testedLabel = computed(() =>
+  health.value === 'failed'
+    ? t('settings.system.requests.health.failedAt', { time: relative.value ?? '' })
+    : t('settings.system.requests.health.testedAt', { time: relative.value ?? '' }),
+)
+</script>
+
+<template>
+  <span class="inline-flex items-center gap-1.5">
+    <span class="inline-flex h-[22px] items-center gap-1.5 rounded-full border px-2 text-xs font-medium whitespace-nowrap" :class="TONES[health]">
+      <Check v-if="health === 'ok'" :size="12" :stroke-width="2.5" aria-hidden="true" />
+      <TriangleAlert v-else-if="health === 'failed'" :size="12" aria-hidden="true" />
+      <span v-else class="size-1.5 rounded-full bg-current" aria-hidden="true" />
+      {{ label }}
+    </span>
+    <span v-if="relative" class="text-xs text-muted-foreground" :title="exact">{{ testedLabel }}</span>
+  </span>
+</template>
diff --git a/client/src/features/settings/DownloadClientsPanel.vue b/client/src/features/settings/DownloadClientsPanel.vue
new file mode 100644
index 000000000..679941c5f
--- /dev/null
+++ b/client/src/features/settings/DownloadClientsPanel.vue
@@ -0,0 +1,854 @@
+<script setup lang="ts">
+import { computed, onMounted, reactive, ref, watch } from 'vue'
+import { useI18n } from 'vue-i18n'
+import { Download, Link2, Loader2, Pencil, Plug, Plus, RefreshCw, Trash2, TriangleAlert } from '@lucide/vue'
+import { toast } from 'vue-sonner'
+import { DOWNLOAD_CLIENT_TYPES } from '@bookorbit/types'
+import type {
+  CreateDownloadClientPayload,
+  DownloadClientItem,
+  DownloadClientReconciliationAttempt,
+  DownloadClientReconciliationItem,
+  DownloadClientType,
+  IndexerColor,
+} from '@bookorbit/types'
+import { Button } from '@/components/ui/button'
+import ConfirmDialog from '@/components/ui/ConfirmDialog.vue'
+import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from '@/components/ui/tooltip'
+import ConnectionHealth from './ConnectionHealth.vue'
+import AdapterTypePicker, { type AdapterTypeOption } from './components/AdapterTypePicker.vue'
+import SettingsEditorSheet from './components/SettingsEditorSheet.vue'
+import SettingsEmptyPanel from './components/SettingsEmptyPanel.vue'
+import SettingsField from './components/SettingsField.vue'
+import SettingsSection from './components/SettingsSection.vue'
+import SettingsToggleField from './components/SettingsToggleField.vue'
+import SourceColorPicker from './components/SourceColorPicker.vue'
+import { useSettingsDraft } from './composables/useSettingsDraft'
+import { SECRET_INPUT_ATTRS } from '@/lib/secret-input'
+import { useDownloadClients, type DownloadClientFailure } from '@/features/book-requests/composables/useDownloadClients'
+import { sourceDotClass } from '@/features/book-requests/sourceColors'
+
+interface MappingDraft {
+  remotePath: string
+  localPath: string
+}
+
+interface ClientDraft {
+  id: number | null
+  name: string
+  color: IndexerColor | null
+  adapterType: DownloadClientType
+  baseUrl: string
+  username: string
+  password: string
+  /** Only sent when the operator actually typed one, so editing does not wipe a stored secret. */
+  passwordTouched: boolean
+  passwordCleared: boolean
+  enabled: boolean
+  priority: number
+  category: string
+  useHardlinks: boolean
+  allowPrivateAddress: boolean
+  pathMappings: MappingDraft[]
+}
+
+/** The fields a save can be rejected for, so the diagnosis lands on the box that caused it. */
+type FieldKey = 'name' | 'baseUrl' | 'password' | 'mappings'
+
+const { t } = useI18n()
+
+/** Reported upwards so the page states the instance-level encryption fact once, not per panel. */
+const emit = defineEmits<{ encryptionState: [configured: boolean] }>()
+
+const {
+  clients,
+  encryptionConfigured,
+  loading,
+  saving,
+  loadFailed,
+  reconciliation,
+  reconcilingIds,
+  fetchClients,
+  save,
+  remove,
+  test,
+  testPathMapping,
+  reconcile,
+  adopt,
+  removeOrphan,
+} = useDownloadClients()
+
+watch(encryptionConfigured, (configured) => emit('encryptionState', configured))
+
+const { draft, open: editorOpen, isDirty, start: startDraft, markPristine, close: closeDraft } = useSettingsDraft<ClientDraft>()
+/** The create flow starts on the type picker, because the type decides what the form even asks. */
+const pickingType = ref(false)
+const testingId = ref<number | null>(null)
+const passwordVisible = ref(false)
+const hardlinkResults = reactive<Record<string, string>>({})
+const fieldErrors = reactive<Partial<Record<FieldKey, string>>>({})
+const pendingOrphanRemoval = ref<{ clientId: number; infoHash: string; name: string } | null>(null)
+
+/**
+ * Server codes carry the copy; the English `message` is a last resort for anything unmapped, which
+ * beats swallowing a diagnosis the operator needs to act on.
+ */
+const SAVE_ERROR_KEYS: Record<string, string> = {
+  DOWNLOAD_CLIENT_NAME_TAKEN: 'settings.system.requests.errors.nameTaken',
+  DOWNLOAD_CLIENT_URL_UNSAFE: 'settings.system.requests.errors.urlUnsafe',
+  DOWNLOAD_CLIENT_URL_PRIVATE: 'settings.system.requests.errors.urlPrivate',
+  REQUEST_ENCRYPTION_KEY_MISSING: 'settings.system.requests.errors.encryptionKeyMissing',
+  REQUEST_ENCRYPTION_KEY_CHANGED: 'settings.system.requests.errors.encryptionKeyChanged',
+  DOWNLOAD_CLIENT_PATH_NOT_ABSOLUTE: 'settings.system.requests.errors.pathNotAbsolute',
+  DOWNLOAD_CLIENT_MAPPING_REQUIRED: 'settings.system.requests.errors.mappingRequired',
+  DOWNLOAD_CLIENT_RECONCILIATION_UNSUPPORTED: 'settings.system.requests.reconciliation.unsupported',
+  DOWNLOAD_CLIENT_RECONCILIATION_NOT_ORPHAN: 'settings.system.requests.reconciliation.notOrphan',
+  DOWNLOAD_CLIENT_RECONCILIATION_NOT_ADOPTABLE: 'settings.system.requests.reconciliation.notAdoptable',
+}
+
+/** Which box a rejection belongs under. Anything unmapped stays a toast, rather than nowhere. */
+const SAVE_ERROR_FIELDS: Record<string, FieldKey> = {
+  DOWNLOAD_CLIENT_NAME_TAKEN: 'name',
+  DOWNLOAD_CLIENT_URL_UNSAFE: 'baseUrl',
+  DOWNLOAD_CLIENT_URL_PRIVATE: 'baseUrl',
+  REQUEST_ENCRYPTION_KEY_MISSING: 'password',
+  REQUEST_ENCRYPTION_KEY_CHANGED: 'password',
+  DOWNLOAD_CLIENT_PATH_NOT_ABSOLUTE: 'mappings',
+  DOWNLOAD_CLIENT_MAPPING_REQUIRED: 'mappings',
+}
+
+function describeFailure(failure: DownloadClientFailure): string {
+  const key = failure.errorCode ? SAVE_ERROR_KEYS[failure.errorCode] : undefined
+  if (key) return t(key)
+  return failure.message ?? t('settings.system.requests.errors.saveFailed')
+}
+
+onMounted(fetchClients)
+
+function emptyDraft(adapterType: DownloadClientType): ClientDraft {
+  return {
+    id: null,
+    name: '',
+    color: null,
+    adapterType,
+    baseUrl: '',
+    username: '',
+    password: '',
+    passwordTouched: false,
+    passwordCleared: false,
+    enabled: true,
+    priority: 1,
+    category: 'bookorbit',
+    useHardlinks: true,
+    allowPrivateAddress: true,
+    // One row to fill in rather than none: a mapping is required, and starting with an empty
+    // section reads as optional right up until the save is refused.
+    pathMappings: [{ remotePath: '', localPath: '' }],
+  }
+}
+
+function openDraft(next: ClientDraft) {
+  startDraft(next)
+  passwordVisible.value = false
+  clearFieldErrors()
+}
+
+function startCreate() {
+  pickingType.value = hasTypeChoice
+  openDraft(emptyDraft('qbittorrent'))
+}
+
+function startEdit(client: DownloadClientItem) {
+  pickingType.value = false
+  openDraft({
+    id: client.id,
+    name: client.name,
+    color: client.color,
+    adapterType: client.adapterType,
+    baseUrl: client.baseUrl,
+    username: client.username ?? '',
+    password: '',
+    passwordTouched: false,
+    passwordCleared: false,
+    enabled: client.enabled,
+    priority: client.priority,
+    category: client.category,
+    useHardlinks: client.useHardlinks,
+    allowPrivateAddress: client.allowPrivateAddress,
+    pathMappings: client.pathMappings.map((mapping) => ({ remotePath: mapping.remotePath, localPath: mapping.localPath })),
+  })
+}
+
+function cancelEdit() {
+  closeDraft()
+  pickingType.value = false
+  clearFieldErrors()
+}
+
+function clearFieldErrors() {
+  for (const key of Object.keys(fieldErrors) as FieldKey[]) delete fieldErrors[key]
+}
+
+function handleNameInput() {
+  delete fieldErrors.name
+}
+
+function handleBaseUrlInput() {
+  delete fieldErrors.baseUrl
+}
+
+function markPasswordTouched() {
+  if (!draft.value) return
+  draft.value.passwordTouched = draft.value.password.length > 0
+  draft.value.passwordCleared = false
+  delete fieldErrors.password
+}
+
+const canClearPassword = computed(() => editingClient.value?.hasPassword === true)
+
+function toggleClearPassword() {
+  const current = draft.value
+  if (!current) return
+  current.passwordCleared = !current.passwordCleared
+  if (current.passwordCleared) {
+    current.password = ''
+    current.passwordTouched = false
+  }
+  delete fieldErrors.password
+}
+
+function togglePasswordVisible() {
+  passwordVisible.value = !passwordVisible.value
+}
+
+/**
+ * A choice between one thing is not a choice. Every client listed here is somebody else's program
+ * that has to be reached over the network, so the picker only earns its step once there are
+ * several; with one it goes straight to the form.
+ */
+const hasTypeChoice = DOWNLOAD_CLIENT_TYPES.length > 1
+
+const typeOptions = computed<AdapterTypeOption[]>(() =>
+  DOWNLOAD_CLIENT_TYPES.map((type) => ({
+    type,
+    label: t(`settings.system.requests.clientTypes.${type}`),
+    description: t(`settings.system.requests.clientTypeDescriptions.${type}`),
+    builtIn: false,
+  })),
+)
+
+function handleTypePicked(type: string) {
+  if (draft.value) draft.value.adapterType = type as DownloadClientType
+}
+
+/** Leaves the picker for the form the chosen client actually needs. */
+function confirmType() {
+  pickingType.value = false
+  markPristine()
+}
+
+function addMapping() {
+  draft.value?.pathMappings.push({ remotePath: '', localPath: '' })
+  delete fieldErrors.mappings
+}
+
+function removeMapping(index: number) {
+  draft.value?.pathMappings.splice(index, 1)
+  delete fieldErrors.mappings
+}
+
+/** What the server will actually store, which is what both the save and its validation act on. */
+function filledMappings(current: ClientDraft): MappingDraft[] {
+  return current.pathMappings
+    .filter((mapping) => mapping.remotePath.trim() && mapping.localPath.trim())
+    .map((mapping) => ({ remotePath: mapping.remotePath.trim(), localPath: mapping.localPath.trim() }))
+}
+
+function toPayload(current: ClientDraft): CreateDownloadClientPayload {
+  return {
+    name: current.name.trim(),
+    color: current.color,
+    adapterType: current.adapterType,
+    baseUrl: current.baseUrl.trim(),
+    username: current.username.trim(),
+    ...(current.passwordCleared ? { password: '' } : current.passwordTouched ? { password: current.password } : {}),
+    enabled: current.enabled,
+    priority: current.priority,
+    category: current.category.trim(),
+    useHardlinks: current.useHardlinks,
+    allowPrivateAddress: current.allowPrivateAddress,
+    pathMappings: filledMappings(current),
+  }
+}
+
+const editingClient = computed(() => (draft.value?.id === null ? null : (clients.value.find((row) => row.id === draft.value?.id) ?? null)))
+
+const sheetTitle = computed(() => {
+  if (draft.value === null) return ''
+  if (pickingType.value) return t('settings.system.requests.addClient')
+  return draft.value.id === null ? t('settings.system.requests.addClient') : draft.value.name || t('settings.system.requests.editClient')
+})
+
+async function handleSave() {
+  const current = draft.value
+  if (!current) return
+
+  clearFieldErrors()
+  if (!current.name.trim()) fieldErrors.name = t('settings.system.requests.errors.nameRequired')
+  if (!current.baseUrl.trim()) fieldErrors.baseUrl = t('settings.system.requests.errors.urlRequired')
+  if (filledMappings(current).length === 0) fieldErrors.mappings = t('settings.system.requests.errors.mappingRequired')
+  if (Object.keys(fieldErrors).length > 0) return
+
+  const failure = await save(current.id, toPayload(current))
+  if (failure) {
+    const field = failure.errorCode ? SAVE_ERROR_FIELDS[failure.errorCode] : undefined
+    if (field) fieldErrors[field] = describeFailure(failure)
+    else toast.error(describeFailure(failure))
+    return
+  }
+  toast.success(t('settings.system.requests.saved'))
+  cancelEdit()
+}
+
+async function handleDelete() {
+  const client = editingClient.value
+  if (!client) return
+
+  const removed = await remove(client.id)
+  if (!removed) {
+    toast.error(t('settings.system.requests.errors.deleteFailed'))
+    return
+  }
+  toast.success(t('settings.system.requests.deleted'))
+  if (draft.value?.id === client.id) cancelEdit()
+}
+
+async function handleTest(client: DownloadClientItem) {
+  testingId.value = client.id
+  try {
+    const result = await test(client.id)
+    const clientLabel = t(`settings.system.requests.clientTypes.${client.adapterType}`)
+    // A separate message rather than an empty placeholder: interpolating "" leaves the trailing
+    // space the version would have followed, and a message ending in a space reads as truncated.
+    if (result.success)
+      toast.success(
+        result.version
+          ? t('settings.system.requests.testOk', { client: clientLabel, version: result.version })
+          : t('settings.system.requests.testOkNoVersion', { client: clientLabel }),
+      )
+    else toast.error(result.error ?? t('settings.system.requests.errors.testFailed'))
+  } finally {
+    testingId.value = null
+  }
+}
+
+const testLabel = computed(() => (isDirty.value ? t('settings.system.requests.testSaveFirst') : t('settings.system.requests.test')))
+
+function handleTestCurrent() {
+  const client = editingClient.value
+  if (client && !isDirty.value) void handleTest(client)
+}
+
+async function handleHardlinkTest(client: DownloadClientItem, mappingId: number) {
+  const key = `${client.id}:${mappingId}`
+  hardlinkResults[key] = t('settings.system.requests.hardlink.checking')
+  const result = await testPathMapping(client.id, mappingId)
+
+  if (result.error) hardlinkResults[key] = result.error
+  else if (!result.localPathExists) hardlinkResults[key] = t('settings.system.requests.hardlink.localMissing')
+  else if (!result.bookDockPathExists) hardlinkResults[key] = t('settings.system.requests.hardlink.dockMissing')
+  else if (result.hardlinkWorks) hardlinkResults[key] = t('settings.system.requests.hardlink.works')
+  else if (result.failure) hardlinkResults[key] = t(`settings.system.requests.hardlink.${result.failure}`, { code: result.errorCode ?? '' })
+  else hardlinkResults[key] = t('settings.system.requests.hardlink.unavailable')
+}
+
+function hardlinkResultFor(client: DownloadClientItem, mappingId: number): string | undefined {
+  return hardlinkResults[`${client.id}:${mappingId}`]
+}
+
+function reconciliationIssues(clientId: number): DownloadClientReconciliationItem[] {
+  return (reconciliation.value[clientId]?.items ?? []).filter(
+    (item) => item.trackedAttempt === null || item.trackedAttempt.status === 'failed' || item.adoptableAttempts.length > 0,
+  )
+}
+
+async function handleReconcile(client: DownloadClientItem) {
+  const failure = await reconcile(client.id)
+  if (failure) toast.error(describeFailure(failure))
+}
+
+async function handleAdopt(client: DownloadClientItem, item: DownloadClientReconciliationItem, attempt: DownloadClientReconciliationAttempt) {
+  const failure = await adopt(client.id, item.infoHash, attempt.downloadId)
+  if (failure) toast.error(describeFailure(failure))
+  else toast.success(t('settings.system.requests.reconciliation.adopted', { title: attempt.requestTitle }))
+}
+
+function requestOrphanRemoval(client: DownloadClientItem, item: DownloadClientReconciliationItem) {
+  pendingOrphanRemoval.value = { clientId: client.id, infoHash: item.infoHash, name: item.name }
+}
+
+function cancelOrphanRemoval() {
+  pendingOrphanRemoval.value = null
+}
+
+async function confirmOrphanRemoval() {
+  const pending = pendingOrphanRemoval.value
+  if (!pending) return
+  const failure = await removeOrphan(pending.clientId, pending.infoHash)
+  if (failure) toast.error(describeFailure(failure))
+  else {
+    toast.success(t('settings.system.requests.reconciliation.removed'))
+    pendingOrphanRemoval.value = null
+  }
+}
+</script>
+
+<template>
+  <div v-if="loading" class="settings-loading-state">
+    <Loader2 class="size-5 animate-spin text-muted-foreground" />
+    <span class="sr-only">{{ t('settings.system.requests.loading') }}</span>
+  </div>
+
+  <div v-else class="space-y-4">
+    <p v-if="loadFailed" role="alert" class="text-sm text-destructive">{{ t('settings.system.requests.errors.loadFailed') }}</p>
+
+    <!--
+      With no client at all the heading heads nothing, so the panel takes its place and says what
+      is actually missing: a direct download still works, a torrent has nowhere to go.
+    -->
+    <SettingsEmptyPanel
+      v-if="clients.length === 0"
+      :title="t('settings.system.requests.clientsEmpty.title')"
+      :body="t('settings.system.requests.clientsEmpty.body')"
+      :note="t('settings.system.requests.clientsEmpty.note')"
+    >
+      <template #icon>
+        <Download :size="18" />
+      </template>
+
+      <Button size="sm" @click="startCreate">
+        <Plus :size="15" aria-hidden="true" />
+        {{ t('settings.system.requests.addClient') }}
+      </Button>
+    </SettingsEmptyPanel>
+
+    <section v-else aria-labelledby="download-clients-heading" class="space-y-2">
+      <div class="flex items-center justify-between">
+        <h2 id="download-clients-heading" class="settings-group-label">{{ t('settings.system.requests.clients') }}</h2>
+        <Button size="sm" variant="outline" @click="startCreate">
+          <Plus :size="14" aria-hidden="true" />
+          {{ t('settings.system.requests.addClient') }}
+        </Button>
+      </div>
+
+      <ul class="space-y-2">
+        <li v-for="client in clients" :key="client.id" class="settings-card">
+          <div
+            class="px-4 py-3.5 bg-card md:px-5 md:py-4"
+            :class="client.enabled && client.lastTestOk === false ? 'rounded-[inherit] ring-1 ring-destructive/40' : ''"
+          >
+            <div class="flex flex-wrap items-start justify-between gap-3">
+              <div class="flex min-w-0 flex-1 basis-72 gap-3">
+                <span
+                  class="flex size-8 shrink-0 items-center justify-center rounded-lg"
+                  :class="client.enabled && client.lastTestOk === false ? 'bg-destructive/12 text-destructive' : 'bg-muted text-muted-foreground'"
+                  aria-hidden="true"
+                >
+                  <TriangleAlert v-if="client.enabled && client.lastTestOk === false" :size="17" />
+                  <Download v-else :size="17" />
+                </span>
+
+                <div class="min-w-0">
+                  <div class="flex flex-wrap items-center gap-2">
+                    <span
+                      v-if="client.color"
+                      class="size-2 shrink-0 rounded-full"
+                      :class="sourceDotClass(client.color)"
+                      :aria-label="t(`settings.system.requests.indexers.color.options.${client.color}`)"
+                      role="img"
+                    ></span>
+                    <p class="settings-label">{{ client.name }}</p>
+                    <ConnectionHealth :last-tested-at="client.lastTestedAt" :last-test-ok="client.lastTestOk" :enabled="client.enabled" />
+                  </div>
+
+                  <div class="mt-1 flex flex-wrap items-center gap-x-2 gap-y-1 text-xs text-muted-foreground">
+                    <span v-if="client.baseUrl" class="font-mono break-all">{{ client.baseUrl }}</span>
+                    <span v-if="client.baseUrl" class="size-[3px] rounded-full bg-border" aria-hidden="true"></span>
+                    <span>{{ client.adapterType }}</span>
+                    <span class="size-[3px] rounded-full bg-border" aria-hidden="true"></span>
+                    <span>{{ t('settings.system.requests.categoryLabel', { category: client.category }) }}</span>
+                    <span class="size-[3px] rounded-full bg-border" aria-hidden="true"></span>
+                    <span>{{ t('settings.system.requests.priorityLabel', { priority: client.priority }) }}</span>
+                  </div>
+
+                  <p v-if="client.enabled && client.lastTestOk === false && client.lastErrorMessage" class="mt-1.5 text-xs text-destructive">
+                    {{ client.lastErrorMessage }}
+                  </p>
+                </div>
+              </div>
+
+              <div class="flex shrink-0 items-center gap-1.5">
+                <Button size="sm" variant="outline" :disabled="reconcilingIds.has(client.id)" @click="handleReconcile(client)">
+                  <Loader2 v-if="reconcilingIds.has(client.id)" class="animate-spin" aria-hidden="true" />
+                  <RefreshCw v-else :size="14" aria-hidden="true" />
+                  {{ t('settings.system.requests.reconciliation.action') }}
+                </Button>
+                <Button size="sm" variant="outline" :disabled="testingId === client.id" @click="handleTest(client)">
+                  <Plug :size="14" aria-hidden="true" />
+                  {{ t('settings.system.requests.test') }}
+                </Button>
+                <Button size="sm" variant="outline" @click="startEdit(client)">
+                  <Pencil :size="14" aria-hidden="true" />
+                  <span class="sr-only">{{ t('settings.system.requests.editClientName', { name: client.name }) }}</span>
+                </Button>
+              </div>
+            </div>
+
+            <ul v-if="client.pathMappings.length" class="mt-3 space-y-2 border-t border-border pt-3">
+              <li v-for="mapping in client.pathMappings" :key="mapping.id" class="text-xs">
+                <p class="font-mono break-all text-foreground">{{ mapping.remotePath }} &rarr; {{ mapping.localPath }}</p>
+                <div class="mt-1 flex flex-wrap items-center gap-2">
+                  <Button size="sm" variant="outline" @click="handleHardlinkTest(client, mapping.id)">
+                    {{ t('settings.system.requests.hardlink.test') }}
+                  </Button>
+                  <span v-if="hardlinkResultFor(client, mapping.id)" role="status" class="text-muted-foreground">
+                    {{ hardlinkResultFor(client, mapping.id) }}
+                  </span>
+                </div>
+              </li>
+            </ul>
+
+            <div v-if="reconciliation[client.id]" class="mt-3 border-t border-border pt-3">
+              <p v-if="!reconciliation[client.id]?.supported" role="status" class="text-sm text-muted-foreground">
+                {{ t('settings.system.requests.reconciliation.unsupported') }}
+              </p>
+              <template v-else>
+                <p v-if="reconciliation[client.id]?.truncated" role="status" class="mb-2 text-sm text-warning">
+                  {{ t('settings.system.requests.reconciliation.truncated') }}
+                </p>
+                <p
+                  v-if="reconciliationIssues(client.id).length === 0 && reconciliation[client.id]?.missingAttempts.length === 0"
+                  role="status"
+                  class="text-sm text-muted-foreground"
+                >
+                  {{ t('settings.system.requests.reconciliation.clean') }}
+                </p>
+                <ul v-else class="space-y-2">
+                  <li v-for="item in reconciliationIssues(client.id)" :key="item.infoHash" class="rounded-lg border border-border p-3">
+                    <div class="flex flex-wrap items-start justify-between gap-3">
+                      <div class="min-w-0">
+                        <p class="text-sm font-medium text-foreground">{{ item.name }}</p>
+                        <p class="mt-0.5 break-all font-mono text-xs text-muted-foreground">{{ item.infoHash }}</p>
+                        <p class="mt-1 text-xs text-muted-foreground">
+                          {{
+                            item.trackedAttempt
+                              ? t('settings.system.requests.reconciliation.failedAttempt', { title: item.trackedAttempt.requestTitle })
+                              : t('settings.system.requests.reconciliation.orphan')
+                          }}
+                        </p>
+                      </div>
+                      <Button v-if="item.trackedAttempt === null" size="sm" variant="destructive" @click="requestOrphanRemoval(client, item)">
+                        <Trash2 :size="14" aria-hidden="true" />
+                        {{ t('settings.system.requests.reconciliation.remove') }}
+                      </Button>
+                    </div>
+                    <div v-if="item.adoptableAttempts.length > 0" class="mt-2 flex flex-wrap gap-2">
+                      <Button
+                        v-for="attempt in item.adoptableAttempts"
+                        :key="attempt.downloadId"
+                        size="sm"
+                        variant="outline"
+                        @click="handleAdopt(client, item, attempt)"
+                      >
+                        <Link2 :size="14" aria-hidden="true" />
+                        {{ t('settings.system.requests.reconciliation.adopt', { title: attempt.requestTitle }) }}
+                      </Button>
+                    </div>
+                  </li>
+                  <li
+                    v-for="attempt in reconciliation[client.id]?.missingAttempts ?? []"
+                    :key="`missing-${attempt.downloadId}`"
+                    class="rounded-lg border border-border p-3"
+                  >
+                    <p class="text-sm font-medium text-foreground">{{ attempt.requestTitle }}</p>
+                    <p class="mt-1 text-xs text-muted-foreground">
+                      {{ t('settings.system.requests.reconciliation.missing', { status: attempt.status }) }}
+                    </p>
+                  </li>
+                </ul>
+              </template>
+            </div>
+          </div>
+        </li>
+      </ul>
+    </section>
+
+    <SettingsEditorSheet
+      v-if="draft"
+      :open="editorOpen"
+      :title="sheetTitle"
+      :description="t('settings.system.requests.editorDescription')"
+      :dirty="isDirty"
+      :busy="saving"
+      :removable="draft.id !== null"
+      :remove-label="t('settings.system.requests.confirmDelete.confirm')"
+      :remove-confirm="t('settings.system.requests.confirmDelete.title')"
+      :remove-consequence="t('settings.system.requests.confirmDelete.description', { name: draft.name })"
+      @save="handleSave"
+      @cancel="cancelEdit"
+      @remove="handleDelete"
+    >
+      <template #badge>
+        <span v-if="!pickingType" class="rounded-full bg-muted px-2 py-0.5 font-mono text-[11px] text-muted-foreground">
+          {{ draft.adapterType }}
+        </span>
+      </template>
+
+      <template #status>
+        <ConnectionHealth
+          v-if="editingClient"
+          :last-tested-at="editingClient.lastTestedAt"
+          :last-test-ok="editingClient.lastTestOk"
+          :enabled="editingClient.enabled"
+        />
+      </template>
+
+      <template #actions>
+        <TooltipProvider v-if="editingClient" :delay-duration="0">
+          <Tooltip>
+            <TooltipTrigger as-child>
+              <Button
+                size="icon-sm"
+                variant="outline"
+                class="aria-disabled:pointer-events-auto aria-disabled:opacity-50"
+                :disabled="testingId === editingClient.id"
+                :aria-disabled="isDirty || undefined"
+                :aria-label="testLabel"
+                @click="handleTestCurrent"
+              >
+                <Loader2 v-if="testingId === editingClient.id" class="animate-spin" aria-hidden="true" />
+                <Plug v-else :size="15" aria-hidden="true" />
+              </Button>
+            </TooltipTrigger>
+            <TooltipContent>{{ testLabel }}</TooltipContent>
+          </Tooltip>
+        </TooltipProvider>
+      </template>
+
+      <SettingsSection
+        v-if="pickingType"
+        :title="t('settings.system.requests.chooseClientType')"
+        :brief="t('settings.system.requests.chooseClientTypeHint')"
+      >
+        <AdapterTypePicker
+          :options="typeOptions"
+          :selected="draft.adapterType"
+          :legend="t('settings.system.requests.chooseClientType')"
+          name="download-client-type"
+          :built-in-label="t('settings.system.requests.indexers.builtIn')"
+          :plugin-label="t('settings.system.requests.external')"
+          @select="handleTypePicked"
+        />
+      </SettingsSection>
+
+      <template v-else>
+        <SettingsSection :title="t('settings.system.requests.sections.connection')">
+          <div class="grid gap-4 sm:grid-cols-2">
+            <SettingsField :label="t('settings.system.requests.fields.name')" input-id="download-client-name" required :error="fieldErrors.name">
+              <template #default="{ describedBy, invalid }">
+                <input
+                  id="download-client-name"
+                  v-model="draft.name"
+                  type="text"
+                  class="settings-control"
+                  autocomplete="off"
+                  :aria-describedby="describedBy"
+                  :aria-invalid="invalid || undefined"
+                  @input="handleNameInput"
+                />
+              </template>
+            </SettingsField>
+
+            <SettingsField v-if="hasTypeChoice" :label="t('settings.system.requests.fields.type')" input-id="download-client-type">
+              <select id="download-client-type" v-model="draft.adapterType" class="settings-control">
+                <option v-for="type in DOWNLOAD_CLIENT_TYPES" :key="type" :value="type">
+                  {{ t(`settings.system.requests.clientTypes.${type}`) }}
+                </option>
+              </select>
+            </SettingsField>
+          </div>
+
+          <SettingsField :label="t('settings.system.requests.fields.baseUrl')" input-id="download-client-url" required :error="fieldErrors.baseUrl">
+            <template #default="{ describedBy, invalid }">
+              <input
+                id="download-client-url"
+                v-model="draft.baseUrl"
+                type="url"
+                class="settings-control font-mono text-[13px]"
+                placeholder="http://localhost:8080"
+                :aria-describedby="describedBy"
+                :aria-invalid="invalid || undefined"
+                @input="handleBaseUrlInput"
+              />
+            </template>
+          </SettingsField>
+
+          <SettingsField class="sm:max-w-80" :label="t('settings.system.requests.fields.username')" input-id="download-client-username">
+            <input id="download-client-username" v-model="draft.username" type="text" class="settings-control" autocomplete="off" />
+          </SettingsField>
+
+          <!-- Full width like the indexer credential: the Show button and a "keep the stored
+               password" placeholder do not both fit in half a row. -->
+          <SettingsField
+            :label="t('settings.system.requests.fields.password')"
+            input-id="download-client-password"
+            :brief="t('settings.system.requests.fields.passwordBrief')"
+            :error="fieldErrors.password"
+          >
+            <template #default="{ describedBy, invalid }">
+              <div class="flex gap-2">
+                <!-- A download client credential is not the BookOrbit login, so it must not be an
+                     input[type=password]: see `@/lib/secret-input`. -->
+                <input
+                  id="download-client-password"
+                  v-model="draft.password"
+                  v-bind="SECRET_INPUT_ATTRS"
+                  type="text"
+                  class="settings-control"
+                  :class="{ 'input-secret': !passwordVisible }"
+                  :disabled="draft.passwordCleared"
+                  :placeholder="
+                    draft.passwordCleared
+                      ? t('settings.system.requests.fields.passwordWillClear')
+                      : draft.id === null
+                        ? ''
+                        : t('settings.system.requests.fields.passwordKeep')
+                  "
+                  :aria-describedby="describedBy"
+                  :aria-invalid="invalid || undefined"
+                  @input="markPasswordTouched"
+                />
+                <Button v-if="!draft.passwordCleared" size="sm" variant="outline" class="h-9 shrink-0" @click="togglePasswordVisible">
+                  {{ passwordVisible ? t('common.hide') : t('common.show') }}
+                </Button>
+                <Button v-if="canClearPassword" size="sm" variant="outline" class="h-9 shrink-0" @click="toggleClearPassword">
+                  {{
+                    draft.passwordCleared
+                      ? t('settings.system.requests.fields.passwordKeepAction')
+                      : t('settings.system.requests.fields.passwordClear')
+                  }}
+                </Button>
+              </div>
+            </template>
+          </SettingsField>
+        </SettingsSection>
+
+        <SettingsSection :title="t('settings.system.requests.sections.behaviour')">
+          <SourceColorPicker
+            v-model="draft.color"
+            input-name="download-client-color"
+            :label="t('settings.system.requests.color.label')"
+            :hint="t('settings.system.requests.color.hint')"
+            :none-label="t('settings.system.requests.color.none')"
+          />
+
+          <!-- Widths belong to the boxes, not to a column count that strands a hint in whatever
+               fraction is left over. -->
+          <div class="flex flex-wrap gap-x-8 gap-y-4">
+            <SettingsField
+              class="basis-full sm:basis-80"
+              :label="t('settings.system.requests.fields.category')"
+              input-id="download-client-category"
+              :brief="t('settings.system.requests.fields.categoryHint')"
+            >
+              <template #default="{ describedBy }">
+                <input id="download-client-category" v-model="draft.category" type="text" class="settings-control" :aria-describedby="describedBy" />
+              </template>
+            </SettingsField>
+
+            <SettingsField class="basis-full sm:basis-40" :label="t('settings.system.requests.fields.priority')" input-id="download-client-priority">
+              <input
+                id="download-client-priority"
+                v-model.number="draft.priority"
+                type="number"
+                min="1"
+                max="100"
+                class="settings-control max-w-28"
+              />
+            </SettingsField>
+          </div>
+
+          <div class="grid gap-4 sm:grid-cols-2">
+            <SettingsToggleField v-model="draft.enabled" :label="t('settings.system.requests.fields.enabled')" input-id="download-client-enabled" />
+            <SettingsToggleField
+              v-model="draft.useHardlinks"
+              :label="t('settings.system.requests.fields.useHardlinks')"
+              input-id="download-client-hardlinks"
+              :brief="t('settings.system.requests.fields.useHardlinksBrief')"
+            />
+            <SettingsToggleField
+              v-model="draft.allowPrivateAddress"
+              :label="t('settings.system.requests.fields.allowPrivateAddress')"
+              input-id="download-client-allow-private"
+              :brief="t('settings.system.requests.fields.allowPrivateAddressHint')"
+            />
+          </div>
+        </SettingsSection>
+
+        <SettingsSection :title="t('settings.system.requests.mappings.title')" :brief="t('settings.system.requests.mappings.brief')">
+          <p v-if="fieldErrors.mappings" role="alert" class="text-xs text-destructive">{{ fieldErrors.mappings }}</p>
+          <p class="text-xs text-muted-foreground">{{ t('settings.system.requests.mappings.identityExample') }}</p>
+
+          <div v-for="(mapping, index) in draft.pathMappings" :key="index" class="grid gap-3 sm:grid-cols-[1fr_1fr_auto] sm:items-end">
+            <SettingsField :label="t('settings.system.requests.mappings.remotePath')" :input-id="`mapping-remote-${index}`">
+              <input
+                :id="`mapping-remote-${index}`"
+                v-model="mapping.remotePath"
+                type="text"
+                class="settings-control font-mono text-[13px]"
+                placeholder="/downloads"
+              />
+            </SettingsField>
+            <SettingsField :label="t('settings.system.requests.mappings.localPath')" :input-id="`mapping-local-${index}`">
+              <input
+                :id="`mapping-local-${index}`"
+                v-model="mapping.localPath"
+                type="text"
+                class="settings-control font-mono text-[13px]"
+                placeholder="/data/downloads"
+              />
+            </SettingsField>
+            <Button size="sm" variant="destructive-outline" class="h-9" @click="removeMapping(index)">
+              <Trash2 :size="14" aria-hidden="true" />
+              <span class="sr-only">{{ t('settings.system.requests.mappings.remove') }}</span>
+            </Button>
+          </div>
+
+          <div>
+            <Button size="sm" variant="outline" @click="addMapping">
+              <Plus :size="14" aria-hidden="true" />
+              {{ t('settings.system.requests.mappings.add') }}
+            </Button>
+          </div>
+        </SettingsSection>
+      </template>
+
+      <template v-if="pickingType" #footer="{ requestClose }">
+        <div class="flex items-center gap-2">
+          <Button size="sm" @click="confirmType">{{ t('settings.system.requests.continueWithType') }}</Button>
+          <Button size="sm" variant="outline" @click="requestClose">{{ t('common.cancel') }}</Button>
+        </div>
+      </template>
+    </SettingsEditorSheet>
+
+    <ConfirmDialog
+      :open="pendingOrphanRemoval !== null"
+      :title="t('settings.system.requests.reconciliation.removeTitle')"
+      :description="t('settings.system.requests.reconciliation.removeDescription', { name: pendingOrphanRemoval?.name ?? '' })"
+      :confirm-label="t('settings.system.requests.reconciliation.remove')"
+      :busy="pendingOrphanRemoval !== null && reconcilingIds.has(pendingOrphanRemoval.clientId)"
+      @confirm="confirmOrphanRemoval"
+      @cancel="cancelOrphanRemoval"
+    />
+  </div>
+</template>
diff --git a/client/src/features/settings/RequestAutomationPanel.vue b/client/src/features/settings/RequestAutomationPanel.vue
new file mode 100644
index 000000000..f1ffc7384
--- /dev/null
+++ b/client/src/features/settings/RequestAutomationPanel.vue
@@ -0,0 +1,548 @@
+<script setup lang="ts">
+import { computed, onMounted, onScopeDispose, ref, watch } from 'vue'
+import { useI18n } from 'vue-i18n'
+import { ChevronRight, Loader2 } from '@lucide/vue'
+import { toast } from 'vue-sonner'
+import {
+  BOOK_REQUEST_IMPORT_FORMATS,
+  BOOK_REQUEST_MEDIA_KINDS,
+  MAX_AUTO_GRAB_ATTEMPTS_LIMIT,
+  MAX_AUTO_SEARCH_INTERVAL_HOURS,
+  MAX_AUTO_SEARCH_MAX_AGE_DAYS,
+  MIN_AUTO_GRAB_SCORE_FLOOR,
+  MIN_AUTO_SEARCH_INTERVAL_HOURS,
+  MIN_AUTO_SEARCH_MAX_AGE_DAYS,
+} from '@bookorbit/types'
+import type { BookRequestImportFormats, BookRequestMediaKind, ReleaseTier, RequestDestination } from '@bookorbit/types'
+import ToggleSwitch from '@/components/ui/ToggleSwitch.vue'
+import ReleaseProfileEditor from './components/ReleaseProfileEditor.vue'
+import RequestDestinationRow from './components/RequestDestinationRow.vue'
+import SettingsRow from './components/SettingsRow.vue'
+import SettingsSlider from './components/SettingsSlider.vue'
+import { useLibraries } from '@/features/library/composables/useLibraries'
+import { useIndexers } from '@/features/book-requests/composables/useIndexers'
+import { useRequestAutomation } from '@/features/book-requests/composables/useRequestAutomation'
+import { useRequestSourceStatus } from '@/features/book-requests/composables/useRequestSourceStatus'
+
+const { t } = useI18n()
+
+const { settings, loading, loadFailed, fetchSettings, save } = useRequestAutomation()
+const { libraries, fetchLibraries } = useLibraries()
+const { indexers, fetchIndexers } = useIndexers()
+/**
+ * Auto-grab switched on with nothing to search is the one setting on this tab that reports success
+ * and does nothing. Every request it touches is handed straight back, and the summary above it
+ * says BookOrbit will grab anything clearing the score - about a search that will never run.
+ *
+ * The counts rather than the indexer list, even though this is an admin page: the list carries a
+ * row per source with its credential state, and all this needs to know is whether any of them is
+ * on. The counts also answer for an operator who holds `manage_app_settings` alone.
+ */
+const { noSourcesEnabled, noSourcesConfigured, fetchSourceStatus } = useRequestSourceStatus()
+
+const MEDIA_KINDS = BOOK_REQUEST_MEDIA_KINDS
+
+/**
+ * The sliders are dragged, so they need a local value to move against. Everything else writes
+ * straight through, and every save adopts what the server reports back.
+ */
+const minScore = ref(settings.value.autoGrabMinScore)
+const attempts = ref(settings.value.maxAutoGrabAttempts)
+const threshold = ref(settings.value.verificationThreshold)
+const searchInterval = ref(settings.value.autoSearchIntervalHours)
+const searchMaxAge = ref(settings.value.autoSearchMaxAgeDays)
+
+/** What these five refs were last taken from, so an unrelated save can be told apart from a change. */
+let adopted = {
+  autoGrabMinScore: settings.value.autoGrabMinScore,
+  maxAutoGrabAttempts: settings.value.maxAutoGrabAttempts,
+  verificationThreshold: settings.value.verificationThreshold,
+  autoSearchIntervalHours: settings.value.autoSearchIntervalHours,
+  autoSearchMaxAgeDays: settings.value.autoSearchMaxAgeDays,
+}
+
+/**
+ * Adopt a field only where the server's own value for it moved.
+ *
+ * Every control on this tab writes through and adopts what comes back, so flipping one checkbox
+ * re-emits the whole settings object; overwriting all five local values from it wiped a number
+ * half-typed in the box beside it and snapped a slider back mid-drag. Comparing against what these
+ * refs were last taken from leaves them alone on an unrelated save, while a genuine change - this
+ * page's own save, a refetch, another operator - still wins.
+ */
+watch(settings, (next) => {
+  if (next.autoGrabMinScore !== adopted.autoGrabMinScore) minScore.value = next.autoGrabMinScore
+  if (next.maxAutoGrabAttempts !== adopted.maxAutoGrabAttempts) attempts.value = next.maxAutoGrabAttempts
+  if (next.verificationThreshold !== adopted.verificationThreshold) threshold.value = next.verificationThreshold
+  if (next.autoSearchIntervalHours !== adopted.autoSearchIntervalHours) searchInterval.value = next.autoSearchIntervalHours
+  if (next.autoSearchMaxAgeDays !== adopted.autoSearchMaxAgeDays) searchMaxAge.value = next.autoSearchMaxAgeDays
+
+  adopted = {
+    autoGrabMinScore: next.autoGrabMinScore,
+    maxAutoGrabAttempts: next.maxAutoGrabAttempts,
+    verificationThreshold: next.verificationThreshold,
+    autoSearchIntervalHours: next.autoSearchIntervalHours,
+    autoSearchMaxAgeDays: next.autoSearchMaxAgeDays,
+  }
+})
+
+onMounted(fetchSettings)
+onMounted(fetchLibraries)
+onMounted(fetchSourceStatus)
+onMounted(() => fetchIndexers({ withAdapters: false }))
+
+/**
+ * What this server will actually do to an approved request, in one sentence. Assembled from the
+ * dragged values rather than the saved ones so it answers the question while the slider moves.
+ */
+const downloadsSummary = computed(() => {
+  if (!settings.value.autoGrabEnabled) return t('settings.system.requests.automation.summaryOff')
+  const score = minScore.value
+  if (!settings.value.autoRetryEnabled) return t('settings.system.requests.automation.summaryNoRetry', { score })
+  const count = Number.isInteger(attempts.value) ? attempts.value : settings.value.maxAutoGrabAttempts
+  return t('settings.system.requests.automation.summaryRetry', { score, count })
+})
+
+const importsSummary = computed(() =>
+  settings.value.verificationEnabled ? t('settings.system.requests.automation.verifyOnHint') : t('settings.system.requests.automation.verifyOffHint'),
+)
+
+function stateLabel(enabled: boolean) {
+  return enabled ? t('settings.system.requests.automation.stateOn') : t('settings.system.requests.automation.stateOff')
+}
+
+/**
+ * Bumped when a write-through save is refused.
+ *
+ * The destination rows and the profile editor are driven entirely by props, so a refusal leaves
+ * their props exactly as they were and Vue with nothing to re-render: the select goes on pointing
+ * at a library that was never stored, and the tier name box keeps the text that never left the
+ * browser. Re-keying them rebuilds both from the settings actually in force.
+ */
+const editorRevision = ref(0)
+
+/** How long the profile editor is left alone before its accumulated edits are sent. */
+const PROFILE_SAVE_DEBOUNCE_MS = 700
+const profileHandles = new Map<BookRequestMediaKind, ReturnType<typeof setTimeout>>()
+const pendingProfiles = new Map<BookRequestMediaKind, ReleaseTier[]>()
+
+onScopeDispose(() => {
+  for (const mediaKind of pendingProfiles.keys()) flushProfile(mediaKind)
+})
+
+/** `successKey` of null saves quietly: the control that asked already shows what it did. */
+async function persist(payload: Parameters<typeof save>[0], successKey: string | null) {
+  if (await save(payload)) {
+    if (successKey) toast.success(t(successKey))
+    return
+  }
+  toast.error(t('settings.system.requests.automation.saveFailed'))
+  editorRevision.value++
+}
+
+function handleAutoGrabChange(enabled: boolean) {
+  void persist(
+    { autoGrabEnabled: enabled },
+    enabled ? 'settings.system.requests.automation.autoGrabEnabled' : 'settings.system.requests.automation.autoGrabDisabled',
+  )
+}
+
+/**
+ * Radios rather than a toggle: neither value is the "off" one, and a switch would have to pick a
+ * side to be off. Both are ordinary choices about what a library should hold.
+ */
+const IMPORT_FORMAT_OPTIONS = BOOK_REQUEST_IMPORT_FORMATS
+
+function handleImportFormatsChange(importFormats: BookRequestImportFormats) {
+  void persist({ importFormats }, 'settings.system.requests.automation.saved')
+}
+
+/**
+ * One medium at a time, so changing where audiobooks go cannot resend, and therefore cannot
+ * clobber, a destination somebody else set for ebooks between this page loading and saving.
+ */
+function handleDestinationChange(mediaKind: BookRequestMediaKind, destination: RequestDestination) {
+  void persist({ destinations: { [mediaKind]: destination } }, 'settings.system.requests.automation.saved')
+}
+
+/**
+ * One medium at a time, for the same reason destinations are: a profile is an ordered list, and
+ * resending all three would clobber a list somebody else reordered between this page loading and
+ * this one saving.
+ *
+ * Debounced, and quiet on success. A tier is built by clicking through a row of format chips, two
+ * checkboxes and two number boxes, and each of those used to be its own PUT and its own "Saved"
+ * toast: eight round trips and a stack of eight identical toasts for one tier nobody had finished
+ * describing. The editor shows the change immediately, so what this waits for is the typing to
+ * stop; a refusal still says so, because that is the one outcome the operator cannot see.
+ */
+function handleProfileChange(mediaKind: BookRequestMediaKind, tiers: ReleaseTier[]) {
+  pendingProfiles.set(mediaKind, tiers)
+  const running = profileHandles.get(mediaKind)
+  if (running) clearTimeout(running)
+
+  profileHandles.set(
+    mediaKind,
+    setTimeout(() => flushProfile(mediaKind), PROFILE_SAVE_DEBOUNCE_MS),
+  )
+}
+
+/** Sends the last complete local profile, including when navigation disposes the debounce timer. */
+function flushProfile(mediaKind: BookRequestMediaKind) {
+  const handle = profileHandles.get(mediaKind)
+  if (handle) clearTimeout(handle)
+  profileHandles.delete(mediaKind)
+  const next = pendingProfiles.get(mediaKind)
+  pendingProfiles.delete(mediaKind)
+  if (next) void persist({ profiles: { [mediaKind]: next } }, null)
+}
+
+function handleAutoRetryChange(enabled: boolean) {
+  void persist({ autoRetryEnabled: enabled }, 'settings.system.requests.automation.saved')
+}
+
+function handleMinScoreChange() {
+  void persist({ autoGrabMinScore: minScore.value }, 'settings.system.requests.automation.saved')
+}
+
+/**
+ * `v-model.number` hands back an empty string for a cleared box, and the spinner does not clamp
+ * what is typed into it. Anything the endpoint would reject is put back to the running value
+ * rather than sent for a 400.
+ */
+function handleAttemptsChange() {
+  const next = Number(attempts.value)
+  if (!Number.isInteger(next) || next < 1 || next > MAX_AUTO_GRAB_ATTEMPTS_LIMIT) {
+    attempts.value = settings.value.maxAutoGrabAttempts
+    return
+  }
+  void persist({ maxAutoGrabAttempts: next }, 'settings.system.requests.automation.saved')
+}
+
+function handleAutoSearchChange(enabled: boolean) {
+  void persist(
+    { autoSearchEnabled: enabled },
+    enabled ? 'settings.system.requests.automation.autoSearchEnabledToast' : 'settings.system.requests.automation.autoSearchDisabledToast',
+  )
+}
+
+/** Same guard as the attempts box: a cleared spinner is an empty string, and neither box clamps. */
+function handleSearchIntervalChange() {
+  const next = Number(searchInterval.value)
+  if (!Number.isInteger(next) || next < MIN_AUTO_SEARCH_INTERVAL_HOURS || next > MAX_AUTO_SEARCH_INTERVAL_HOURS) {
+    searchInterval.value = settings.value.autoSearchIntervalHours
+    return
+  }
+  void persist({ autoSearchIntervalHours: next }, 'settings.system.requests.automation.saved')
+}
+
+function handleSearchMaxAgeChange() {
+  const next = Number(searchMaxAge.value)
+  if (!Number.isInteger(next) || next < MIN_AUTO_SEARCH_MAX_AGE_DAYS || next > MAX_AUTO_SEARCH_MAX_AGE_DAYS) {
+    searchMaxAge.value = settings.value.autoSearchMaxAgeDays
+    return
+  }
+  void persist({ autoSearchMaxAgeDays: next }, 'settings.system.requests.automation.saved')
+}
+
+function handleThresholdChange() {
+  void persist({ verificationThreshold: threshold.value }, 'settings.system.requests.automation.saved')
+}
+
+function handleVerificationChange(enabled: boolean) {
+  void persist(
+    { verificationEnabled: enabled },
+    enabled ? 'settings.system.requests.automation.verificationEnabled' : 'settings.system.requests.automation.verificationDisabled',
+  )
+}
+</script>
+
+<template>
+  <div v-if="loading" class="settings-loading-state">
+    <Loader2 class="size-5 animate-spin text-muted-foreground" />
+    <span class="sr-only">{{ t('settings.system.requests.automation.loading') }}</span>
+  </div>
+
+  <section v-else aria-labelledby="request-automation-heading" class="space-y-3">
+    <h2 id="request-automation-heading" class="sr-only">{{ t('settings.system.requests.automation.title') }}</h2>
+
+    <p v-if="loadFailed" role="alert" class="text-sm text-destructive">{{ t('settings.system.requests.automation.loadFailed') }}</p>
+
+    <div class="settings-card">
+      <div class="settings-card-header">
+        <span class="settings-card-title">{{ t('settings.system.requests.automation.groupDownloads') }}</span>
+        <span class="settings-state-pill">{{ stateLabel(settings.autoGrabEnabled) }}</span>
+      </div>
+
+      <p class="settings-hint settings-prose bg-card px-4 py-3 md:px-5">{{ downloadsSummary }}</p>
+
+      <p
+        v-if="settings.autoGrabEnabled && noSourcesEnabled"
+        role="status"
+        class="settings-hint settings-prose bg-card px-4 pb-3 text-warning md:px-5"
+      >
+        {{
+          noSourcesConfigured
+            ? t('settings.system.requests.automation.noSourcesConfigured')
+            : t('settings.system.requests.automation.noSourcesEnabled')
+        }}
+      </p>
+
+      <SettingsRow :label="t('settings.system.requests.automation.autoGrab')">
+        <ToggleSwitch
+          :model-value="settings.autoGrabEnabled"
+          :aria-label="t('settings.system.requests.automation.autoGrab')"
+          @update:model-value="handleAutoGrabChange"
+        />
+      </SettingsRow>
+
+      <div v-if="settings.autoGrabEnabled" class="settings-subgroup ml-4 md:ml-5">
+        <SettingsRow
+          class="pl-3 md:pl-4"
+          control-id="auto-grab-min-score"
+          :label="t('settings.system.requests.automation.minScore')"
+          :hint="t('settings.system.requests.automation.minScoreShort')"
+        >
+          <SettingsSlider
+            id="auto-grab-min-score"
+            v-model="minScore"
+            :min="MIN_AUTO_GRAB_SCORE_FLOOR"
+            :max="100"
+            :step="5"
+            @change="handleMinScoreChange"
+          />
+        </SettingsRow>
+
+        <SettingsRow
+          class="pl-3 md:pl-4"
+          :label="t('settings.system.requests.automation.autoRetry')"
+          :hint="t('settings.system.requests.automation.autoRetryShort')"
+        >
+          <ToggleSwitch
+            :model-value="settings.autoRetryEnabled"
+            :aria-label="t('settings.system.requests.automation.autoRetry')"
+            @update:model-value="handleAutoRetryChange"
+          />
+        </SettingsRow>
+
+        <SettingsRow
+          class="pl-3 md:pl-4"
+          control-id="auto-grab-attempts"
+          :label="t('settings.system.requests.automation.maxAttempts')"
+          :hint="t('settings.system.requests.automation.maxAttemptsShort')"
+        >
+          <input
+            id="auto-grab-attempts"
+            v-model.number="attempts"
+            type="number"
+            inputmode="numeric"
+            min="1"
+            :max="MAX_AUTO_GRAB_ATTEMPTS_LIMIT"
+            step="1"
+            class="input-field w-20"
+            @change="handleAttemptsChange"
+          />
+        </SettingsRow>
+
+        <SettingsRow
+          class="pl-3 md:pl-4"
+          :label="t('settings.system.requests.automation.autoSearch')"
+          :hint="t('settings.system.requests.automation.autoSearchShort')"
+        >
+          <ToggleSwitch
+            :model-value="settings.autoSearchEnabled"
+            :aria-label="t('settings.system.requests.automation.autoSearch')"
+            @update:model-value="handleAutoSearchChange"
+          />
+        </SettingsRow>
+
+        <template v-if="settings.autoSearchEnabled">
+          <SettingsRow
+            class="pl-6 md:pl-8"
+            control-id="auto-search-interval"
+            :label="t('settings.system.requests.automation.autoSearchInterval')"
+            :hint="t('settings.system.requests.automation.autoSearchIntervalShort')"
+          >
+            <div class="flex items-center gap-2">
+              <input
+                id="auto-search-interval"
+                v-model.number="searchInterval"
+                type="number"
+                inputmode="numeric"
+                :min="MIN_AUTO_SEARCH_INTERVAL_HOURS"
+                :max="MAX_AUTO_SEARCH_INTERVAL_HOURS"
+                step="1"
+                class="input-field w-20"
+                @change="handleSearchIntervalChange"
+              />
+              <span class="text-xs text-muted-foreground">{{ t('settings.system.requests.automation.autoSearchIntervalUnit') }}</span>
+            </div>
+          </SettingsRow>
+
+          <SettingsRow
+            class="pl-6 md:pl-8"
+            control-id="auto-search-max-age"
+            :label="t('settings.system.requests.automation.autoSearchMaxAge')"
+            :hint="t('settings.system.requests.automation.autoSearchMaxAgeShort')"
+          >
+            <div class="flex items-center gap-2">
+              <input
+                id="auto-search-max-age"
+                v-model.number="searchMaxAge"
+                type="number"
+                inputmode="numeric"
+                :min="MIN_AUTO_SEARCH_MAX_AGE_DAYS"
+                :max="MAX_AUTO_SEARCH_MAX_AGE_DAYS"
+                step="1"
+                class="input-field w-20"
+                @change="handleSearchMaxAgeChange"
+              />
+              <span class="text-xs text-muted-foreground">{{ t('settings.system.requests.automation.autoSearchMaxAgeUnit') }}</span>
+            </div>
+          </SettingsRow>
+        </template>
+      </div>
+
+      <details class="group bg-card px-4 py-3 md:px-5">
+        <summary
+          class="flex cursor-pointer list-none items-center gap-1.5 text-xs font-medium text-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring/50"
+        >
+          <ChevronRight class="size-3.5 text-muted-foreground transition-transform group-open:rotate-90" aria-hidden="true" />
+          {{ t('settings.system.requests.automation.howDownloads') }}
+        </summary>
+        <div class="mt-2 space-y-2 settings-prose">
+          <p class="settings-hint">{{ t('settings.system.requests.automation.autoGrabHint') }}</p>
+          <p class="settings-hint">{{ t('settings.system.requests.automation.minScoreHint') }}</p>
+          <p class="settings-hint">{{ t('settings.system.requests.automation.autoRetryHint') }}</p>
+          <p class="settings-hint">{{ t('settings.system.requests.automation.maxAttemptsHint') }}</p>
+          <p class="settings-hint">{{ t('settings.system.requests.automation.autoSearchHint') }}</p>
+          <p class="settings-hint">{{ t('settings.system.requests.automation.autoSearchIntervalHint') }}</p>
+          <p class="settings-hint">{{ t('settings.system.requests.automation.autoSearchMaxAgeHint') }}</p>
+        </div>
+      </details>
+    </div>
+
+    <div class="settings-card">
+      <div class="settings-card-header">
+        <span class="settings-card-title">{{ t('settings.system.requests.automation.groupImports') }}</span>
+        <span class="settings-state-pill">{{ stateLabel(settings.verificationEnabled) }}</span>
+      </div>
+
+      <p class="settings-hint settings-prose bg-card px-4 py-3 md:px-5">{{ importsSummary }}</p>
+
+      <SettingsRow :label="t('settings.system.requests.automation.verify')">
+        <ToggleSwitch
+          :model-value="settings.verificationEnabled"
+          :aria-label="t('settings.system.requests.automation.verify')"
+          @update:model-value="handleVerificationChange"
+        />
+      </SettingsRow>
+
+      <SettingsRow
+        v-if="settings.verificationEnabled"
+        class="settings-subgroup ml-4 pl-3 md:ml-5 md:pl-4"
+        control-id="request-verification-threshold"
+        :label="t('settings.system.requests.automation.verification')"
+        :hint="t('settings.system.requests.automation.verificationShort')"
+      >
+        <SettingsSlider id="request-verification-threshold" v-model="threshold" :min="0" :max="100" :step="5" @change="handleThresholdChange" />
+      </SettingsRow>
+
+      <details class="group bg-card px-4 py-3 md:px-5">
+        <summary
+          class="flex cursor-pointer list-none items-center gap-1.5 text-xs font-medium text-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring/50"
+        >
+          <ChevronRight class="size-3.5 text-muted-foreground transition-transform group-open:rotate-90" aria-hidden="true" />
+          {{ t('settings.system.requests.automation.howImports') }}
+        </summary>
+        <div class="mt-2 space-y-2 settings-prose">
+          <p class="settings-hint">{{ t('settings.system.requests.automation.pipeline') }}</p>
+          <p class="settings-hint">{{ t('settings.system.requests.automation.verificationHint') }}</p>
+        </div>
+      </details>
+    </div>
+
+    <div class="settings-card">
+      <fieldset>
+        <legend class="settings-card-header w-full">
+          <span class="settings-card-title">{{ t('settings.system.requests.automation.destinations') }}</span>
+        </legend>
+
+        <div class="border-t border-border px-4 py-3.5 md:px-5 md:py-4">
+          <p class="settings-hint settings-prose">{{ t('settings.system.requests.automation.destinationsHint') }}</p>
+
+          <div class="mt-3 grid gap-3">
+            <RequestDestinationRow
+              v-for="mediaKind in MEDIA_KINDS"
+              :key="`${mediaKind}-${editorRevision}`"
+              :media-kind="mediaKind"
+              :libraries="libraries"
+              :destination="settings.destinations[mediaKind]"
+              @update="handleDestinationChange"
+            />
+          </div>
+        </div>
+      </fieldset>
+    </div>
+
+    <div class="settings-card">
+      <fieldset>
+        <legend class="settings-card-header w-full">
+          <span class="settings-card-title">{{ t('settings.system.requests.profiles.title') }}</span>
+        </legend>
+
+        <div class="border-t border-border px-4 py-3.5 md:px-5 md:py-4">
+          <p class="settings-hint settings-prose">{{ t('settings.system.requests.profiles.hint') }}</p>
+
+          <div class="mt-3 grid gap-4">
+            <div v-for="mediaKind in MEDIA_KINDS" :key="mediaKind">
+              <h3 class="text-xs font-medium text-foreground">{{ t(`bookRequests.mediaKind.${mediaKind}`) }}</h3>
+              <div class="mt-1.5">
+                <ReleaseProfileEditor
+                  :key="`${mediaKind}-${editorRevision}`"
+                  :media-kind="mediaKind"
+                  :tiers="settings.profiles[mediaKind]"
+                  :indexers="indexers"
+                  @update="handleProfileChange"
+                />
+              </div>
+            </div>
+          </div>
+        </div>
+      </fieldset>
+    </div>
+
+    <div class="settings-card">
+      <fieldset>
+        <legend class="settings-card-header w-full">
+          <span class="settings-card-title">{{ t('settings.system.requests.automation.importFormats') }}</span>
+        </legend>
+
+        <div class="border-t border-border px-4 py-3.5 md:px-5 md:py-4">
+          <p class="settings-hint settings-prose">{{ t('settings.system.requests.automation.importFormatsHint') }}</p>
+
+          <div class="mt-3 grid gap-2">
+            <label v-for="option in IMPORT_FORMAT_OPTIONS" :key="option" class="flex items-start gap-2.5">
+              <input
+                type="radio"
+                name="import-formats"
+                class="mt-0.5 accent-primary"
+                :value="option"
+                :checked="settings.importFormats === option"
+                @change="handleImportFormatsChange(option)"
+              />
+              <span class="min-w-0 settings-prose">
+                <span class="block text-xs font-medium text-foreground">
+                  {{ t(`settings.system.requests.automation.importFormatsOption.${option}`) }}
+                </span>
+                <span class="settings-hint block">
+                  {{ t(`settings.system.requests.automation.importFormatsOption.${option}Hint`) }}
+                </span>
+              </span>
+            </label>
+          </div>
+        </div>
+      </fieldset>
+    </div>
+  </section>
+</template>
diff --git a/client/src/features/settings/RequestIndexersPanel.vue b/client/src/features/settings/RequestIndexersPanel.vue
new file mode 100644
index 000000000..78d66caa8
--- /dev/null
+++ b/client/src/features/settings/RequestIndexersPanel.vue
@@ -0,0 +1,927 @@
+<script setup lang="ts">
+import { computed, onMounted, ref, watch } from 'vue'
+import { useI18n } from 'vue-i18n'
+import { Loader2, Plug, Plus, Server as ServerIcon, Trash2, TriangleAlert, Upload } from '@lucide/vue'
+import { toast } from 'vue-sonner'
+import { BOOK_REQUEST_MEDIA_KINDS } from '@bookorbit/types'
+import type { IndexerAdapterDescriptor, IndexerItem, IndexerSettingsField } from '@bookorbit/types'
+import { Button } from '@/components/ui/button'
+import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from '@/components/ui/tooltip'
+import ConfirmDialog from '@/components/ui/ConfirmDialog.vue'
+import ChipInput from '@/components/ui/ChipInput.vue'
+import ConnectionHealth from './ConnectionHealth.vue'
+import PluginDirectoryLink from './components/PluginDirectoryLink.vue'
+import RequestSourceRow from './components/RequestSourceRow.vue'
+import PluginVersionBadge from './components/PluginVersionBadge.vue'
+import RequestSourcesEmpty from './components/RequestSourcesEmpty.vue'
+import SettingsEditorSheet from './components/SettingsEditorSheet.vue'
+import SettingsField from './components/SettingsField.vue'
+import SettingsSection from './components/SettingsSection.vue'
+import SettingsToggleField from './components/SettingsToggleField.vue'
+import SourceColorPicker from './components/SourceColorPicker.vue'
+import { isBuiltInAdapter, useIndexerDraft } from './composables/useIndexerDraft'
+import { useIndexerPlugins } from './composables/useIndexerPlugins'
+import { SECRET_INPUT_ATTRS } from '@/lib/secret-input'
+import { usePermissions } from '@/features/auth/composables/usePermissions'
+import { useIndexers } from '@/features/book-requests/composables/useIndexers'
+
+const { t, te } = useI18n()
+
+/** Reported upwards so the page states the instance-level encryption fact once, not per panel. */
+const emit = defineEmits<{ encryptionState: [configured: boolean] }>()
+
+const {
+  indexers,
+  adapters,
+  pluginFailures,
+  adapterFor,
+  encryptionConfigured,
+  loading,
+  saving,
+  loadFailed,
+  fetchIndexers,
+  save,
+  remove,
+  test,
+  inspectPlugin,
+  installPlugin,
+  removePlugin,
+} = useIndexers()
+
+watch(encryptionConfigured, (configured) => emit('encryptionState', configured))
+
+const { isSuperuser } = usePermissions()
+
+/** Installing a plugin runs its code in the server process, so only an administrator may. */
+const canInstallPlugins = isSuperuser
+
+/** The row whose test is in flight, and the row whose enabled flag is; both go inert on their own. */
+const testingId = ref<number | null>(null)
+const togglingId = ref<number | null>(null)
+
+const {
+  draft,
+  editorOpen,
+  credentialVisible,
+  fieldErrors,
+  isDirty,
+  currentAdapter,
+  editingIndexer,
+  sheetTitle,
+  canScopeMediaKinds,
+  describeFailure,
+  startCreate,
+  startCreateFor,
+  startEdit,
+  cancelEdit,
+  handleNameInput,
+  handleBaseUrlInput,
+  markCredentialTouched,
+  canClearCredential,
+  toggleClearCredential,
+  toggleCredentialVisible,
+  setSetting,
+  handleSettingInput,
+  settingList,
+  setSettingList,
+  isSettingOptionSelected,
+  isSettingOptionLocked,
+  toggleSettingOption,
+  canRestoreSettingDefault,
+  restoreSettingDefault,
+  normalizeCategory,
+  adapterCarries,
+  isMediaKindSearched,
+  toggleMediaKind,
+  handleSave,
+} = useIndexerDraft({ indexers, adapterFor, adapterLabel, save })
+
+/** Only while the editor is open: the record a closed sheet left behind is not being edited. */
+const editingType = computed(() => (editorOpen.value ? (draft.value?.adapterType ?? null) : null))
+
+const {
+  pluginInput,
+  pluginReview,
+  pluginBusy,
+  pluginRestartPending,
+  removingPlugin,
+  pluginPendingRemoval,
+  pluginRows,
+  torznabRows,
+  nothingConfigured,
+  allSourcesDisabled,
+  editingPluginType,
+  editingPlugin,
+  pluginUseCount,
+  pluginUsage,
+  pendingRemovalUsage,
+  askRemovePlugin,
+  askRemovePluginType,
+  cancelRemovePlugin,
+  confirmRemovePlugin,
+  handleRowPluginUpdate,
+  handleRowPluginRemove,
+  startPluginInstall,
+  startPluginUpdate,
+  handlePluginChosen,
+  cancelPluginInstall,
+  confirmPluginInstall,
+  removeInstalledPlugin,
+} = useIndexerPlugins({
+  indexers,
+  adapters,
+  pluginFailures,
+  adapterFor,
+  inspectPlugin,
+  installPlugin,
+  removePlugin,
+  fetchIndexers,
+  editingType,
+  cancelEdit,
+  startCreateFor,
+})
+
+onMounted(fetchIndexers)
+
+/**
+ * A built-in adapter has translated copy keyed on its type; a plugin can only supply untranslated
+ * English, because plugin text cannot go through the translation workflow. So a message key is
+ * preferred where one exists and the descriptor string is the fallback.
+ */
+function adapterLabel(adapter: IndexerAdapterDescriptor): string {
+  const key = `settings.system.requests.indexers.types.${adapter.type}`
+  return adapter.builtIn && te(key) ? t(key) : adapter.label
+}
+
+function baseUrlHint(type: string): string {
+  const adapter = adapterFor(type)
+  const key = `settings.system.requests.indexers.fields.baseUrlHint.${type}`
+  if (adapter?.builtIn && te(key)) return t(key)
+  return adapter?.baseUrlHint ?? ''
+}
+
+/**
+ * A row whose adapter is not part of this build, which happens after an upgrade drops one or a
+ * plugin fails to load. It is kept rather than deleted so an encrypted credential is not silently
+ * lost, so the list has to say why it will not work.
+ */
+function isAvailable(type: string) {
+  return adapters.value.some((adapter) => adapter.type === type)
+}
+
+/** Plugin field labels are untranslated English; a built-in prefers its own message key. */
+function settingLabel(field: IndexerSettingsField): string {
+  const key = `settings.system.requests.indexers.fields.${field.key}`
+  return te(key) ? t(key) : field.label
+}
+
+/** Deleting the last source built on a plugin is deleting the plugin; the sheet says so first. */
+async function handleDelete() {
+  const indexer = editingIndexer.value
+  if (!indexer) return
+
+  if (!isBuiltInAdapter(indexer.adapterType)) {
+    await removeInstalledPlugin(indexer.adapterType)
+    return
+  }
+
+  const removed = await remove(indexer.id)
+  if (!removed) {
+    toast.error(t('settings.system.requests.indexers.errors.deleteFailed'))
+    return
+  }
+  toast.success(t('settings.system.requests.indexers.deleted'))
+  if (draft.value?.id === indexer.id) cancelEdit()
+}
+
+async function handleTest(indexer: IndexerItem) {
+  testingId.value = indexer.id
+  try {
+    const result = await test(indexer.id)
+    if (result.success) toast.success(t('settings.system.requests.indexers.testOk', { name: result.indexerName ?? indexer.name }))
+    else toast.error(result.error ?? t('settings.system.requests.indexers.errors.testFailed'))
+  } finally {
+    testingId.value = null
+  }
+}
+
+/**
+ * Turning a source off from its row. The same `enabled` flag the editor writes, sent on its own so
+ * a row with a stored credential is not round-tripped through a form to be silenced for an hour.
+ */
+async function handleToggleEnabled(indexer: IndexerItem, enabled: boolean) {
+  togglingId.value = indexer.id
+  try {
+    const failure = await save(indexer.id, { enabled })
+    if (failure) {
+      toast.error(describeFailure(failure))
+      return
+    }
+    const key = enabled ? 'settings.system.requests.indexers.enabledNotice' : 'settings.system.requests.indexers.disabledNotice'
+    toast.success(t(key, { name: indexer.name }))
+  } finally {
+    togglingId.value = null
+  }
+}
+
+const testLabel = computed(() => (isDirty.value ? t('settings.system.requests.indexers.testSaveFirst') : t('settings.system.requests.indexers.test')))
+
+function handleTestCurrent() {
+  const indexer = editingIndexer.value
+  if (indexer && !isDirty.value) void handleTest(indexer)
+}
+</script>
+
+<template>
+  <div v-if="loading" class="settings-loading-state">
+    <Loader2 class="size-5 animate-spin text-muted-foreground" />
+    <span class="sr-only">{{ t('settings.system.requests.indexers.loading') }}</span>
+  </div>
+
+  <div v-else class="space-y-4">
+    <p v-if="loadFailed" role="alert" class="text-sm text-destructive">{{ t('settings.system.requests.indexers.errors.loadFailed') }}</p>
+
+    <!--
+      Kept outside both groups. It is how a plugin is chosen from the empty panel too, and that
+      panel replaces the section this input used to live in.
+    -->
+    <input
+      v-if="canInstallPlugins"
+      ref="pluginInput"
+      type="file"
+      accept=".mjs"
+      class="sr-only"
+      :aria-label="t('settings.system.requests.indexers.plugins.install')"
+      @change="handlePluginChosen"
+    />
+
+    <!--
+      Said once, above the list rather than on any row. BookOrbit bundles no source: every row here
+      is an address or a plugin somebody added, and the page that names Prowlarr and Jackett is the
+      one place where whose responsibility that is has to be stated plainly.
+    -->
+    <p class="settings-hint">{{ t('settings.system.requests.indexers.posture') }}</p>
+
+    <p v-if="pluginRestartPending" role="status" class="settings-hint text-primary">
+      {{ t('settings.system.requests.indexers.plugins.restartRequired') }}
+    </p>
+
+    <!--
+      A list of rows that are all switched off looks configured, and this page is where somebody
+      comes to find out why nothing is being searched. Stated above the groups rather than on each
+      row, because the fact is about the set rather than about any one source.
+    -->
+    <p v-if="allSourcesDisabled" role="status" class="settings-hint text-warning">
+      {{ t('settings.system.requests.indexers.allDisabled') }}
+    </p>
+
+    <RequestSourcesEmpty
+      v-if="nothingConfigured"
+      :can-install-plugins="canInstallPlugins"
+      @install-plugin="startPluginInstall"
+      @add-indexer="startCreate"
+    />
+
+    <!--
+      Two things, added two ways. A plugin is a file you install and then fill in; a Torznab indexer
+      is an address you already have. Everything else on this page used to be the seam between those
+      two being explained rather than shown.
+    -->
+    <!-- A wider gap than anything inside a group takes, so the two labels read as a boundary. -->
+    <div v-else class="space-y-6">
+      <section aria-labelledby="request-plugins-heading" class="space-y-3">
+        <!-- Label and hint are one block, and the row keeps a button's height whether it has one or
+             not, so both groups read at the same rhythm. -->
+        <div>
+          <div class="flex min-h-8 items-center justify-between gap-2">
+            <h2 id="request-plugins-heading" class="settings-group-label mb-0">{{ t('settings.system.requests.indexers.plugins.title') }}</h2>
+            <!-- Only while the group has rows. With none, the one call to action lives in the slot
+                 below rather than twice on the same line of the page. -->
+            <Button v-if="canInstallPlugins && pluginRows.length" size="sm" variant="outline" :disabled="pluginBusy" @click="startPluginInstall">
+              <Upload :size="14" aria-hidden="true" />
+              {{ t('settings.system.requests.indexers.plugins.install') }}
+            </Button>
+          </div>
+
+          <p class="settings-hint settings-prose mt-1.5">
+            {{ t('settings.system.requests.indexers.plugins.hint') }}
+            <PluginDirectoryLink v-if="canInstallPlugins" />
+          </p>
+        </div>
+
+        <div v-if="!pluginRows.length" class="settings-empty-state flex flex-wrap items-center gap-x-4 gap-y-3 px-4 py-3.5 text-start md:px-5">
+          <span class="flex size-8 shrink-0 items-center justify-center rounded-lg bg-muted text-muted-foreground" aria-hidden="true">
+            <Plug :size="17" />
+          </span>
+          <p role="status" class="min-w-56 flex-1 text-sm text-muted-foreground">
+            {{ t('settings.system.requests.indexers.plugins.none') }}
+          </p>
+          <Button v-if="canInstallPlugins" size="sm" variant="outline" :disabled="pluginBusy" @click="startPluginInstall">
+            <Upload :size="14" aria-hidden="true" />
+            {{ t('settings.system.requests.indexers.plugins.install') }}
+          </Button>
+        </div>
+
+        <ul v-else class="space-y-2">
+          <li v-for="row in pluginRows" :key="row.key" class="settings-card">
+            <!-- Known by its directory, not its type: it never loaded, so it declared nothing. -->
+            <div
+              v-if="row.kind === 'broken'"
+              role="status"
+              class="flex flex-wrap items-start justify-between gap-3 rounded-[inherit] bg-card px-4 py-3.5 ring-1 ring-destructive/40 md:px-5 md:py-4"
+            >
+              <div class="flex min-w-0 flex-1 basis-72 gap-3">
+                <span class="flex size-8 shrink-0 items-center justify-center rounded-lg bg-destructive/12 text-destructive" aria-hidden="true">
+                  <TriangleAlert :size="17" />
+                </span>
+                <div class="min-w-0">
+                  <p class="settings-label">{{ t('settings.system.requests.indexers.plugins.brokenTitle') }}</p>
+                  <p class="mt-1 text-xs break-words text-destructive">
+                    {{ t('settings.system.requests.indexers.pluginFailed', { directory: row.failure.directory, reason: row.failure.reason }) }}
+                  </p>
+                </div>
+              </div>
+              <Button
+                v-if="canInstallPlugins"
+                size="sm"
+                variant="destructive-outline"
+                :disabled="pluginBusy || removingPlugin === row.failure.directory"
+                @click="askRemovePluginType(row.failure.directory, row.failure.directory)"
+              >
+                <Loader2 v-if="removingPlugin === row.failure.directory" class="animate-spin" aria-hidden="true" />
+                <Trash2 v-else :size="15" aria-hidden="true" />
+                {{ t('settings.system.requests.indexers.plugins.removeAction') }}
+              </Button>
+            </div>
+
+            <!-- Installed, never filled in. The row it will become, with the step that gets it there. -->
+            <div v-else-if="row.kind === 'pending'" class="flex flex-wrap items-start justify-between gap-3 bg-card px-4 py-3.5 md:px-5 md:py-4">
+              <div class="flex min-w-0 flex-1 basis-72 gap-3">
+                <span class="flex size-8 shrink-0 items-center justify-center rounded-lg bg-muted text-muted-foreground" aria-hidden="true">
+                  <Plug :size="17" />
+                </span>
+                <div class="min-w-0">
+                  <div class="flex flex-wrap items-center gap-2">
+                    <p class="settings-label">{{ row.adapter.label }}</p>
+                    <PluginVersionBadge :version="row.adapter.version" />
+                    <span class="rounded-full bg-muted px-2 py-0.5 text-[11px] font-medium text-muted-foreground">
+                      {{ t('settings.system.requests.indexers.plugins.notSetUp') }}
+                    </span>
+                  </div>
+                  <p class="mt-1 font-mono text-xs break-all text-muted-foreground">{{ row.adapter.type }}</p>
+                </div>
+              </div>
+
+              <div class="flex shrink-0 items-center gap-1.5">
+                <Button
+                  size="sm"
+                  variant="outline"
+                  :aria-label="t('settings.system.requests.indexers.plugins.configureAria', { label: row.adapter.label })"
+                  @click="startCreateFor(row.adapter.type)"
+                >
+                  {{ t('settings.system.requests.indexers.plugins.configure') }}
+                </Button>
+
+                <TooltipProvider v-if="canInstallPlugins" :delay-duration="0">
+                  <span class="mx-0.5 h-5 w-px bg-border" aria-hidden="true"></span>
+                  <Tooltip>
+                    <TooltipTrigger as-child>
+                      <Button
+                        size="icon-sm"
+                        variant="outline"
+                        :disabled="pluginBusy || removingPlugin === row.adapter.type"
+                        :aria-label="t('settings.system.requests.indexers.plugins.update')"
+                        @click="startPluginUpdate(row.adapter)"
+                      >
+                        <Upload :size="15" aria-hidden="true" />
+                      </Button>
+                    </TooltipTrigger>
+                    <TooltipContent>{{ t('settings.system.requests.indexers.plugins.update') }}</TooltipContent>
+                  </Tooltip>
+                  <Tooltip>
+                    <TooltipTrigger as-child>
+                      <Button
+                        size="icon-sm"
+                        variant="destructive-outline"
+                        :disabled="pluginBusy || removingPlugin === row.adapter.type"
+                        :aria-label="t('settings.system.requests.indexers.plugins.removeAction')"
+                        @click="askRemovePlugin(row.adapter)"
+                      >
+                        <Loader2 v-if="removingPlugin === row.adapter.type" class="animate-spin" aria-hidden="true" />
+                        <Trash2 v-else :size="15" aria-hidden="true" />
+                      </Button>
+                    </TooltipTrigger>
+                    <TooltipContent>{{ t('settings.system.requests.indexers.plugins.removeAction') }}</TooltipContent>
+                  </Tooltip>
+                </TooltipProvider>
+              </div>
+            </div>
+
+            <RequestSourceRow
+              v-else
+              plugin
+              :indexer="row.indexer"
+              :testing="testingId === row.indexer.id"
+              :busy="togglingId === row.indexer.id"
+              :available="isAvailable(row.indexer.adapterType)"
+              :plugin-version="adapterFor(row.indexer.adapterType)?.version"
+              :manage-plugin="canInstallPlugins"
+              :plugin-busy="pluginBusy || removingPlugin === row.indexer.adapterType"
+              @test="handleTest(row.indexer)"
+              @edit="startEdit(row.indexer)"
+              @toggle="handleToggleEnabled(row.indexer, $event)"
+              @update-plugin="handleRowPluginUpdate(row.indexer.adapterType)"
+              @remove-plugin="handleRowPluginRemove(row.indexer.adapterType)"
+            />
+          </li>
+        </ul>
+      </section>
+
+      <section aria-labelledby="request-indexers-heading" class="space-y-3">
+        <div>
+          <div class="flex min-h-8 items-center justify-between gap-2">
+            <h2 id="request-indexers-heading" class="settings-group-label mb-0">{{ t('settings.system.requests.indexers.title') }}</h2>
+            <Button v-if="torznabRows.length" size="sm" variant="outline" @click="startCreate">
+              <Plus :size="14" aria-hidden="true" />
+              {{ t('settings.system.requests.indexers.add') }}
+            </Button>
+          </div>
+
+          <p class="settings-hint settings-prose mt-1.5">{{ t('settings.system.requests.indexers.hint') }}</p>
+        </div>
+
+        <div v-if="!torznabRows.length" class="settings-empty-state flex flex-wrap items-center gap-x-4 gap-y-3 px-4 py-3.5 text-start md:px-5">
+          <span class="flex size-8 shrink-0 items-center justify-center rounded-lg bg-muted text-muted-foreground" aria-hidden="true">
+            <ServerIcon :size="17" />
+          </span>
+          <p role="status" class="min-w-56 flex-1 text-sm text-muted-foreground">
+            {{ t('settings.system.requests.indexers.none') }}
+          </p>
+          <Button size="sm" variant="outline" @click="startCreate">
+            <Plus :size="14" aria-hidden="true" />
+            {{ t('settings.system.requests.indexers.add') }}
+          </Button>
+        </div>
+
+        <ul v-else class="space-y-2">
+          <li v-for="indexer in torznabRows" :key="indexer.id" class="settings-card">
+            <RequestSourceRow
+              :indexer="indexer"
+              :testing="testingId === indexer.id"
+              :busy="togglingId === indexer.id"
+              :available="isAvailable(indexer.adapterType)"
+              @test="handleTest(indexer)"
+              @edit="startEdit(indexer)"
+              @toggle="handleToggleEnabled(indexer, $event)"
+            />
+          </li>
+        </ul>
+      </section>
+    </div>
+
+    <SettingsEditorSheet
+      v-if="draft"
+      :open="editorOpen"
+      :title="sheetTitle"
+      :description="t('settings.system.requests.indexers.editorDescription')"
+      :dirty="isDirty"
+      :busy="saving || removingPlugin !== null"
+      :removable="draft.id !== null && (editingPluginType === null || canInstallPlugins)"
+      :remove-label="
+        editingPluginType ? t('settings.system.requests.indexers.plugins.removeAction') : t('settings.system.requests.indexers.confirmDelete.confirm')
+      "
+      :remove-confirm="
+        editingPluginType
+          ? t('settings.system.requests.indexers.plugins.confirmRemove', { label: editingPlugin?.label ?? draft.name })
+          : t('settings.system.requests.indexers.confirmDelete.title')
+      "
+      :remove-consequence="
+        editingPluginType
+          ? t('settings.system.requests.indexers.plugins.removeWarning', { count: pluginUseCount })
+          : t('settings.system.requests.indexers.confirmDelete.description', { name: draft.name })
+      "
+      @save="handleSave"
+      @cancel="cancelEdit"
+      @remove="handleDelete"
+    >
+      <template #badge>
+        <span class="rounded-full bg-muted px-2 py-0.5 font-mono text-[11px] text-muted-foreground">
+          {{ draft.adapterType }}
+        </span>
+        <PluginVersionBadge v-if="currentAdapter && !currentAdapter.builtIn" :version="currentAdapter.version" />
+      </template>
+
+      <template #status>
+        <ConnectionHealth
+          v-if="editingIndexer"
+          :last-tested-at="editingIndexer.lastTestedAt"
+          :last-test-ok="editingIndexer.lastTestOk"
+          :enabled="editingIndexer.enabled"
+        />
+      </template>
+
+      <template #actions>
+        <TooltipProvider v-if="editingIndexer" :delay-duration="0">
+          <Tooltip>
+            <TooltipTrigger as-child>
+              <Button
+                size="icon-sm"
+                variant="outline"
+                class="aria-disabled:pointer-events-auto aria-disabled:opacity-50"
+                :disabled="testingId === editingIndexer.id"
+                :aria-disabled="isDirty || undefined"
+                :aria-label="testLabel"
+                @click="handleTestCurrent"
+              >
+                <Loader2 v-if="testingId === editingIndexer.id" class="animate-spin" aria-hidden="true" />
+                <Plug v-else :size="15" aria-hidden="true" />
+              </Button>
+            </TooltipTrigger>
+            <TooltipContent>{{ testLabel }}</TooltipContent>
+          </Tooltip>
+        </TooltipProvider>
+      </template>
+
+      <template #default>
+        <SettingsSection :title="t('settings.system.requests.sections.connection')">
+          <!-- The type is settled in the picker before this form exists, and is fixed afterwards:
+               a row carries that adapter's base URL, categories and settings, so swapping it here
+               would leave every one of them describing an adapter that no longer applies. It is
+               stated in the header badge instead. -->
+          <SettingsField :label="t('settings.system.requests.indexers.fields.name')" input-id="indexer-name" required :error="fieldErrors.name">
+            <template #default="{ describedBy, invalid }">
+              <input
+                id="indexer-name"
+                v-model="draft.name"
+                type="text"
+                class="settings-control"
+                autocomplete="off"
+                :aria-describedby="describedBy"
+                :aria-invalid="invalid || undefined"
+                @input="handleNameInput"
+              />
+            </template>
+          </SettingsField>
+
+          <SourceColorPicker v-model="draft.color" input-name="indexer-color" />
+
+          <SettingsField
+            :label="t('settings.system.requests.indexers.fields.baseUrl')"
+            input-id="indexer-url"
+            required
+            :brief="baseUrlHint(draft.adapterType)"
+            :error="fieldErrors.baseUrl"
+          >
+            <template #default="{ describedBy, invalid }">
+              <input
+                id="indexer-url"
+                v-model="draft.baseUrl"
+                type="url"
+                class="settings-control font-mono text-[13px]"
+                placeholder="https://indexer.example.com"
+                :aria-describedby="describedBy"
+                :aria-invalid="invalid || undefined"
+                @input="handleBaseUrlInput"
+              />
+            </template>
+          </SettingsField>
+
+          <SettingsField
+            v-if="currentAdapter?.credentialKind"
+            :label="t(`settings.system.requests.indexers.fields.credential.${currentAdapter.credentialKind}`)"
+            input-id="indexer-credential"
+            :brief="t('settings.system.requests.indexers.fields.credentialBrief')"
+            :error="fieldErrors.credential"
+          >
+            <template #default="{ describedBy, invalid }">
+              <div class="flex gap-2">
+                <!-- A tracker credential is not the BookOrbit login, so it must not be an
+                     input[type=password]: see `@/lib/secret-input`. -->
+                <input
+                  id="indexer-credential"
+                  v-model="draft.credential"
+                  v-bind="SECRET_INPUT_ATTRS"
+                  type="text"
+                  class="settings-control"
+                  :class="{ 'input-secret': !credentialVisible }"
+                  :disabled="draft.credentialCleared"
+                  :placeholder="
+                    draft.credentialCleared
+                      ? t('settings.system.requests.indexers.fields.credentialWillClear')
+                      : draft.id === null
+                        ? ''
+                        : t('settings.system.requests.indexers.fields.credentialKeep')
+                  "
+                  :aria-describedby="describedBy"
+                  :aria-invalid="invalid || undefined"
+                  @input="markCredentialTouched"
+                />
+                <Button v-if="!draft.credentialCleared" size="sm" variant="outline" class="h-9 shrink-0" @click="toggleCredentialVisible">
+                  {{ credentialVisible ? t('common.hide') : t('common.show') }}
+                </Button>
+                <Button v-if="canClearCredential" size="sm" variant="outline" class="h-9 shrink-0" @click="toggleClearCredential">
+                  {{
+                    draft.credentialCleared
+                      ? t('settings.system.requests.indexers.fields.credentialKeepAction')
+                      : t('settings.system.requests.indexers.fields.credentialClear')
+                  }}
+                </Button>
+              </div>
+            </template>
+          </SettingsField>
+        </SettingsSection>
+
+        <SettingsSection :title="t('settings.system.requests.sections.search')">
+          <fieldset v-if="canScopeMediaKinds">
+            <legend class="settings-label">{{ t('settings.system.requests.indexers.mediaKinds.label') }}</legend>
+            <p class="settings-hint">{{ t('settings.system.requests.indexers.mediaKinds.hint') }}</p>
+
+            <div class="mt-3 grid gap-3 sm:grid-cols-3">
+              <SettingsToggleField
+                v-for="mediaKind in BOOK_REQUEST_MEDIA_KINDS"
+                :key="mediaKind"
+                :model-value="isMediaKindSearched(mediaKind)"
+                :label="t(`bookRequests.mediaKind.${mediaKind}`)"
+                :input-id="`indexer-media-${mediaKind}`"
+                :disabled="!adapterCarries(mediaKind)"
+                :brief="adapterCarries(mediaKind) ? undefined : t('settings.system.requests.indexers.mediaKinds.notCarried')"
+                @update:model-value="toggleMediaKind(mediaKind)"
+              />
+            </div>
+          </fieldset>
+
+          <SettingsToggleField
+            v-if="currentAdapter?.supportsIsbnSearch"
+            v-model="draft.searchByIsbn"
+            :label="t('settings.system.requests.indexers.fields.searchByIsbn')"
+            input-id="indexer-search-by-isbn"
+            :brief="t('settings.system.requests.indexers.fields.searchByIsbnBrief')"
+          />
+
+          <div v-if="currentAdapter?.usesCategories" class="grid gap-4 sm:grid-cols-3">
+            <SettingsField
+              v-for="mediaKind in BOOK_REQUEST_MEDIA_KINDS"
+              :key="mediaKind"
+              class="sm:[&_.settings-hint]:whitespace-nowrap"
+              :label="t(`bookRequests.mediaKind.${mediaKind}`)"
+              :input-id="`indexer-categories-${mediaKind}`"
+              :brief="mediaKind === 'ebook' ? t('settings.system.requests.indexers.categories.brief') : undefined"
+            >
+              <template #default="{ describedBy }">
+                <ChipInput
+                  v-model="draft.categories[mediaKind]"
+                  :input-id="`indexer-categories-${mediaKind}`"
+                  :normalize="normalizeCategory"
+                  input-mode="numeric"
+                  control-class="min-h-9"
+                  :described-by="describedBy"
+                  placeholder="7020"
+                />
+              </template>
+            </SettingsField>
+          </div>
+        </SettingsSection>
+
+        <SettingsSection v-if="currentAdapter?.settingsFields.length" :title="t('settings.system.requests.sections.access')">
+          <template v-for="field in currentAdapter.settingsFields" :key="field.key">
+            <SettingsToggleField
+              v-if="field.type === 'boolean'"
+              :model-value="Boolean(draft.settings[field.key])"
+              :label="settingLabel(field)"
+              :input-id="`indexer-setting-${field.key}`"
+              :brief="field.hint"
+              @update:model-value="setSetting(field.key, $event)"
+            />
+
+            <SettingsField
+              v-else-if="field.format === 'list'"
+              :label="settingLabel(field)"
+              :input-id="`indexer-setting-${field.key}`"
+              :brief="field.hint"
+              :required="Boolean(field.minItems)"
+            >
+              <template #default="{ describedBy }">
+                <div v-if="field.options" class="space-y-2">
+                  <div
+                    :id="`indexer-setting-${field.key}`"
+                    role="group"
+                    class="flex flex-wrap gap-2"
+                    :aria-label="settingLabel(field)"
+                    :aria-describedby="describedBy"
+                  >
+                    <button
+                      v-for="option in field.options"
+                      :key="option"
+                      type="button"
+                      class="rounded-full border px-3 py-1.5 font-mono text-xs font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:cursor-not-allowed disabled:opacity-60"
+                      :class="
+                        isSettingOptionSelected(field, option)
+                          ? 'border-primary bg-primary/10 text-primary'
+                          : 'border-border text-muted-foreground hover:border-primary/50 hover:text-foreground'
+                      "
+                      :aria-pressed="isSettingOptionSelected(field, option)"
+                      :disabled="isSettingOptionLocked(field, option)"
+                      @click="toggleSettingOption(field, option)"
+                    >
+                      {{ option }}
+                    </button>
+                  </div>
+                  <button
+                    v-if="canRestoreSettingDefault(field)"
+                    type="button"
+                    class="text-xs text-muted-foreground underline-offset-2 hover:text-foreground hover:underline focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
+                    @click="restoreSettingDefault(field)"
+                  >
+                    {{ t('settings.system.requests.indexers.settings.restoreDefault') }}
+                  </button>
+                </div>
+                <ChipInput
+                  v-else
+                  :model-value="settingList(field)"
+                  :input-id="`indexer-setting-${field.key}`"
+                  control-class="min-h-9"
+                  :described-by="describedBy"
+                  @update:model-value="setSettingList(field, $event)"
+                />
+              </template>
+            </SettingsField>
+
+            <SettingsField v-else :label="settingLabel(field)" :input-id="`indexer-setting-${field.key}`" :brief="field.hint">
+              <template #default="{ describedBy }">
+                <input
+                  :id="`indexer-setting-${field.key}`"
+                  :type="field.type === 'number' ? 'number' : 'text'"
+                  :value="draft.settings[field.key] ?? ''"
+                  class="settings-control"
+                  :class="field.type === 'number' ? 'max-w-32' : ''"
+                  :aria-describedby="describedBy"
+                  @input="handleSettingInput(field, $event)"
+                />
+              </template>
+            </SettingsField>
+          </template>
+        </SettingsSection>
+
+        <SettingsSection :title="t('settings.system.requests.sections.availability')">
+          <div class="grid gap-4 sm:grid-cols-2">
+            <SettingsToggleField v-model="draft.enabled" :label="t('settings.system.requests.indexers.fields.enabled')" input-id="indexer-enabled" />
+            <SettingsToggleField
+              v-model="draft.allowPrivateAddress"
+              :label="t('settings.system.requests.indexers.fields.allowPrivateAddress')"
+              input-id="indexer-allow-private"
+              :brief="t('settings.system.requests.indexers.fields.allowPrivateAddressBrief')"
+            />
+          </div>
+        </SettingsSection>
+
+        <details class="border-t border-border pt-4" :open="Boolean(draft.resolvers.length || draft.proxyUrl)">
+          <summary class="settings-label cursor-pointer rounded focus-visible:ring-2 focus-visible:ring-ring/50 focus-visible:outline-none">
+            {{ t('settings.system.requests.indexers.network.title') }}
+          </summary>
+          <p class="settings-hint mt-1">{{ t('settings.system.requests.indexers.network.brief') }}</p>
+
+          <div class="mt-4 grid gap-4 sm:grid-cols-2">
+            <SettingsField
+              :label="t('settings.system.requests.indexers.network.resolvers')"
+              input-id="indexer-resolvers"
+              :brief="t('settings.system.requests.indexers.network.resolversBrief')"
+            >
+              <template #default="{ describedBy }">
+                <ChipInput
+                  v-model="draft.resolvers"
+                  input-id="indexer-resolvers"
+                  control-class="min-h-9"
+                  :described-by="describedBy"
+                  placeholder="1.1.1.1"
+                />
+              </template>
+            </SettingsField>
+
+            <SettingsField
+              :label="t('settings.system.requests.indexers.network.proxyUrl')"
+              input-id="indexer-proxy"
+              :brief="t('settings.system.requests.indexers.network.proxyHint')"
+            >
+              <template #default="{ describedBy }">
+                <input
+                  id="indexer-proxy"
+                  v-model="draft.proxyUrl"
+                  type="url"
+                  class="settings-control font-mono text-[13px]"
+                  placeholder="http://proxy.example.com:8080"
+                  :aria-describedby="describedBy"
+                />
+              </template>
+            </SettingsField>
+          </div>
+        </details>
+
+        <SettingsSection v-if="editingPluginType" :title="t('settings.system.requests.indexers.plugins.sectionTitle')">
+          <p class="text-xs">
+            <span class="font-mono break-all text-foreground">{{ editingPluginType }}</span>
+            <span class="ms-1 text-muted-foreground">&middot; {{ pluginUsage }}</span>
+          </p>
+          <p class="settings-hint">
+            {{
+              editingPlugin ? t('settings.system.requests.indexers.plugins.managedHint') : t('settings.system.requests.indexers.plugins.missingHint')
+            }}
+          </p>
+        </SettingsSection>
+      </template>
+    </SettingsEditorSheet>
+
+    <ConfirmDialog
+      :open="pluginPendingRemoval !== null"
+      :title="t('settings.system.requests.indexers.plugins.confirmRemove', { label: pluginPendingRemoval?.label ?? '' })"
+      :description="
+        pendingRemovalUsage > 0
+          ? t('settings.system.requests.indexers.plugins.removeWarning', { count: pendingRemovalUsage })
+          : t('settings.system.requests.indexers.plugins.removeUnusedWarning')
+      "
+      :confirm-label="t('settings.system.requests.indexers.plugins.removeAction')"
+      :busy="removingPlugin !== null"
+      @confirm="confirmRemovePlugin"
+      @cancel="cancelRemovePlugin"
+    />
+
+    <!--
+      The source is shown rather than summarised. Installing a plugin runs its code in the server
+      process, and one dependency-free file is what makes reading it first a realistic thing to ask.
+    -->
+    <SettingsEditorSheet
+      :open="pluginReview !== null"
+      :title="
+        pluginReview?.replaces
+          ? t('settings.system.requests.indexers.plugins.replaceTitle')
+          : t('settings.system.requests.indexers.plugins.reviewTitle')
+      "
+      :description="t('settings.system.requests.indexers.plugins.reviewDescription')"
+      :busy="pluginBusy"
+      @save="confirmPluginInstall"
+      @cancel="cancelPluginInstall"
+    >
+      <template v-if="pluginReview" #default>
+        <SettingsSection :title="t('settings.system.requests.indexers.plugins.declares')">
+          <dl class="grid gap-2 text-sm sm:grid-cols-2">
+            <div>
+              <dt class="settings-hint">{{ t('settings.system.requests.indexers.fields.name') }}</dt>
+              <dd class="text-foreground">{{ pluginReview.label }}</dd>
+            </div>
+            <div>
+              <dt class="settings-hint">{{ t('settings.system.requests.indexers.plugins.type') }}</dt>
+              <dd class="text-foreground">{{ pluginReview.type }}</dd>
+            </div>
+            <div>
+              <dt class="settings-hint">{{ t('settings.system.requests.indexers.plugins.version') }}</dt>
+              <dd class="text-foreground">
+                {{ pluginReview.version ?? t('settings.system.requests.indexers.plugins.versionUnknownValue') }}
+              </dd>
+            </div>
+            <div>
+              <dt class="settings-hint">{{ t('settings.system.requests.indexers.plugins.media') }}</dt>
+              <dd class="text-foreground">{{ pluginReview.mediaKinds.join(', ') }}</dd>
+            </div>
+            <div>
+              <dt class="settings-hint">{{ t('settings.system.requests.indexers.plugins.credential') }}</dt>
+              <dd class="text-foreground">
+                {{
+                  pluginReview.requiresCredential
+                    ? t('settings.system.requests.indexers.plugins.credentialRequired')
+                    : t('settings.system.requests.indexers.plugins.credentialNone')
+                }}
+              </dd>
+            </div>
+          </dl>
+
+          <p role="alert" class="settings-hint text-destructive">
+            {{ t('settings.system.requests.indexers.plugins.trustWarning') }}
+          </p>
+          <p v-if="pluginReview.replaces" role="status" class="settings-hint text-primary">
+            {{ t('settings.system.requests.indexers.plugins.replaces', { type: pluginReview.type }) }}
+          </p>
+        </SettingsSection>
+
+        <SettingsSection :title="t('settings.system.requests.indexers.plugins.source')">
+          <pre
+            class="max-h-96 overflow-auto rounded-lg border border-border bg-muted/40 p-3 text-xs text-foreground"
+          ><code>{{ pluginReview.source }}</code></pre>
+        </SettingsSection>
+      </template>
+
+      <!-- This step runs code rather than saving a form, so the action says which of the two it is. -->
+      <template #footer="{ requestClose }">
+        <div class="flex items-center gap-2">
+          <Button size="sm" :disabled="pluginBusy" @click="confirmPluginInstall">
+            <Loader2 v-if="pluginBusy" class="animate-spin" aria-hidden="true" />
+            {{
+              pluginReview?.replaces
+                ? t('settings.system.requests.indexers.plugins.replace')
+                : t('settings.system.requests.indexers.plugins.confirmInstall')
+            }}
+          </Button>
+          <Button size="sm" variant="outline" :disabled="pluginBusy" @click="requestClose">{{ t('common.cancel') }}</Button>
+        </div>
+      </template>
+    </SettingsEditorSheet>
+  </div>
+</template>
diff --git a/client/src/features/settings/RequestsSettings.vue b/client/src/features/settings/RequestsSettings.vue
new file mode 100644
index 000000000..8951d03b2
--- /dev/null
+++ b/client/src/features/settings/RequestsSettings.vue
@@ -0,0 +1,77 @@
+<script setup lang="ts">
+import { computed, ref } from 'vue'
+import { useI18n } from 'vue-i18n'
+import DownloadClientsPanel from './DownloadClientsPanel.vue'
+import RequestAutomationPanel from './RequestAutomationPanel.vue'
+import RequestIndexersPanel from './RequestIndexersPanel.vue'
+import SettingsPageHeader from './SettingsPageHeader.vue'
+import SettingsTabs from './components/SettingsTabs.vue'
+import { useRouteTab } from '@/composables/useRouteTab'
+
+const { t } = useI18n()
+withDefaults(defineProps<{ embedded?: boolean }>(), { embedded: false })
+
+/**
+ * The three things this page configures, in the order a release passes through them: where it is
+ * found, what fetches it, and what happens once it lands. Stacked, they were one long scroll whose
+ * middle looked like a continuation of its top.
+ */
+const TABS = ['sources', 'clients', 'automation'] as const
+type Tab = (typeof TABS)[number]
+
+function normalizeTab(value: unknown): Tab {
+  return typeof value === 'string' && TABS.includes(value as Tab) ? (value as Tab) : 'sources'
+}
+
+const tabs = computed(() => [
+  { id: 'sources' as const, label: t('settings.system.requests.tabs.sources') },
+  { id: 'clients' as const, label: t('settings.system.requests.tabs.clients') },
+  { id: 'automation' as const, label: t('settings.system.requests.tabs.automation') },
+])
+const { activeTab, selectTab } = useRouteTab<Tab>({
+  routeName: 'settings-admin-requests',
+  normalize: normalizeTab,
+  availableTabs: TABS,
+  fallback: 'sources',
+})
+
+/**
+ * One instance-level fact, reported by whichever panel loads it. Said up front rather than as a
+ * 400 after the operator has typed a credential into a form.
+ */
+const encryptionConfigured = ref(true)
+
+function handleEncryptionState(configured: boolean) {
+  encryptionConfigured.value = configured
+}
+</script>
+
+<template>
+  <SettingsPageHeader
+    v-if="!embedded"
+    class="hidden md:flex"
+    :title="t('settings.system.requests.title')"
+    :subtitle="t('settings.system.requests.subtitle')"
+  />
+
+  <div class="space-y-6" :class="{ 'mt-5 md:mt-0': !embedded }">
+    <!--
+      The intro is a statement about sources, so it belongs to that tab rather than above all three,
+      and the Sources tab states it in its own words while there is nothing configured yet.
+    -->
+    <p v-if="!encryptionConfigured" role="alert" class="settings-hint text-destructive">
+      {{ t('settings.system.requests.encryptionKeyMissing') }}
+    </p>
+
+    <SettingsTabs :tabs="tabs" :active-tab="activeTab" @select="selectTab" />
+
+    <RequestIndexersPanel v-if="activeTab === 'sources'" @encryption-state="handleEncryptionState" />
+    <DownloadClientsPanel v-else-if="activeTab === 'clients'" @encryption-state="handleEncryptionState" />
+    <!-- Narrower than the rest of the page: this tab is mostly prose, and a switch explaining
+         itself over the full width of a list view is a line too long to read comfortably. Wrapped
+         rather than passed as a class, because the panel has a v-if root and would not inherit it. -->
+    <div v-else class="max-w-3xl">
+      <RequestAutomationPanel />
+    </div>
+  </div>
+</template>
diff --git a/client/src/features/settings/SearchHealth.vue b/client/src/features/settings/SearchHealth.vue
new file mode 100644
index 000000000..954e2b0e7
--- /dev/null
+++ b/client/src/features/settings/SearchHealth.vue
@@ -0,0 +1,54 @@
+<script setup lang="ts">
+import { computed } from 'vue'
+import { useI18n } from 'vue-i18n'
+import { SearchX } from '@lucide/vue'
+import { formatDateTime, formatNumber, formatRelativeFromNow } from '@/i18n/formatters'
+
+/**
+ * How this source has been behaving in real searches, which is a different question from what the
+ * Test button answers: a caps call can succeed against a tracker that has refused every search
+ * since Tuesday, and the picker's live failure list stops existing the moment the drawer closes.
+ *
+ * Shown only while a source is failing. A green badge beside the connection badge would be two
+ * ticks saying almost the same thing, and the one worth interrupting an operator for is the run
+ * of failures nobody has watched happen.
+ */
+const props = defineProps<{
+  lastSearchAt: string | null
+  lastSearchOk: boolean | null
+  searchFailureStreak: number
+  enabled: boolean
+}>()
+
+const { t } = useI18n()
+
+/** A disabled source is not failing; nothing is searching it. */
+const failing = computed(() => props.enabled && props.lastSearchOk === false && props.searchFailureStreak > 0)
+
+const relative = computed(() => (props.lastSearchAt === null ? null : formatRelativeFromNow(new Date(props.lastSearchAt))))
+const exact = computed(() => (props.lastSearchAt === null ? undefined : formatDateTime(new Date(props.lastSearchAt))))
+
+/**
+ * One failure is noise a retry usually clears; a run of them is the fact worth naming, and the
+ * count is what separates the two at a glance.
+ */
+const label = computed(() =>
+  props.searchFailureStreak > 1
+    ? t('settings.system.requests.searchHealth.failingStreak', { count: formatNumber(props.searchFailureStreak) })
+    : t('settings.system.requests.searchHealth.failingOnce'),
+)
+</script>
+
+<template>
+  <span v-if="failing" class="inline-flex items-center gap-1.5">
+    <span
+      class="inline-flex h-[22px] items-center gap-1.5 rounded-full border border-warning/40 bg-warning/10 px-2 text-xs font-medium whitespace-nowrap text-foreground"
+    >
+      <SearchX :size="12" class="text-warning" aria-hidden="true" />
+      {{ label }}
+    </span>
+    <span v-if="relative" class="text-xs text-muted-foreground" :title="exact">
+      {{ t('settings.system.requests.searchHealth.lastSearchAt', { time: relative }) }}
+    </span>
+  </span>
+</template>
diff --git a/client/src/features/settings/__tests__/ConnectionHealth.spec.ts b/client/src/features/settings/__tests__/ConnectionHealth.spec.ts
new file mode 100644
index 000000000..ea3eb573c
--- /dev/null
+++ b/client/src/features/settings/__tests__/ConnectionHealth.spec.ts
@@ -0,0 +1,47 @@
+import { mount } from '@vue/test-utils'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import ConnectionHealth from '../ConnectionHealth.vue'
+
+const NOW = new Date('2026-08-19T12:00:00Z')
+
+function render(props: { lastTestedAt: string | null; lastTestOk: boolean | null; enabled: boolean }) {
+  return mount(ConnectionHealth, { props })
+}
+
+describe('ConnectionHealth', () => {
+  beforeEach(() => {
+    vi.useFakeTimers()
+    vi.setSystemTime(NOW)
+  })
+
+  afterEach(() => vi.useRealTimers())
+
+  it('reads a passing test as connected', () => {
+    const wrapper = render({ lastTestedAt: '2026-08-19T11:54:00Z', lastTestOk: true, enabled: true })
+    expect(wrapper.text()).toContain('Connected')
+  })
+
+  it('reads a failing test as not reachable', () => {
+    const wrapper = render({ lastTestedAt: '2026-08-19T11:54:00Z', lastTestOk: false, enabled: true })
+    expect(wrapper.text()).toContain('Not reachable')
+  })
+
+  it('says never tested rather than inventing a state', () => {
+    const wrapper = render({ lastTestedAt: null, lastTestOk: null, enabled: true })
+    expect(wrapper.text()).toContain('Never tested')
+    expect(wrapper.text()).not.toContain('ago')
+  })
+
+  it('lets disabled outrank a stale pass, because nothing will call it', () => {
+    const wrapper = render({ lastTestedAt: '2026-08-19T11:54:00Z', lastTestOk: true, enabled: false })
+    expect(wrapper.text()).toContain('Disabled')
+    expect(wrapper.text()).not.toContain('Connected')
+  })
+
+  it('states recency relatively and keeps the exact time one hover away', () => {
+    const wrapper = render({ lastTestedAt: '2026-08-19T11:54:00Z', lastTestOk: false, enabled: true })
+
+    expect(wrapper.text()).toContain('failed 6 minutes ago')
+    expect(wrapper.find('[title]').attributes('title')).toBeTruthy()
+  })
+})
diff --git a/client/src/features/settings/__tests__/DownloadClientsPanel.spec.ts b/client/src/features/settings/__tests__/DownloadClientsPanel.spec.ts
new file mode 100644
index 000000000..05df80a61
--- /dev/null
+++ b/client/src/features/settings/__tests__/DownloadClientsPanel.spec.ts
@@ -0,0 +1,282 @@
+import { flushPromises, mount, type VueWrapper } from '@vue/test-utils'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { DownloadClientItem } from '@bookorbit/types'
+
+const { apiMock, toastMock } = vi.hoisted(() => ({
+  apiMock: vi.fn<(url: string, init?: RequestInit) => Promise<Response>>(),
+  toastMock: { success: vi.fn<(message: string) => void>(), error: vi.fn<(message: string) => void>() },
+}))
+
+vi.mock('@/lib/api', () => ({ api: apiMock }))
+vi.mock('vue-sonner', () => ({ toast: toastMock }))
+
+import DownloadClientsPanel from '../DownloadClientsPanel.vue'
+
+function client(overrides: Partial<DownloadClientItem> = {}): DownloadClientItem {
+  return {
+    id: 1,
+    name: 'My qBittorrent',
+    color: null,
+    adapterType: 'qbittorrent',
+    enabled: true,
+    priority: 1,
+    baseUrl: 'http://127.0.0.1:8080',
+    username: 'admin',
+    hasPassword: true,
+    category: 'bookorbit',
+    useHardlinks: true,
+    allowPrivateAddress: true,
+    // Required since a client without one declares no directory the import may read out of.
+    pathMappings: [{ id: 1, remotePath: '/downloads', localPath: '/data/torrents' }],
+    lastTestedAt: null,
+    lastTestOk: null,
+    lastErrorMessage: null,
+    createdAt: '2026-08-19T00:00:00.000Z',
+    updatedAt: '2026-08-19T00:00:00.000Z',
+    ...overrides,
+  } as DownloadClientItem
+}
+
+function response(body: unknown, ok = true): Response {
+  return { ok, status: ok ? 200 : 500, json: vi.fn<() => Promise<unknown>>().mockResolvedValue(body) } as unknown as Response
+}
+
+async function mountPanel(clients: DownloadClientItem[] = []) {
+  apiMock.mockImplementation(() => Promise.resolve(response({ clients, encryptionConfigured: true })))
+  const wrapper = mount(DownloadClientsPanel)
+  await flushPromises()
+  return wrapper
+}
+
+/** The editor renders through DialogPortal, so it lands on the body rather than in the wrapper. */
+function sheet(): HTMLElement {
+  const el = document.body.querySelector('[role="dialog"]')
+  if (el === null) throw new Error('no editor sheet is open')
+  return el as HTMLElement
+}
+
+function clickInSheet(text: string) {
+  const button = [...sheet().querySelectorAll('button')].find((candidate) => (candidate.textContent ?? '').includes(text))
+  if (button === undefined) throw new Error(`no button labelled "${text}" in the sheet`)
+  button.click()
+}
+
+async function clickInPanel(wrapper: VueWrapper, text: string) {
+  const button = wrapper.findAll('button').find((candidate) => candidate.text().includes(text))
+  if (button === undefined) throw new Error(`no button labelled "${text}" in the panel`)
+  await button.trigger('click')
+  await flushPromises()
+}
+
+function typeInto(selector: string, value: string) {
+  const input = sheet().querySelector<HTMLInputElement>(selector)
+  if (input === null) throw new Error(`no field matching ${selector}`)
+  input.value = value
+  input.dispatchEvent(new Event('input', { bubbles: true }))
+}
+
+async function openCreate(wrapper: VueWrapper) {
+  await clickInPanel(wrapper, 'Add client')
+  await flushPromises()
+  // Creating now starts on the type step, so the form does not exist until one is chosen.
+  clickInSheet('Continue')
+  await flushPromises()
+}
+
+/** A save is refused without one, so anything testing a *different* rejection has to fill it in. */
+function fillMapping(remotePath = '/downloads', localPath = '/data/torrents') {
+  typeInto('#mapping-remote-0', remotePath)
+  typeInto('#mapping-local-0', localPath)
+}
+
+describe('DownloadClientsPanel', () => {
+  beforeEach(() => vi.clearAllMocks())
+  afterEach(() => {
+    document.body.innerHTML = ''
+  })
+
+  /**
+   * Every client that can be added is somebody else's program reached over the network, and which
+   * one it is decides what the form has to ask for, so the step earns itself once there are
+   * several. A direct file is fetched by BookOrbit itself and is deliberately not offered at all.
+   */
+  /**
+   * With no client the heading heads nothing, so the panel takes its place. The distinction it has
+   * to keep is that this is not a broken install: a direct HTTP download needs no client at all.
+   */
+  it('says what is missing rather than that nothing works, when no client is configured', async () => {
+    const wrapper = await mountPanel()
+
+    expect(wrapper.find('section[aria-labelledby="download-clients-heading"]').exists()).toBe(false)
+    expect(wrapper.text()).toContain('No download client yet')
+    expect(wrapper.text()).toContain('direct HTTP download')
+    expect(wrapper.findAll('button').filter((button) => button.text().includes('Add client'))).toHaveLength(1)
+  })
+
+  it('goes back to the list and its heading once a client exists', async () => {
+    const wrapper = await mountPanel([client()])
+
+    expect(wrapper.find('section[aria-labelledby="download-clients-heading"]').exists()).toBe(true)
+    expect(wrapper.text()).not.toContain('No download client yet')
+  })
+
+  it('asks which client this is before showing a form shaped for it', async () => {
+    const wrapper = await mountPanel()
+    await clickInPanel(wrapper, 'Add client')
+
+    expect([...sheet().querySelectorAll<HTMLInputElement>('input[name="download-client-type"]')].map((input) => input.value)).toEqual([
+      'qbittorrent',
+      'transmission',
+      'deluge',
+    ])
+    expect(sheet().querySelector('#download-client-name')).toBeNull()
+
+    clickInSheet('Continue')
+    await flushPromises()
+
+    expect(sheet().querySelector('#download-client-name')).not.toBeNull()
+    expect(sheet().querySelector('#download-client-url')).not.toBeNull()
+  })
+
+  it('keeps the list rendered while a row is being edited', async () => {
+    const wrapper = await mountPanel([client()])
+    await clickInPanel(wrapper, 'Edit My qBittorrent')
+
+    expect(wrapper.text()).toContain('My qBittorrent')
+    expect(sheet().querySelector<HTMLInputElement>('#download-client-name')?.value).toBe('My qBittorrent')
+  })
+
+  it('shows and saves the assigned client color', async () => {
+    const wrapper = await mountPanel([client({ color: 'orange' })])
+
+    expect(wrapper.find('[role="img"]').classes().join(' ')).toContain('--pill-source-orange')
+    await clickInPanel(wrapper, 'Edit My qBittorrent')
+
+    const green = sheet().querySelector<HTMLInputElement>('input[name="download-client-color"][value="green"]')
+    if (green === null) throw new Error('no green client color option')
+    green.click()
+    clickInSheet('Save')
+    await flushPromises()
+
+    const saveCall = apiMock.mock.calls.find(([, init]) => init?.method === 'PUT')
+    expect(JSON.parse(String(saveCall?.[1]?.body))).toMatchObject({ color: 'green' })
+  })
+
+  it('shows a rejected save under the field it belongs to instead of as a toast', async () => {
+    const wrapper = await mountPanel()
+    await openCreate(wrapper)
+    typeInto('#download-client-name', 'Taken')
+    typeInto('#download-client-url', 'http://localhost:8080')
+    fillMapping()
+    await flushPromises()
+
+    apiMock.mockImplementation((url: string, init?: RequestInit) =>
+      Promise.resolve(
+        init?.method === 'POST'
+          ? response({ errorCode: 'DOWNLOAD_CLIENT_URL_PRIVATE', message: 'private' }, false)
+          : response({ clients: [], encryptionConfigured: true }),
+      ),
+    )
+    clickInSheet('Save')
+    await flushPromises()
+
+    expect(sheet().querySelector('#download-client-url-error')?.textContent).toContain('private or local network')
+    expect(toastMock.error).not.toHaveBeenCalled()
+  })
+
+  /**
+   * The mapping declares the directory the import may read out of, so the server refuses a client
+   * without one. Saying so under the section beats letting the round trip come back with a 400.
+   */
+  it('refuses to save a client with no path mapping, and says so under the mappings section', async () => {
+    const wrapper = await mountPanel()
+    await openCreate(wrapper)
+    typeInto('#download-client-name', 'qbit')
+    typeInto('#download-client-url', 'http://localhost:8080')
+    await flushPromises()
+
+    clickInSheet('Save')
+    await flushPromises()
+
+    expect(sheet().textContent).toContain('Add at least one path mapping')
+    expect(apiMock.mock.calls.some(([, init]) => init?.method === 'POST')).toBe(false)
+  })
+
+  /** The single-host answer, which is a mapping rather than the absence of one. */
+  it('offers a mapping row to fill in as soon as the form opens', async () => {
+    const wrapper = await mountPanel()
+    await openCreate(wrapper)
+
+    expect(sheet().querySelector('#mapping-remote-0')).not.toBeNull()
+    expect(sheet().textContent).toContain('Same filesystem?')
+  })
+
+  /**
+   * An empty box means "keep", because that is what it looked like when the form opened. Sending
+   * the empty string wiped a working credential and the next grab failed with nothing saying why.
+   */
+  describe('stored password', () => {
+    async function editAndSave(wrapper: VueWrapper, act: () => void) {
+      await clickInPanel(wrapper, 'Edit My qBittorrent')
+      act()
+      await flushPromises()
+      clickInSheet('Save')
+      await flushPromises()
+      const saveCall = apiMock.mock.calls.find(([, init]) => init?.method === 'PUT')
+      return JSON.parse(String(saveCall?.[1]?.body)) as Record<string, unknown>
+    }
+
+    it('keeps it when a typed password is erased again', async () => {
+      const wrapper = await mountPanel([client()])
+
+      const body = await editAndSave(wrapper, () => {
+        typeInto('#download-client-password', 'hunter2')
+        typeInto('#download-client-password', '')
+      })
+
+      expect(body).not.toHaveProperty('password')
+    })
+
+    it('sends a typed password', async () => {
+      const wrapper = await mountPanel([client()])
+
+      const body = await editAndSave(wrapper, () => typeInto('#download-client-password', 'hunter2'))
+
+      expect(body).toMatchObject({ password: 'hunter2' })
+    })
+
+    it('removes it only when clearing is asked for outright', async () => {
+      const wrapper = await mountPanel([client()])
+
+      const body = await editAndSave(wrapper, () => clickInSheet('Clear'))
+
+      expect(body).toMatchObject({ password: '' })
+    })
+
+    it('offers no clearing on a client that has no stored password', async () => {
+      const wrapper = await mountPanel([client({ hasPassword: false })])
+      await clickInPanel(wrapper, 'Edit My qBittorrent')
+
+      expect([...sheet().querySelectorAll('button')].some((button) => (button.textContent ?? '').trim() === 'Clear')).toBe(false)
+    })
+  })
+
+  /** Test runs against the saved row, so a green tick for a draft would be a tick for old values. */
+  it('refuses to test while the draft differs from the saved client', async () => {
+    const wrapper = await mountPanel([client()])
+    await clickInPanel(wrapper, 'Edit My qBittorrent')
+
+    const savedTest = sheet().querySelector<HTMLButtonElement>('button[aria-label="Test connection"]')
+    expect(savedTest?.disabled).toBe(false)
+
+    typeInto('#download-client-url', 'http://127.0.0.1:9091')
+    await flushPromises()
+
+    expect(sheet().querySelector('button[aria-label="Test connection"]')).toBeNull()
+    const dirtyTest = sheet().querySelector<HTMLButtonElement>('button[aria-label="Save your changes before testing"]')
+    expect(dirtyTest?.getAttribute('aria-disabled')).toBe('true')
+    dirtyTest?.click()
+    await flushPromises()
+    expect(apiMock.mock.calls.some(([url, init]) => String(url).endsWith('/test') && init?.method === 'POST')).toBe(false)
+  })
+})
diff --git a/client/src/features/settings/__tests__/RequestAutomationPanel.spec.ts b/client/src/features/settings/__tests__/RequestAutomationPanel.spec.ts
new file mode 100644
index 000000000..5fa2cc3ed
--- /dev/null
+++ b/client/src/features/settings/__tests__/RequestAutomationPanel.spec.ts
@@ -0,0 +1,452 @@
+import { flushPromises, mount } from '@vue/test-utils'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { DEFAULT_BOOK_REQUEST_AUTOMATION_SETTINGS } from '@bookorbit/types'
+import type { BookRequestAutomationSettings } from '@bookorbit/types'
+
+const { apiMock } = vi.hoisted(() => ({ apiMock: vi.fn<(url: string, init?: RequestInit) => Promise<Response>>() }))
+
+vi.mock('@/lib/api', () => ({ api: apiMock }))
+vi.mock('vue-sonner', () => ({ toast: { success: vi.fn<(message: string) => void>(), error: vi.fn<(message: string) => void>() } }))
+
+import { toast } from 'vue-sonner'
+import RequestAutomationPanel from '../RequestAutomationPanel.vue'
+
+const PATH = '/api/v1/admin/book-request-automation'
+
+function settings(overrides: Partial<BookRequestAutomationSettings> = {}): BookRequestAutomationSettings {
+  return { ...DEFAULT_BOOK_REQUEST_AUTOMATION_SETTINGS, ...overrides }
+}
+
+function response(body: unknown, ok = true): Response {
+  return { ok, status: ok ? 200 : 500, json: vi.fn<() => Promise<unknown>>().mockResolvedValue(body) } as unknown as Response
+}
+
+async function mountPanel(loaded: BookRequestAutomationSettings = settings()) {
+  apiMock.mockImplementation(async (url) => {
+    if (url === '/api/v1/admin/request-indexers') {
+      return response({
+        indexers: [
+          { id: 11, name: 'Public books' },
+          { id: 12, name: 'Private books' },
+        ],
+        encryptionConfigured: true,
+      })
+    }
+    if (url === '/api/v1/book-requests/source-status') return response({ configured: 2, enabled: 2 })
+    return response(loaded)
+  })
+  const wrapper = mount(RequestAutomationPanel)
+  await flushPromises()
+  return wrapper
+}
+
+function lastBody(): Record<string, unknown> {
+  const [, init] = apiMock.mock.calls.at(-1)!
+  return JSON.parse(String(init?.body)) as Record<string, unknown>
+}
+
+function sentBodies(): Record<string, unknown>[] {
+  return apiMock.mock.calls.filter(([, init]) => init?.body).map(([, init]) => JSON.parse(String(init?.body)) as Record<string, unknown>)
+}
+
+/** What the panel has switched off, named so a diff says which control changed rather than how many. */
+function disabledControls(wrapper: ReturnType<typeof mount>): string[] {
+  return wrapper
+    .findAll('input, select, button')
+    .filter((control) => control.attributes('disabled') !== undefined)
+    .map((control) => control.attributes('aria-label') ?? control.attributes('name') ?? control.attributes('type') ?? control.element.tagName)
+}
+
+/** A save the test holds open, so the panel can be inspected mid-flight. */
+function heldSave(body: BookRequestAutomationSettings): () => void {
+  let release!: () => void
+  const held = new Promise<void>((resolve) => {
+    release = resolve
+  })
+  apiMock.mockImplementationOnce(async () => {
+    await held
+    return response(body)
+  })
+  return release
+}
+
+describe('RequestAutomationPanel', () => {
+  beforeEach(() => vi.clearAllMocks())
+
+  it('loads the settings the instance is actually running', async () => {
+    await mountPanel()
+
+    expect(apiMock).toHaveBeenCalledWith(PATH)
+  })
+
+  /** Unattended grabbing is off out of the box, so its knobs are not there to be fiddled with. */
+  it('keeps the score floor out of the way until unattended grabbing is on', async () => {
+    const wrapper = await mountPanel()
+
+    expect(wrapper.text()).not.toContain('Minimum release score')
+
+    const enabled = await mountPanel(settings({ autoGrabEnabled: true }))
+    expect(enabled.text()).toContain('Minimum release score')
+  })
+
+  /**
+   * The card header answers "what will this server do to my requests" without the reader having to
+   * assemble it from four separate settings, so it has to track all of them.
+   */
+  describe('the summary each card leads with', () => {
+    it('reports the picker is the only route while unattended grabbing is off', async () => {
+      const wrapper = await mountPanel()
+
+      expect(wrapper.text()).toContain('Every approved request waits for a person to open the release picker')
+    })
+
+    it('names the floor and how many releases will be tried', async () => {
+      const wrapper = await mountPanel(settings({ autoGrabEnabled: true, autoRetryEnabled: true, maxAutoGrabAttempts: 3 }))
+
+      expect(wrapper.text()).toContain('scores 80 or more')
+      expect(wrapper.text()).toContain('Up to 3 releases are tried')
+    })
+
+    it('drops the retry clause when a failure is the end of it', async () => {
+      const wrapper = await mountPanel(settings({ autoGrabEnabled: true, autoRetryEnabled: false }))
+
+      expect(wrapper.text()).toContain('If it fails, the request waits for a person')
+      expect(wrapper.text()).not.toContain('releases are tried')
+    })
+
+    /** Dragging is the moment the number means something, so the sentence cannot wait for the save. */
+    it('follows the slider before anything is saved', async () => {
+      const wrapper = await mountPanel(settings({ autoGrabEnabled: true }))
+      apiMock.mockClear()
+
+      // `setValue` fires the change the panel saves on; a drag in progress is only ever `input`.
+      const slider = wrapper.get('#auto-grab-min-score')
+      ;(slider.element as HTMLInputElement).value = '95'
+      await slider.trigger('input')
+
+      expect(wrapper.text()).toContain('scores 95 or more')
+      expect(apiMock).not.toHaveBeenCalled()
+    })
+  })
+
+  it('sends only the knob that moved', async () => {
+    const wrapper = await mountPanel(settings({ autoGrabEnabled: true }))
+
+    await wrapper.get('input[type="number"]').setValue(2)
+    await wrapper.get('input[type="number"]').trigger('change')
+    await flushPromises()
+
+    expect(lastBody()).toEqual({ maxAutoGrabAttempts: 2 })
+  })
+
+  /** A cleared box is not an instruction to set the attempt limit to nothing. */
+  it('puts an unusable attempt count back rather than posting it for a 400', async () => {
+    const wrapper = await mountPanel(settings({ autoGrabEnabled: true }))
+    apiMock.mockClear()
+
+    // `setValue` on a number box already fires the change the component listens for.
+    const box = wrapper.get('input[type="number"]')
+    await box.setValue('')
+    await flushPromises()
+
+    expect(apiMock).not.toHaveBeenCalled()
+    expect((box.element as HTMLInputElement).value).toBe(String(DEFAULT_BOOK_REQUEST_AUTOMATION_SETTINGS.maxAutoGrabAttempts))
+  })
+
+  /**
+   * The wanted list. A request is looked for once when it is approved; without this one, a book
+   * declined for want of a good enough release - or one whose first release is posted next month -
+   * sits at approved forever looking like work somebody already took.
+   */
+  describe('keeping looking for requests nothing was found for', () => {
+    it('stays out of the way until unattended grabbing is on', async () => {
+      const wrapper = await mountPanel()
+
+      expect(wrapper.text()).not.toContain('Keep looking')
+    })
+
+    it('holds its two knobs back until it is switched on', async () => {
+      const wrapper = await mountPanel(settings({ autoGrabEnabled: true }))
+
+      expect(wrapper.text()).toContain('Keep looking')
+      expect(wrapper.find('#auto-search-interval').exists()).toBe(false)
+      expect(wrapper.find('#auto-search-max-age').exists()).toBe(false)
+    })
+
+    it('shows the schedule the instance is running', async () => {
+      const wrapper = await mountPanel(
+        settings({ autoGrabEnabled: true, autoSearchEnabled: true, autoSearchIntervalHours: 12, autoSearchMaxAgeDays: 90 }),
+      )
+
+      expect((wrapper.get('#auto-search-interval').element as HTMLInputElement).value).toBe('12')
+      expect((wrapper.get('#auto-search-max-age').element as HTMLInputElement).value).toBe('90')
+    })
+
+    it('sends only the knob that moved', async () => {
+      const wrapper = await mountPanel(settings({ autoGrabEnabled: true, autoSearchEnabled: true }))
+      apiMock.mockClear()
+
+      await wrapper.get('#auto-search-interval').setValue('6')
+      await flushPromises()
+
+      expect(lastBody()).toEqual({ autoSearchIntervalHours: 6 })
+    })
+
+    /** A cleared box is not an instruction to search continuously, and the spinner does not clamp. */
+    it.each([
+      ['#auto-search-interval', '', String(DEFAULT_BOOK_REQUEST_AUTOMATION_SETTINGS.autoSearchIntervalHours)],
+      ['#auto-search-interval', '0', String(DEFAULT_BOOK_REQUEST_AUTOMATION_SETTINGS.autoSearchIntervalHours)],
+      ['#auto-search-max-age', '9000', String(DEFAULT_BOOK_REQUEST_AUTOMATION_SETTINGS.autoSearchMaxAgeDays)],
+    ])('puts an unusable %s value back rather than posting it for a 400', async (selector, typed, restored) => {
+      const wrapper = await mountPanel(settings({ autoGrabEnabled: true, autoSearchEnabled: true }))
+      apiMock.mockClear()
+
+      const box = wrapper.get(selector)
+      await box.setValue(typed)
+      await flushPromises()
+
+      expect(apiMock).not.toHaveBeenCalled()
+      expect((box.element as HTMLInputElement).value).toBe(restored)
+    })
+  })
+
+  it('offers the verification threshold whether or not anything is automated', async () => {
+    const wrapper = await mountPanel()
+
+    expect(wrapper.text()).toContain('Verification threshold')
+    expect((wrapper.get('#request-verification-threshold').element as HTMLInputElement).value).toBe('70')
+  })
+
+  /**
+   * Off is the operator choosing to trust the grab, so the threshold it would have been measured
+   * against is not a knob any more. It stays stored, and comes back with the number they tuned.
+   */
+  it('puts the threshold away when import checking is switched off', async () => {
+    const wrapper = await mountPanel(settings({ verificationEnabled: false }))
+
+    expect(wrapper.text()).not.toContain('Verification threshold')
+    expect(wrapper.text()).toContain('Nothing is held for review')
+  })
+
+  it('sends the mode when the checking switch is thrown', async () => {
+    const wrapper = await mountPanel()
+    apiMock.mockResolvedValue(response(settings({ verificationEnabled: false })))
+
+    const switches = wrapper.findAll('[role="switch"]')
+    await switches[switches.length - 1].trigger('click')
+    await flushPromises()
+
+    expect(lastBody()).toEqual({ verificationEnabled: false })
+  })
+
+  it('adopts whatever the server reports back rather than what was typed', async () => {
+    const wrapper = await mountPanel(settings({ autoGrabEnabled: true }))
+    apiMock.mockResolvedValue(response(settings({ autoGrabEnabled: true, verificationThreshold: 85 })))
+
+    const slider = wrapper.findAll('input[type="range"]').at(-1)!
+    await slider.setValue(90)
+    await slider.trigger('change')
+    await flushPromises()
+
+    expect((wrapper.get('#request-verification-threshold').element as HTMLInputElement).value).toBe('85')
+  })
+
+  /**
+   * One shared saving flag used to disable all seventeen controls for the round trip, so moving
+   * any one knob greyed out the whole panel and dropped focus to the document.
+   */
+  it('leaves every other control alone while a save is in flight', async () => {
+    const wrapper = await mountPanel(settings({ autoGrabEnabled: true }))
+    const before = disabledControls(wrapper)
+    const release = heldSave(settings({ autoGrabEnabled: true }))
+
+    await wrapper.findAll('[role="switch"]')[1]!.trigger('click')
+
+    expect(disabledControls(wrapper)).toEqual(before)
+
+    release()
+    await flushPromises()
+  })
+
+  /** Refusing the second change lost it, and told the operator their save had failed. */
+  it('queues a knob moved mid-save rather than reporting it failed', async () => {
+    const wrapper = await mountPanel()
+    apiMock.mockClear()
+    const release = heldSave(settings({ verificationEnabled: false }))
+    apiMock.mockResolvedValue(response(settings({ verificationEnabled: false, importFormats: 'preferred' })))
+
+    const switches = wrapper.findAll('[role="switch"]')
+    await switches[switches.length - 1]!.trigger('click')
+    await wrapper.findAll('input[name="import-formats"]')[1]!.trigger('change')
+    await flushPromises()
+
+    expect(sentBodies()).toEqual([{ verificationEnabled: false }])
+
+    release()
+    await flushPromises()
+
+    expect(sentBodies()).toEqual([{ verificationEnabled: false }, { importFormats: 'preferred' }])
+    expect(toast.error).not.toHaveBeenCalled()
+  })
+
+  /**
+   * A tier is described by clicking through a row of chips, selects and number boxes, and each of
+   * those used to be its own PUT and its own "Saved" toast.
+   */
+  describe('release profiles', () => {
+    async function profilePanel() {
+      const wrapper = await mountPanel(
+        settings({ profiles: { ebook: [{ id: 'tier-1', name: 'Retail', conditions: {} }], audiobook: [], comic: [] } }),
+      )
+      apiMock.mockClear()
+      apiMock.mockResolvedValue(response(settings()))
+      return wrapper
+    }
+
+    /** The chip presses land on the editor, and one request lands on the server. */
+    it('collapses a burst of tier edits into one save', async () => {
+      vi.useFakeTimers()
+      try {
+        const wrapper = await profilePanel()
+        const chips = wrapper.findAll('button[aria-pressed]')
+
+        await chips[0]!.trigger('click')
+        await chips[1]!.trigger('click')
+        await chips[2]!.trigger('click')
+        expect(apiMock).not.toHaveBeenCalled()
+
+        await vi.advanceTimersByTimeAsync(1000)
+
+        expect(apiMock).toHaveBeenCalledTimes(1)
+        const profiles = lastBody().profiles as { ebook: { conditions: { formats: string[] } }[] }
+        expect(profiles.ebook[0]!.conditions.formats).toHaveLength(3)
+      } finally {
+        vi.useRealTimers()
+      }
+    })
+
+    it('says nothing on success, because the editor already shows the change', async () => {
+      vi.useFakeTimers()
+      try {
+        const wrapper = await profilePanel()
+
+        await wrapper.findAll('button[aria-pressed]')[0]!.trigger('click')
+        await vi.advanceTimersByTimeAsync(1000)
+
+        expect(toast.success).not.toHaveBeenCalled()
+      } finally {
+        vi.useRealTimers()
+      }
+    })
+
+    /** Both are evaluated by the matcher, and neither could be entered before. */
+    it('stores a size ceiling in bytes from a figure typed in megabytes', async () => {
+      vi.useFakeTimers()
+      try {
+        const wrapper = await profilePanel()
+        const boxes = wrapper.findAll('input[type="number"]')
+
+        await boxes[boxes.length - 1]!.setValue('700')
+        await vi.advanceTimersByTimeAsync(1000)
+
+        const profiles = lastBody().profiles as { ebook: { conditions: { maxSizeBytes: number } }[] }
+        expect(profiles.ebook[0]!.conditions.maxSizeBytes).toBe(700 * 1024 * 1024)
+      } finally {
+        vi.useRealTimers()
+      }
+    })
+
+    /**
+     * Driven the way a person drives it, one pick at a time. The multi-selects this replaced passed
+     * a `setValue([...])` that reached straight into `option.selected`, which is the one path a real
+     * browser never takes: Vue stringified the bound array and the second pick cleared the box.
+     */
+    it('authors language and source conditions that the matcher already supports', async () => {
+      vi.useFakeTimers()
+      try {
+        const wrapper = await profilePanel()
+
+        async function pick(field: string, ...labels: string[]) {
+          const input = wrapper.find(`input#tier-1-${field}`)
+          for (const label of labels) {
+            ;(input.element as HTMLInputElement).value = label
+            await input.trigger('input')
+            await input.trigger('keydown', { key: 'Enter' })
+          }
+        }
+
+        await pick('languages', 'English', 'French')
+        await pick('indexers', 'Public books', 'Private books')
+        await vi.advanceTimersByTimeAsync(1000)
+
+        const profiles = lastBody().profiles as {
+          ebook: { conditions: { languages: string[]; indexerIds: number[] } }[]
+        }
+        expect(profiles.ebook[0]!.conditions.languages).toEqual(['en', 'fr'])
+        expect(profiles.ebook[0]!.conditions.indexerIds).toEqual([11, 12])
+      } finally {
+        vi.useRealTimers()
+      }
+    })
+
+    it('does not let an unrelated save overwrite a profile waiting in the debounce window', async () => {
+      vi.useFakeTimers()
+      try {
+        const wrapper = await profilePanel()
+        const chip = wrapper.findAll('button[aria-pressed]')[0]!
+
+        await chip.trigger('click')
+        await wrapper.findAll('[role="switch"]').at(-1)!.trigger('click')
+        await flushPromises()
+
+        expect(chip.attributes('aria-pressed')).toBe('true')
+      } finally {
+        vi.useRealTimers()
+      }
+    })
+
+    it('flushes the last profile edit when the settings panel is left before the timer fires', async () => {
+      const wrapper = await profilePanel()
+
+      await wrapper.findAll('button[aria-pressed]')[0]!.trigger('click')
+      expect(apiMock).not.toHaveBeenCalled()
+      wrapper.unmount()
+      await flushPromises()
+
+      expect(apiMock).toHaveBeenCalledTimes(1)
+      expect(lastBody()).toHaveProperty('profiles.ebook')
+    })
+  })
+
+  describe('import formats', () => {
+    /**
+     * Neither value is the "off" one, so a toggle would have to pick a side to be off. The default
+     * is stated rather than implied by an unchecked box.
+     */
+    it('shows which format rule the instance is running', async () => {
+      const wrapper = await mountPanel(settings({ importFormats: 'preferred' }))
+      const radios = wrapper.findAll('input[name="import-formats"]')
+
+      expect(radios).toHaveLength(2)
+      expect((radios[1]!.element as HTMLInputElement).checked).toBe(true)
+    })
+
+    it('saves the rule the operator picked', async () => {
+      const wrapper = await mountPanel()
+      apiMock.mockResolvedValue(response(settings({ importFormats: 'preferred' })))
+
+      await wrapper.findAll('input[name="import-formats"]')[1]!.trigger('change')
+      await flushPromises()
+
+      expect(lastBody()).toEqual({ importFormats: 'preferred' })
+    })
+
+    it('explains what each rule keeps', async () => {
+      const text = (await mountPanel()).text()
+
+      expect(text).toContain('All available')
+      expect(text).toContain('Preferred only')
+      expect(text).toContain("destination library's format priority")
+    })
+  })
+})
diff --git a/client/src/features/settings/__tests__/RequestIndexersPanel.spec.ts b/client/src/features/settings/__tests__/RequestIndexersPanel.spec.ts
new file mode 100644
index 000000000..45809b363
--- /dev/null
+++ b/client/src/features/settings/__tests__/RequestIndexersPanel.spec.ts
@@ -0,0 +1,1098 @@
+import { flushPromises, mount, type VueWrapper } from '@vue/test-utils'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { INDEXER_COLORS, type IndexerAdapterDescriptor, type IndexerItem } from '@bookorbit/types'
+
+const { apiMock, toastMock, superuser } = vi.hoisted(() => ({
+  superuser: { value: true },
+  apiMock: vi.fn<(url: string, init?: RequestInit) => Promise<Response>>(),
+  toastMock: { success: vi.fn<(message: string) => void>(), error: vi.fn<(message: string) => void>() },
+}))
+
+/**
+ * Superuser by default, since the install controls are the part gated on it. The factory builds a
+ * real computed rather than handing back a plain object: the template unwraps a ref and would treat
+ * `{ value: false }` as simply truthy.
+ */
+vi.mock('@/features/auth/composables/usePermissions', async () => {
+  const { computed } = await import('vue')
+  return { usePermissions: () => ({ isSuperuser: computed(() => superuser.value), hasPermission: () => true }) }
+})
+vi.mock('@/lib/api', () => ({ api: apiMock }))
+vi.mock('vue-sonner', () => ({ toast: toastMock }))
+
+import RequestIndexersPanel from '../RequestIndexersPanel.vue'
+
+let mounted: VueWrapper | null = null
+const PATH = '/api/v1/admin/request-indexers'
+
+function descriptor(overrides: Partial<IndexerAdapterDescriptor> = {}): IndexerAdapterDescriptor {
+  return {
+    type: 'torznab',
+    label: 'Torznab',
+    builtIn: true,
+    requiresCredential: false,
+    credentialKind: 'apiKey',
+    mediaKinds: ['ebook', 'audiobook', 'comic'],
+    usesCategories: true,
+    seedsBack: true,
+    supportsIsbnSearch: false,
+    defaultCategories: { ebook: [7020], audiobook: [3030], comic: [7030] },
+    settingsFields: [],
+    ...overrides,
+  }
+}
+
+/**
+ * An open library: no credential, no categories, nothing seeded back, and an address of its own.
+ * A plugin rather than a built-in, because torznab is the only built-in and it is the opposite of
+ * this on every one of those.
+ */
+const OPEN_LIBRARY = descriptor({
+  type: 'open-library',
+  label: 'Open Library',
+  builtIn: false,
+  credentialKind: null,
+  mediaKinds: ['ebook'],
+  usesCategories: false,
+  seedsBack: false,
+  defaultCategories: { ebook: [], audiobook: [], comic: [] },
+  defaultBaseUrl: 'https://openlibrary.example',
+})
+
+/** What an adapter loaded from the plugin directory looks like to the form. */
+const PLUGIN = descriptor({
+  type: 'demo-tracker',
+  label: 'Demo Tracker',
+  builtIn: false,
+  version: '2.4.1',
+  requiresCredential: true,
+  credentialKind: 'sessionId',
+  baseUrlHint: "The tracker's own address.",
+  settingsFields: [
+    { key: 'preferFlac', type: 'boolean', label: 'Prefer FLAC', default: true },
+    {
+      key: 'formats',
+      type: 'string',
+      format: 'list',
+      label: 'Formats',
+      default: 'epub,mobi',
+      options: ['epub', 'mobi', 'pdf'],
+      minItems: 1,
+    },
+  ],
+})
+
+function indexer(overrides: Partial<IndexerItem> = {}): IndexerItem {
+  return {
+    id: 1,
+    name: 'My Prowlarr',
+    color: null,
+    adapterType: 'torznab',
+    enabled: true,
+    baseUrl: 'http://127.0.0.1:9696/1',
+    hasCredential: true,
+    allowPrivateAddress: true,
+    categories: { ebook: [7020], audiobook: [3030], comic: [7030] },
+    disabledMediaKinds: [],
+    isbnSearchDisabled: false,
+    settings: {},
+    networkProfile: null,
+    lastTestedAt: null,
+    lastTestOk: null,
+    lastErrorMessage: null,
+    lastSearchAt: null,
+    lastSearchOk: null,
+    lastSearchError: null,
+    searchFailureStreak: 0,
+    createdAt: '2026-08-19T00:00:00.000Z',
+    updatedAt: '2026-08-19T00:00:00.000Z',
+    ...overrides,
+  }
+}
+
+/**
+ * The editor's own actions live in a menu that opens on a pointer gesture jsdom does not raise, so
+ * its content is rendered flat. What that costs is the open/closed state, which is reka's to get
+ * right rather than this file's.
+ */
+const DROPDOWN_STUBS = {
+  DropdownMenu: { template: '<div><slot /></div>' },
+  DropdownMenuTrigger: { template: '<div><slot /></div>' },
+  DropdownMenuContent: { template: '<div><slot /></div>' },
+  DropdownMenuItem: { emits: ['click'], template: '<button @click="$emit(\'click\')"><slot /></button>' },
+  DropdownMenuSeparator: { template: '<hr />' },
+}
+
+function response(body: unknown, ok = true): Response {
+  return { ok, status: ok ? 200 : 500, json: vi.fn<() => Promise<unknown>>().mockResolvedValue(body) } as unknown as Response
+}
+
+async function mountPanel(
+  options: { indexers?: IndexerItem[]; adapters?: IndexerAdapterDescriptor[]; pluginFailures?: Array<{ directory: string; reason: string }> } = {},
+) {
+  const { indexers = [], adapters = [descriptor(), OPEN_LIBRARY], pluginFailures = [] } = options
+  apiMock.mockImplementation((url: string) =>
+    Promise.resolve(url.endsWith('/adapters') ? response({ adapters, pluginFailures }) : response({ indexers, encryptionConfigured: true })),
+  )
+  const wrapper = mount(RequestIndexersPanel, { global: { stubs: DROPDOWN_STUBS } })
+  mounted = wrapper
+  await flushPromises()
+  return wrapper
+}
+
+/** The editor renders through DialogPortal, so it lands on the body rather than in the wrapper. */
+function sheet(): HTMLElement {
+  const el = document.body.querySelector('[role="dialog"]')
+  if (el === null) throw new Error('no editor sheet is open')
+  return el as HTMLElement
+}
+
+/** Text or accessible name: a row's repeated controls are icons rather than labelled buttons. */
+function nameOf(button: HTMLButtonElement): string {
+  const text = (button.textContent ?? '').trim()
+  return text || (button.getAttribute('aria-label') ?? '')
+}
+
+/** The plugin removal question, which is a dialog on the page rather than part of the editor. */
+function confirmDialog(): HTMLElement {
+  const dialog = [...document.body.querySelectorAll('[role="dialog"]')].find((el) => (el.textContent ?? '').includes('plugin?'))
+  if (dialog === undefined) throw new Error('no plugin removal question is open')
+  return dialog as HTMLElement
+}
+
+function clickInConfirm(text: string) {
+  const button = [...confirmDialog().querySelectorAll('button')].find((candidate) => nameOf(candidate).includes(text))
+  if (button === undefined) throw new Error(`the question offers no answer labelled "${text}"`)
+  button.click()
+}
+
+function clickInSheet(text: string) {
+  const button = [...sheet().querySelectorAll('button')].find((candidate) => nameOf(candidate).includes(text))
+  if (button === undefined) throw new Error(`no button labelled "${text}" in the sheet`)
+  button.click()
+}
+
+async function clickInPanel(wrapper: VueWrapper, text: string) {
+  const button = wrapper.findAll('button').find((candidate) => nameOf(candidate.element as HTMLButtonElement).includes(text))
+  if (button === undefined) throw new Error(`no button labelled "${text}" in the panel`)
+  await button.trigger('click')
+  await flushPromises()
+}
+
+function typeInto(selector: string, value: string) {
+  const input = sheet().querySelector<HTMLInputElement>(selector)
+  if (input === null) throw new Error(`no field matching ${selector}`)
+  input.value = value
+  input.dispatchEvent(new Event('input', { bubbles: true }))
+}
+
+/** Add now opens the type picker first, so reaching the form means choosing a type and going on. */
+/**
+ * Two ways in, because there are two things. Torznab is the only built-in, so adding an indexer
+ * needs no choice; a plugin is set up from the row it already occupies.
+ */
+async function openCreate(wrapper: VueWrapper, type = 'torznab') {
+  if (type === 'torznab') {
+    await clickInPanel(wrapper, 'Add indexer')
+    return
+  }
+
+  const row = wrapper.findAll('li').find((item) => item.text().includes(type))
+  const button = row?.findAll('button').find((candidate) => candidate.text().includes('Set up'))
+  if (button === undefined) throw new Error(`no set-up button for "${type}"`)
+  await button.trigger('click')
+  await flushPromises()
+}
+
+describe('RequestIndexersPanel', () => {
+  beforeEach(() => vi.clearAllMocks())
+  afterEach(() => {
+    // Unmounted, not just wiped: a panel left mounted stays reactive and teleports its sheet back
+    // into the body on the next render, where the following test finds it and reads it as its own.
+    mounted?.unmount()
+    mounted = null
+    document.body.innerHTML = ''
+  })
+
+  /**
+   * The adapter list is a runtime fact once adapters can be loaded from disk, so the form has to
+   * ask rather than compile it in.
+   */
+  it('asks the server which adapters this install actually has', async () => {
+    await mountPanel()
+
+    expect(apiMock).toHaveBeenCalledWith(`${PATH}/adapters`)
+  })
+
+  /**
+   * Choosing the type first is the point of the picker: a select inside the form rewrites base URL,
+   * categories and every adapter setting under whatever has already been typed.
+   */
+  describe('installing a plugin', () => {
+    const INSPECTION = {
+      type: 'example-tracker',
+      label: 'Example Tracker',
+      requiresCredential: true,
+      credentialKind: 'apiKey',
+      mediaKinds: ['ebook'],
+      usesCategories: true,
+      seedsBack: true,
+      settingsFields: [],
+      source: 'export default { type: "example-tracker" };\n',
+      replaces: false,
+      active: true,
+    }
+
+    /** The panel picks a file through a hidden input; this is what the browser would hand it. */
+    async function chooseFile(wrapper: VueWrapper, name = 'index.mjs') {
+      const input = wrapper.find<HTMLInputElement>('input[type="file"]')
+      Object.defineProperty(input.element, 'files', { value: [new File(['export default {}'], name)], configurable: true })
+      await input.trigger('change')
+      await flushPromises()
+    }
+
+    function respondWith(inspection: unknown, ok = true) {
+      apiMock.mockImplementation((url: string) => {
+        if (url.endsWith('/plugins/inspect') || url.endsWith('/plugins')) return Promise.resolve(response(inspection, ok))
+        return Promise.resolve(
+          url.endsWith('/adapters')
+            ? response({ adapters: [descriptor()], pluginFailures: [] })
+            : response({ indexers: [], encryptionConfigured: true }),
+        )
+      })
+    }
+
+    /** Installing a plugin runs its code in the server process, so it is not an ordinary admin action. */
+    it('does not offer the control to someone who is not an administrator', async () => {
+      superuser.value = false
+      try {
+        const wrapper = await mountPanel({
+          adapters: [descriptor(), PLUGIN],
+          indexers: [indexer({ adapterType: 'demo-tracker', name: 'A tracker' })],
+        })
+
+        expect(wrapper.findAll('button').some((button) => button.text().includes('Install plugin'))).toBe(false)
+        expect(wrapper.find('input[type="file"]').exists()).toBe(false)
+        expect(wrapper.findAll('button').map((button) => nameOf(button.element as HTMLButtonElement))).not.toContain('Delete plugin')
+
+        await clickInPanel(wrapper, 'Edit A tracker')
+        expect([...sheet().querySelectorAll('button')].map(nameOf)).not.toContain('Delete plugin')
+      } finally {
+        superuser.value = true
+      }
+    })
+
+    it('reads the file without installing it', async () => {
+      const wrapper = await mountPanel()
+      respondWith(INSPECTION)
+
+      await chooseFile(wrapper)
+
+      const posted = apiMock.mock.calls.map(([url]) => url)
+      expect(posted).toContain(`${PATH}/plugins/inspect`)
+      expect(posted).not.toContain(`${PATH}/plugins`)
+    })
+
+    /** The docs ask an operator to read a plugin before trusting it; the sheet makes that literal. */
+    it('shows what the plugin declares and the code it will run', async () => {
+      const wrapper = await mountPanel()
+      respondWith(INSPECTION)
+
+      await chooseFile(wrapper)
+
+      expect(sheet().textContent).toContain('Example Tracker')
+      expect(sheet().textContent).toContain('example-tracker')
+      expect(sheet().querySelector('code')?.textContent).toBe(INSPECTION.source)
+    })
+
+    it('warns what installing one actually means', async () => {
+      const wrapper = await mountPanel()
+      respondWith(INSPECTION)
+
+      await chooseFile(wrapper)
+
+      expect(sheet().textContent).toContain('encryption key')
+    })
+
+    it('says when the install would replace one already there', async () => {
+      const wrapper = await mountPanel()
+      respondWith({ ...INSPECTION, replaces: true })
+
+      await chooseFile(wrapper)
+
+      expect(sheet().textContent).toContain('replaces')
+    })
+
+    /** Sent again rather than a token, so what was reviewed and what lands are the same bytes. */
+    it('sends the file again on confirmation', async () => {
+      const wrapper = await mountPanel()
+      respondWith(INSPECTION)
+      await chooseFile(wrapper)
+
+      clickInSheet('Install plugin')
+      await flushPromises()
+
+      expect(apiMock.mock.calls.map(([url]) => url)).toContain(`${PATH}/plugins`)
+    })
+
+    /** This step runs code rather than saving a form, so it must not be labelled like a form. */
+    it('names the action install rather than save', async () => {
+      const wrapper = await mountPanel()
+      respondWith(INSPECTION)
+
+      await chooseFile(wrapper)
+
+      const labels = [...sheet().querySelectorAll('button')].map((button) => button.textContent?.trim())
+      expect(labels).toContain('Install plugin')
+      expect(labels).not.toContain('Save')
+    })
+
+    /**
+     * A plugin is loaded into the running server as it is written, so the usual install asks for
+     * nothing further. Telling every operator to restart trains them to ignore the one time it matters.
+     */
+    it('asks for no restart when the server loaded the plugin', async () => {
+      const wrapper = await mountPanel()
+      respondWith({ ...INSPECTION, active: true })
+      await chooseFile(wrapper)
+
+      clickInSheet('Install plugin')
+      await flushPromises()
+
+      expect(wrapper.text()).not.toContain('Restart BookOrbit')
+    })
+
+    /** The file landed but would not load here, which is the one case a restart can still fix. */
+    it('says a restart is needed when the server could not load it', async () => {
+      const wrapper = await mountPanel()
+      respondWith({ ...INSPECTION, active: false })
+      await chooseFile(wrapper)
+
+      clickInSheet('Install plugin')
+      await flushPromises()
+
+      expect(wrapper.text()).toContain('Restart BookOrbit')
+    })
+
+    it('installs nothing when the file is refused', async () => {
+      const wrapper = await mountPanel()
+      respondWith({ message: 'That file is not a usable plugin: it declares no label' }, false)
+
+      await chooseFile(wrapper)
+
+      expect(() => sheet()).toThrow('no editor sheet is open')
+      expect(toastMock.error).toHaveBeenCalledWith(expect.stringContaining('no label'))
+    })
+
+    /**
+     * A plugin and the source using it carry the same name, so the plugin is looked after from
+     * inside that source rather than from a list of its own that reads like a duplicate.
+     */
+    describe('managing the plugin from the source that uses it', () => {
+      const USING_PLUGIN = indexer({ adapterType: 'demo-tracker', name: 'A tracker' })
+
+      function withPlugin(inspection: unknown, ok = true) {
+        apiMock.mockImplementation((url: string) => {
+          if (url.endsWith('/plugins/inspect') || url.endsWith('/plugins')) return Promise.resolve(response(inspection, ok))
+          if (String(url).includes('/plugins/')) return Promise.resolve(response(null, ok))
+          return Promise.resolve(
+            url.endsWith('/adapters')
+              ? response({ adapters: [descriptor(), PLUGIN], pluginFailures: [] })
+              : response({ indexers: [USING_PLUGIN], encryptionConfigured: true }),
+          )
+        })
+      }
+
+      async function openDrawer(wrapper: VueWrapper) {
+        await clickInPanel(wrapper, 'Edit A tracker')
+      }
+
+      /** The plugin is managed from the row it occupies, next to the source that runs it. */
+      it('offers update and remove on the plugin row, and not on a torznab one', async () => {
+        const wrapper = await mountPanel({ adapters: [descriptor(), PLUGIN], indexers: [USING_PLUGIN, indexer({ id: 2, name: 'Plain' })] })
+
+        const rowNames = (name: string) => {
+          const row = wrapper.findAll('li').find((item) => item.text().includes(name))
+          return row === undefined ? [] : row.findAll('button').map((button) => nameOf(button.element as HTMLButtonElement))
+        }
+
+        expect(rowNames('A tracker')).toEqual(expect.arrayContaining(['Update plugin', 'Delete plugin']))
+        expect(rowNames('Plain')).not.toContain('Delete plugin')
+      })
+
+      /** In the editor the plugin is a fact about the source, not a second form inside its form. */
+      it('states the plugin in the editor without giving it buttons of its own', async () => {
+        const wrapper = await mountPanel({ adapters: [descriptor(), PLUGIN], indexers: [USING_PLUGIN] })
+
+        await openDrawer(wrapper)
+
+        const section = [...sheet().querySelectorAll('section')].pop()
+        expect(section?.textContent).toContain('used by 1 source')
+        expect(section?.querySelectorAll('button')).toHaveLength(0)
+      })
+
+      it('reviews a chosen file as a replacement', async () => {
+        const wrapper = await mountPanel({ adapters: [descriptor(), PLUGIN], indexers: [USING_PLUGIN] })
+        withPlugin({ ...INSPECTION, type: 'demo-tracker', label: 'Demo Tracker', replaces: true })
+
+        await clickInPanel(wrapper, 'Update plugin')
+        await chooseFile(wrapper)
+
+        expect(sheet().textContent).toContain('Replace this plugin?')
+      })
+
+      /** Otherwise updating one plugin from the wrong file quietly installs a different one. */
+      it('refuses a file that declares a different plugin', async () => {
+        const wrapper = await mountPanel({ adapters: [descriptor(), PLUGIN], indexers: [USING_PLUGIN] })
+        withPlugin({ ...INSPECTION, type: 'something-else', replaces: false })
+
+        await clickInPanel(wrapper, 'Update plugin')
+        await chooseFile(wrapper)
+
+        expect(toastMock.error).toHaveBeenCalledWith(expect.stringContaining('something-else'))
+        expect(apiMock.mock.calls.map(([url]) => url)).not.toContain(`${PATH}/plugins`)
+      })
+
+      /** Removing one plugin also deletes every source and credential configured for its type. */
+      it('asks before deleting the plugin, and states that all of its sources are deleted', async () => {
+        const wrapper = await mountPanel({ adapters: [descriptor(), PLUGIN], indexers: [USING_PLUGIN] })
+        withPlugin(null)
+
+        await clickInPanel(wrapper, 'Delete plugin')
+        expect(apiMock.mock.calls.some(([, init]) => (init as RequestInit | undefined)?.method === 'DELETE')).toBe(false)
+        expect(confirmDialog().textContent).toContain('1 source and its saved settings and credential will be permanently deleted')
+
+        clickInConfirm('Delete plugin')
+        await flushPromises()
+
+        expect(apiMock).toHaveBeenCalledWith(`${PATH}/plugins/demo-tracker`, expect.objectContaining({ method: 'DELETE' }))
+        expect(toastMock.success).toHaveBeenCalledWith('Deleted demo-tracker and its sources.')
+      })
+    })
+
+    /** An installed plugin nothing uses searches nothing, which the row has to say. */
+    it('lists an installed plugin that was never filled in, and offers to do it', async () => {
+      const wrapper = await mountPanel({ adapters: [descriptor(), PLUGIN] })
+
+      expect(wrapper.text()).toContain('Not set up yet')
+      await clickInPanel(wrapper, 'Set up')
+
+      expect(sheet().querySelector<HTMLInputElement>('#indexer-name')?.value).toBe('Demo Tracker')
+    })
+
+    /** Once something uses it, it is that source, and a second row for it would be a duplicate. */
+    it('stops listing it separately once a source uses it', async () => {
+      const wrapper = await mountPanel({
+        adapters: [descriptor(), PLUGIN],
+        indexers: [indexer({ adapterType: 'demo-tracker', name: 'A tracker' })],
+      })
+
+      expect(wrapper.text()).not.toContain('Not set up yet')
+    })
+
+    /** Every delete surface for a plugin-backed row has the same plugin-wide consequence. */
+    it('deletes the whole plugin from its row and from its source editor', async () => {
+      const wrapper = await mountPanel({
+        adapters: [descriptor(), PLUGIN],
+        indexers: [indexer({ adapterType: 'demo-tracker', name: 'A tracker' })],
+      })
+
+      const panelNames = wrapper.findAll('button').map((button) => nameOf(button.element as HTMLButtonElement))
+      expect(panelNames).toContain('Delete plugin')
+      expect(panelNames).not.toContain('Delete source')
+
+      await clickInPanel(wrapper, 'Edit A tracker')
+
+      const sheetNames = [...sheet().querySelectorAll('button')].map(nameOf)
+      expect(sheetNames).toContain('Delete plugin')
+      expect(sheetNames).not.toContain('Delete source')
+
+      clickInSheet('Delete plugin')
+      await flushPromises()
+      expect(sheet().textContent).toContain('saved settings and credential will be permanently deleted')
+
+      clickInSheet('Delete plugin')
+      await flushPromises()
+
+      expect(apiMock).toHaveBeenCalledWith(`${PATH}/plugins/demo-tracker`, expect.objectContaining({ method: 'DELETE' }))
+    })
+
+    it('keeps source-only deletion for built-in Torznab sources', async () => {
+      const wrapper = await mountPanel({ adapters: [descriptor()], indexers: [indexer({ name: 'My Torznab' })] })
+
+      await clickInPanel(wrapper, 'Edit My Torznab')
+
+      const sheetNames = [...sheet().querySelectorAll('button')].map(nameOf)
+      expect(sheetNames).toContain('Delete source')
+      expect(sheetNames).not.toContain('Delete plugin')
+    })
+  })
+
+  /**
+   * A fresh install. Two empty groups are two headings with nothing to head, and the page they made
+   * said "no plugin installed" and "no indexer yet" without ever saying what that costs.
+   */
+  describe('with nothing configured at all', () => {
+    it('links administrators to the open library plugin collection', async () => {
+      const wrapper = await mountPanel({ adapters: [descriptor()] })
+
+      const link = wrapper.get('a[href="https://github.com/orbit-plugins/bookorbit-open-plugins"]')
+      expect(link.text()).toContain('Browse open library plugins')
+      expect(link.attributes('target')).toBe('_blank')
+      expect(link.attributes('rel')).toBe('noopener noreferrer')
+    })
+
+    it('replaces both groups with one panel that says searching finds nothing', async () => {
+      const wrapper = await mountPanel({ adapters: [descriptor()] })
+
+      expect(wrapper.find('section[aria-labelledby="request-plugins-heading"]').exists()).toBe(false)
+      expect(wrapper.find('section[aria-labelledby="request-indexers-heading"]').exists()).toBe(false)
+      expect(wrapper.text()).toContain('No sources yet')
+      expect(wrapper.text()).toContain('a request search finds nothing')
+    })
+
+    /** The two ways in are the two groups it replaced, so both have to be reachable from it. */
+    it('offers both ways in, and opens the torznab form from its own button', async () => {
+      const wrapper = await mountPanel({ adapters: [descriptor()] })
+
+      const names = wrapper.findAll('button').map((button) => nameOf(button.element as HTMLButtonElement))
+      expect(names).toContain('Install plugin')
+      expect(names).toContain('Add indexer')
+
+      await clickInPanel(wrapper, 'Add indexer')
+      expect(sheet().querySelector('#indexer-name')).not.toBeNull()
+    })
+
+    /** A door nobody can open is worse than one door: the copy stops promising two, as well. */
+    it('leaves out the plugin door for someone who is not an administrator', async () => {
+      superuser.value = false
+      try {
+        const wrapper = await mountPanel({ adapters: [descriptor()] })
+
+        expect(wrapper.text()).toContain('No sources yet')
+        expect(wrapper.text()).not.toContain('There are two ways in')
+        expect(wrapper.findAll('button').map((button) => nameOf(button.element as HTMLButtonElement))).not.toContain('Install plugin')
+        expect(wrapper.find('a[href="https://github.com/orbit-plugins/bookorbit-open-plugins"]').exists()).toBe(false)
+      } finally {
+        superuser.value = true
+      }
+    })
+
+    /** A plugin that would not load is the one row somebody has to act on, so it is not "nothing". */
+    it('keeps the groups when a plugin failed to load', async () => {
+      const wrapper = await mountPanel({ adapters: [descriptor()], pluginFailures: [{ directory: 'busted', reason: 'boom' }] })
+
+      expect(wrapper.text()).not.toContain('No sources yet')
+      expect(wrapper.find('section[aria-labelledby="request-plugins-heading"]').exists()).toBe(true)
+      expect(wrapper.text()).toContain('busted')
+    })
+  })
+
+  /**
+   * The common state once anything exists. A second full-height panel would compete with a real
+   * list, so the group that is still empty keeps its heading and says so on one line.
+   */
+  it('states an empty group on one line, with its action on that line rather than twice', async () => {
+    const wrapper = await mountPanel({ adapters: [descriptor(), PLUGIN], indexers: [indexer({ adapterType: 'demo-tracker', name: 'A tracker' })] })
+
+    const torznab = wrapper.find('section[aria-labelledby="request-indexers-heading"]')
+    expect(torznab.text()).toContain('No indexer yet.')
+    expect(torznab.findAll('button').filter((button) => button.text().includes('Add indexer'))).toHaveLength(1)
+  })
+
+  /**
+   * Two groups, because there are two things. Torznab is the only built-in, so adding an indexer
+   * asks nothing about which kind it is: that question only existed because plugins shared the list.
+   */
+  it('adds a torznab indexer without asking which kind it is', async () => {
+    const wrapper = await mountPanel({ adapters: [descriptor(), OPEN_LIBRARY, PLUGIN] })
+
+    await clickInPanel(wrapper, 'Add indexer')
+
+    expect(sheet().querySelector('input[name="indexer-adapter-type"]')).toBeNull()
+    expect(sheet().querySelector('#indexer-name')).not.toBeNull()
+    expect(sheet().textContent).toContain('torznab')
+  })
+
+  it('keeps plugins and torznab indexers in groups of their own', async () => {
+    const wrapper = await mountPanel({
+      adapters: [descriptor(), OPEN_LIBRARY, PLUGIN],
+      indexers: [indexer({ name: 'My Prowlarr' })],
+    })
+
+    const group = (heading: string) => wrapper.find(`section[aria-labelledby="${heading}"]`).text()
+    expect(group('request-plugins-heading')).toContain('Open Library')
+    expect(group('request-plugins-heading')).toContain('Demo Tracker')
+    expect(group('request-plugins-heading')).not.toContain('My Prowlarr')
+    expect(group('request-indexers-heading')).toContain('My Prowlarr')
+    expect(group('request-indexers-heading')).not.toContain('Demo Tracker')
+  })
+
+  it('shows the installed plugin version in the source row and editor header', async () => {
+    const wrapper = await mountPanel({
+      adapters: [descriptor(), PLUGIN],
+      indexers: [indexer({ adapterType: 'demo-tracker', name: 'A tracker' })],
+    })
+
+    const pluginGroup = wrapper.find('section[aria-labelledby="request-plugins-heading"]')
+    expect(pluginGroup.text()).toContain('v2.4.1')
+    expect(pluginGroup.find('[aria-label="Plugin version 2.4.1"]').exists()).toBe(true)
+
+    await clickInPanel(wrapper, 'Edit A tracker')
+
+    expect(sheet().textContent).toContain('v2.4.1')
+    expect(sheet().querySelector('[aria-label="Plugin version 2.4.1"]')).not.toBeNull()
+  })
+
+  it('marks a legacy plugin version as unknown in both places', async () => {
+    const legacy = descriptor({ ...PLUGIN, version: undefined })
+    const wrapper = await mountPanel({
+      adapters: [descriptor(), legacy],
+      indexers: [indexer({ adapterType: 'demo-tracker', name: 'A tracker' })],
+    })
+
+    expect(wrapper.find('[aria-label="Plugin version unknown"]').text()).toBe('v?')
+    await clickInPanel(wrapper, 'Edit A tracker')
+    expect(sheet().querySelector('[aria-label="Plugin version unknown"]')?.textContent?.trim()).toBe('v?')
+  })
+
+  /** The collection is about plugins, so it sits inside that group rather than above both of them. */
+  it('keeps the plugin collection link inside the plugins group once sources exist', async () => {
+    const wrapper = await mountPanel({
+      adapters: [descriptor(), PLUGIN],
+      indexers: [indexer({ name: 'My Prowlarr' })],
+    })
+
+    const group = wrapper.get('section[aria-labelledby="request-plugins-heading"]')
+    expect(group.get('a[href="https://github.com/orbit-plugins/bookorbit-open-plugins"]').text()).toContain('Browse open library plugins')
+    expect(wrapper.findAll('a[href="https://github.com/orbit-plugins/bookorbit-open-plugins"]')).toHaveLength(1)
+  })
+
+  it('does not ask for a credential an adapter has no use for', async () => {
+    const wrapper = await mountPanel({ adapters: [OPEN_LIBRARY] })
+    await openCreate(wrapper, 'open-library')
+
+    expect(sheet().querySelector('#indexer-credential')).toBeNull()
+  })
+
+  /** Categories are meaningless for a source that serves the file itself. */
+  it('hides the category editor for a source that does not use it', async () => {
+    const wrapper = await mountPanel({ adapters: [OPEN_LIBRARY] })
+    await openCreate(wrapper, 'open-library')
+
+    expect(sheet().querySelector('#indexer-categories-ebook')).toBeNull()
+  })
+
+  it('shows it for an adapter that does use it', async () => {
+    const wrapper = await mountPanel({ adapters: [descriptor()] })
+    await openCreate(wrapper)
+
+    expect(sheet().querySelector('#indexer-categories-ebook')).not.toBeNull()
+  })
+
+  /** A plugin declares its own fields, and the form has never heard of them at build time. */
+  it('renders the settings fields an adapter declared', async () => {
+    const wrapper = await mountPanel({ adapters: [PLUGIN] })
+    await openCreate(wrapper, 'demo-tracker')
+
+    expect(sheet().querySelector('#indexer-setting-preferFlac')).not.toBeNull()
+    expect(sheet().textContent).toContain('Prefer FLAC')
+  })
+
+  /** A closed list offers every valid value and no way to invent another one. */
+  it('edits a constrained list as choices and keeps its required final choice selected', async () => {
+    const wrapper = await mountPanel({ adapters: [PLUGIN] })
+    await openCreate(wrapper, 'demo-tracker')
+
+    const group = sheet().querySelector('#indexer-setting-formats')!
+    const choice = (value: string) => [...group.querySelectorAll('button')].find((button) => button.textContent?.trim() === value)!
+
+    expect(group.querySelector('input')).toBeNull()
+    expect(choice('epub').getAttribute('aria-pressed')).toBe('true')
+    expect(choice('mobi').getAttribute('aria-pressed')).toBe('true')
+    expect(choice('pdf').getAttribute('aria-pressed')).toBe('false')
+
+    choice('epub').click()
+    await flushPromises()
+
+    expect(choice('mobi').disabled).toBe(true)
+    expect(sheet().textContent).toContain('Restore defaults')
+
+    const restoreButton = [...sheet().querySelectorAll('button')].find((button) => button.textContent?.trim() === 'Restore defaults')!
+    restoreButton.click()
+    await flushPromises()
+
+    expect(choice('epub').getAttribute('aria-pressed')).toBe('true')
+    expect(choice('mobi').getAttribute('aria-pressed')).toBe('true')
+    expect(sheet().textContent).not.toContain('Restore defaults')
+  })
+
+  it('repairs casing, duplicates, and unknown values from an older saved list', async () => {
+    const wrapper = await mountPanel({
+      adapters: [PLUGIN],
+      indexers: [indexer({ adapterType: 'demo-tracker', name: 'A tracker', settings: { formats: 'EPUB,epub,not-a-format' } })],
+    })
+
+    await clickInPanel(wrapper, 'Edit A tracker')
+
+    const group = sheet().querySelector('#indexer-setting-formats')!
+    const choice = (value: string) => [...group.querySelectorAll('button')].find((button) => button.textContent?.trim() === value)!
+    expect(choice('epub').getAttribute('aria-pressed')).toBe('true')
+    expect(choice('mobi').getAttribute('aria-pressed')).toBe('false')
+    expect(group.textContent).not.toContain('not-a-format')
+  })
+
+  /** Older plugins can still declare an open-ended list when the valid values are not finite. */
+  it('keeps free-entry chips for a list with no declared options', async () => {
+    const plugin = descriptor({
+      ...PLUGIN,
+      settingsFields: [{ key: 'mirrors', type: 'string', format: 'list', label: 'Mirrors', default: 'one,two' }],
+    })
+
+    const wrapper = await mountPanel({ adapters: [plugin] })
+    await openCreate(wrapper, 'demo-tracker')
+
+    expect(sheet().querySelector<HTMLInputElement>('#indexer-setting-mirrors')).not.toBeNull()
+  })
+
+  it('prefills the base URL an adapter names for itself', async () => {
+    const wrapper = await mountPanel({ adapters: [OPEN_LIBRARY] })
+    await openCreate(wrapper, 'open-library')
+
+    expect(sheet().querySelector<HTMLInputElement>('#indexer-url')?.value).toBe('https://openlibrary.example')
+  })
+
+  /**
+   * The editor opens over the list rather than under it, so the row being edited is still there
+   * when it closes.
+   */
+  it('keeps the list rendered while a row is being edited', async () => {
+    const wrapper = await mountPanel({ indexers: [indexer()] })
+    await clickInPanel(wrapper, 'Edit My Prowlarr')
+
+    expect(wrapper.text()).toContain('My Prowlarr')
+    expect(sheet().querySelector<HTMLInputElement>('#indexer-name')?.value).toBe('My Prowlarr')
+  })
+
+  /**
+   * The colour is the operator's way of making a source recognisable in the release picker, where
+   * the only other thing distinguishing two rows from different trackers is their names.
+   */
+  it('sends the colour picked for a source', async () => {
+    const wrapper = await mountPanel({ adapters: [descriptor()] })
+    await openCreate(wrapper)
+    typeInto('#indexer-name', 'MAM')
+    typeInto('#indexer-url', 'http://localhost:9696')
+    sheet().querySelector<HTMLInputElement>('input[name="indexer-color"][value="orange"]')!.click()
+    await flushPromises()
+
+    clickInSheet('Save')
+    await flushPromises()
+
+    const post = apiMock.mock.calls.find(([, init]) => init?.method === 'POST')!
+    expect(JSON.parse(String((post[1] as RequestInit).body)).color).toBe('orange')
+  })
+
+  it('preselects the only unused color when configuring a newly installed plugin', async () => {
+    const existing = INDEXER_COLORS.filter((color) => color !== 'teal').map((color, offset) =>
+      indexer({ id: offset + 1, name: `Source ${offset + 1}`, color }),
+    )
+    const wrapper = await mountPanel({ adapters: [descriptor(), PLUGIN], indexers: existing })
+
+    await openCreate(wrapper, 'demo-tracker')
+
+    const checked = sheet().querySelector<HTMLInputElement>('input[name="indexer-color"]:checked')
+    expect(checked?.value).toBe('teal')
+    expect(sheet().querySelectorAll('input[name="indexer-color"]:not([value=""])')).toHaveLength(10)
+  })
+
+  it('opens the editor on the colour the source already has, and offers to take it away', async () => {
+    const wrapper = await mountPanel({ adapters: [descriptor()], indexers: [indexer({ color: 'purple' })] })
+    await clickInPanel(wrapper, 'Edit My Prowlarr')
+
+    const checked = sheet().querySelector<HTMLInputElement>('input[name="indexer-color"]:checked')
+    expect(checked?.value).toBe('purple')
+    expect(sheet().querySelector('input[name="indexer-color"][value=""]')).not.toBeNull()
+  })
+
+  /**
+   * A rejection names the field it is about. Spending that on a toast that is gone in four seconds
+   * leaves the operator looking at a form with no indication of which box is wrong.
+   */
+  it('shows a rejected save under the field it belongs to instead of as a toast', async () => {
+    const wrapper = await mountPanel({ adapters: [descriptor()] })
+    await openCreate(wrapper)
+    typeInto('#indexer-name', 'Taken')
+    typeInto('#indexer-url', 'http://localhost:9696')
+    await flushPromises()
+
+    apiMock.mockImplementation((url: string, init?: RequestInit) =>
+      Promise.resolve(
+        init?.method === 'POST'
+          ? response({ errorCode: 'INDEXER_NAME_TAKEN', message: 'taken' }, false)
+          : response({ indexers: [], encryptionConfigured: true }),
+      ),
+    )
+    clickInSheet('Save')
+    await flushPromises()
+
+    const error = sheet().querySelector('#indexer-name-error')
+    expect(error?.textContent).toContain('already exists')
+    expect(toastMock.error).not.toHaveBeenCalled()
+  })
+
+  /** A required field that is simply empty is the form's own business, not a round trip. */
+  it('refuses to send a save that is missing a name, and says which field', async () => {
+    const wrapper = await mountPanel({ adapters: [descriptor()] })
+    await openCreate(wrapper)
+    apiMock.mockClear()
+
+    clickInSheet('Save')
+    await flushPromises()
+
+    expect(sheet().querySelector('#indexer-name-error')).not.toBeNull()
+    expect(apiMock.mock.calls.filter(([, init]) => init?.method === 'POST')).toEqual([])
+  })
+
+  /**
+   * The loading flag swaps the whole section for a spinner. Refreshing the list through it after
+   * a test tears the panel down and rebuilds it, which reads as the page reloading and loses the
+   * reader's place, so a post-test refresh has to be silent.
+   */
+  it('does not blank the panel when testing a connection', async () => {
+    const wrapper = await mountPanel({ indexers: [indexer()] })
+    apiMock.mockClear()
+    apiMock.mockImplementation((url: string) =>
+      Promise.resolve(
+        url.endsWith('/test')
+          ? response({ success: true, indexerName: 'Prowlarr' })
+          : response({ indexers: [indexer()], encryptionConfigured: true }),
+      ),
+    )
+
+    await clickInPanel(wrapper, 'Test connection')
+
+    expect(wrapper.find('.settings-loading-state').exists()).toBe(false)
+    expect(wrapper.text()).toContain('My Prowlarr')
+  })
+
+  /** Which adapters exist cannot change from testing a row, so asking again is a wasted call. */
+  it('does not refetch the adapter list when testing a connection', async () => {
+    const wrapper = await mountPanel({ indexers: [indexer()] })
+    apiMock.mockClear()
+    apiMock.mockImplementation((url: string) =>
+      Promise.resolve(url.endsWith('/test') ? response({ success: true }) : response({ indexers: [indexer()], encryptionConfigured: true })),
+    )
+
+    await clickInPanel(wrapper, 'Test connection')
+
+    expect(apiMock.mock.calls.map((c) => c[0]).filter((u) => String(u).endsWith('/adapters'))).toEqual([])
+  })
+
+  /** A broken plugin must remain diagnosable and deletable instead of becoming a dead-end row. */
+  it('says why a plugin failed to load and can delete it', async () => {
+    const wrapper = await mountPanel({ pluginFailures: [{ directory: 'Broken Plugin', reason: 'it exports no search function' }] })
+
+    expect(wrapper.text()).toContain('Broken Plugin')
+    expect(wrapper.text()).toContain('it exports no search function')
+
+    await clickInPanel(wrapper, 'Delete plugin')
+    clickInConfirm('Delete plugin')
+    await flushPromises()
+
+    expect(apiMock).toHaveBeenCalledWith(`${PATH}/plugins/Broken%20Plugin`, expect.objectContaining({ method: 'DELETE' }))
+  })
+
+  /**
+   * Silencing a source is reversible and routine; editing its credential is neither. Behind the
+   * editor they were the same door, so the switch is on the row.
+   */
+  describe('turning a source off from its row', () => {
+    function switchFor(wrapper: VueWrapper, name: string) {
+      const found = wrapper.findAll('[role="switch"]').find((candidate) => candidate.attributes('aria-label')?.includes(name))
+      if (found === undefined) throw new Error(`no switch for "${name}"`)
+      return found
+    }
+
+    it('sends only the enabled flag, leaving the stored credential alone', async () => {
+      const wrapper = await mountPanel({ indexers: [indexer()] })
+      apiMock.mockClear()
+      apiMock.mockImplementation((url: string, init?: RequestInit) =>
+        Promise.resolve(init?.method === 'PUT' ? response({}) : response({ indexers: [indexer({ enabled: false })], encryptionConfigured: true })),
+      )
+
+      await switchFor(wrapper, 'My Prowlarr').trigger('click')
+      await flushPromises()
+
+      const [, init] = apiMock.mock.calls.find(([, options]) => (options as RequestInit | undefined)?.method === 'PUT') ?? []
+      expect(JSON.parse(String((init as RequestInit).body))).toEqual({ enabled: false })
+    })
+
+    it('offers it for a plugin-backed source too', async () => {
+      const wrapper = await mountPanel({
+        adapters: [descriptor(), PLUGIN],
+        indexers: [indexer({ id: 2, adapterType: 'demo-tracker', name: 'A tracker' })],
+      })
+
+      expect(switchFor(wrapper, 'A tracker').attributes('aria-checked')).toBe('true')
+    })
+
+    /** The badge beside the name is what says a source is off, so it has to follow the switch. */
+    it('reads the state back off the row once the save lands', async () => {
+      const wrapper = await mountPanel({ indexers: [indexer()] })
+      apiMock.mockImplementation((url: string, init?: RequestInit) =>
+        Promise.resolve(init?.method === 'PUT' ? response({}) : response({ indexers: [indexer({ enabled: false })], encryptionConfigured: true })),
+      )
+
+      await switchFor(wrapper, 'My Prowlarr').trigger('click')
+      await flushPromises()
+
+      expect(switchFor(wrapper, 'My Prowlarr').attributes('aria-checked')).toBe('false')
+      expect(wrapper.text()).toContain('Disabled')
+    })
+
+    it('says so and leaves the switch where it was when the save is refused', async () => {
+      const wrapper = await mountPanel({ indexers: [indexer()] })
+      apiMock.mockImplementation((url: string, init?: RequestInit) =>
+        Promise.resolve(
+          init?.method === 'PUT'
+            ? response({ message: 'Could not save that indexer' }, false)
+            : response({ indexers: [indexer()], encryptionConfigured: true }),
+        ),
+      )
+
+      await switchFor(wrapper, 'My Prowlarr').trigger('click')
+      await flushPromises()
+
+      expect(toastMock.error).toHaveBeenCalled()
+      expect(switchFor(wrapper, 'My Prowlarr').attributes('aria-checked')).toBe('true')
+    })
+  })
+
+  /**
+   * An empty box means "keep", because that is what it looked like when the form opened. Sending
+   * the empty string wiped a working credential and the next search failed with nothing saying why.
+   */
+  describe('stored credential', () => {
+    async function editAndSave(wrapper: VueWrapper, act: () => void) {
+      await clickInPanel(wrapper, 'Edit My Torznab')
+      act()
+      await flushPromises()
+      clickInSheet('Save')
+      await flushPromises()
+      const saveCall = apiMock.mock.calls.find(([, init]) => init?.method === 'PUT')
+      return JSON.parse(String(saveCall?.[1]?.body)) as Record<string, unknown>
+    }
+
+    it('keeps it when a typed credential is erased again', async () => {
+      const wrapper = await mountPanel({ adapters: [descriptor()], indexers: [indexer({ name: 'My Torznab' })] })
+
+      const body = await editAndSave(wrapper, () => {
+        typeInto('#indexer-credential', 'abcdef')
+        typeInto('#indexer-credential', '')
+      })
+
+      expect(body).not.toHaveProperty('credential')
+    })
+
+    it('sends a typed credential', async () => {
+      const wrapper = await mountPanel({ adapters: [descriptor()], indexers: [indexer({ name: 'My Torznab' })] })
+
+      const body = await editAndSave(wrapper, () => typeInto('#indexer-credential', 'abcdef'))
+
+      expect(body).toMatchObject({ credential: 'abcdef' })
+    })
+
+    it('removes it only when clearing is asked for outright', async () => {
+      const wrapper = await mountPanel({ adapters: [descriptor()], indexers: [indexer({ name: 'My Torznab' })] })
+
+      const body = await editAndSave(wrapper, () => clickInSheet('Clear'))
+
+      expect(body).toMatchObject({ credential: '' })
+    })
+
+    it('offers no clearing on a source that has no stored credential', async () => {
+      const wrapper = await mountPanel({ adapters: [descriptor()], indexers: [indexer({ name: 'My Torznab', hasCredential: false })] })
+      await clickInPanel(wrapper, 'Edit My Torznab')
+
+      expect([...sheet().querySelectorAll('button')].map(nameOf)).not.toContain('Clear')
+    })
+
+    it('offers no clearing when the adapter requires a credential', async () => {
+      const wrapper = await mountPanel({ adapters: [PLUGIN], indexers: [indexer({ name: 'A tracker', adapterType: PLUGIN.type })] })
+      await clickInPanel(wrapper, 'Edit A tracker')
+
+      expect([...sheet().querySelectorAll('button')].map(nameOf)).not.toContain('Clear')
+    })
+  })
+
+  /** Test runs against the saved row, so a green tick for a draft would be a tick for old values. */
+  it('refuses to test while the draft differs from the saved source', async () => {
+    const wrapper = await mountPanel({ adapters: [descriptor()], indexers: [indexer({ name: 'My Torznab' })] })
+    await clickInPanel(wrapper, 'Edit My Torznab')
+
+    expect(sheet().querySelector<HTMLButtonElement>('button[aria-label="Test connection"]')?.disabled).toBe(false)
+
+    typeInto('#indexer-url', 'http://127.0.0.1:9697/1')
+    await flushPromises()
+
+    expect(sheet().querySelector('button[aria-label="Test connection"]')).toBeNull()
+    const dirtyTest = sheet().querySelector<HTMLButtonElement>('button[aria-label="Save your changes before testing"]')
+    expect(dirtyTest?.getAttribute('aria-disabled')).toBe('true')
+    dirtyTest?.click()
+    await flushPromises()
+    expect(apiMock.mock.calls.some(([url, init]) => String(url).endsWith('/test') && init?.method === 'POST')).toBe(false)
+  })
+
+  /**
+   * Removing a plugin changes the adapter list, so the refresh has to ask for it again; what it
+   * must not do is take the populated panel away and put a spinner where the reader was looking.
+   */
+  it('refreshes the adapters after a plugin removal without blanking the panel', async () => {
+    const wrapper = await mountPanel({ adapters: [descriptor(), PLUGIN], indexers: [indexer({ adapterType: 'demo-tracker', name: 'A tracker' })] })
+
+    let releaseList = () => {}
+    const pending = new Promise<Response>((resolve) => {
+      releaseList = () => resolve(response({ indexers: [], encryptionConfigured: true }))
+    })
+    apiMock.mockImplementation((url: string, init?: RequestInit) => {
+      if (init?.method === 'DELETE') return Promise.resolve(response({}))
+      if (url.endsWith('/adapters')) return Promise.resolve(response({ adapters: [descriptor()], pluginFailures: [] }))
+      return pending
+    })
+
+    await clickInPanel(wrapper, 'Delete plugin')
+    clickInConfirm('Delete plugin')
+    await flushPromises()
+
+    expect(wrapper.find('.settings-loading-state').exists()).toBe(false)
+    expect(wrapper.text()).toContain('A tracker')
+
+    releaseList()
+    await flushPromises()
+
+    expect(apiMock).toHaveBeenCalledWith(`${PATH}/adapters`)
+  })
+
+  /** An older removal may have left a source behind; it must still have a full cleanup path. */
+  it('flags and can delete an orphaned plugin source', async () => {
+    const wrapper = await mountPanel({
+      indexers: [indexer({ adapterType: 'mam', name: 'An old tracker' })],
+      adapters: [descriptor(), OPEN_LIBRARY],
+    })
+
+    expect(wrapper.text()).toContain('mam')
+    expect(wrapper.find('[role="status"]').exists()).toBe(true)
+
+    await clickInPanel(wrapper, 'Edit An old tracker')
+    expect(sheet().textContent).toContain('plugin file is already gone')
+    expect([...sheet().querySelectorAll('button')].map(nameOf)).toContain('Delete plugin')
+
+    clickInSheet('Delete plugin')
+    await flushPromises()
+    clickInSheet('Delete plugin')
+    await flushPromises()
+
+    expect(apiMock).toHaveBeenCalledWith(`${PATH}/plugins/mam`, expect.objectContaining({ method: 'DELETE' }))
+  })
+})
diff --git a/client/src/features/settings/__tests__/RequestsSettings.spec.ts b/client/src/features/settings/__tests__/RequestsSettings.spec.ts
new file mode 100644
index 000000000..1c7c0b662
--- /dev/null
+++ b/client/src/features/settings/__tests__/RequestsSettings.spec.ts
@@ -0,0 +1,75 @@
+import { mount } from '@vue/test-utils'
+import { describe, expect, it, vi } from 'vitest'
+
+const routerState = vi.hoisted(() => ({
+  currentQuery: {} as Record<string, string>,
+  replacedQuery: null as Record<string, string> | null,
+}))
+
+// The real module builds the application router at import time, which jsdom has no history for.
+vi.mock('vue-router', () => ({
+  useRoute: () => ({ query: routerState.currentQuery }),
+  useRouter: () => ({
+    replace: vi.fn<(to: { name: string; query: Record<string, string> }) => void>((to) => {
+      routerState.replacedQuery = to.query
+      routerState.currentQuery = to.query
+    }),
+  }),
+  createRouter: () => ({ beforeEach: vi.fn<() => void>(), afterEach: vi.fn<() => void>(), isReady: () => Promise.resolve() }),
+  createWebHistory: () => ({}),
+  createMemoryHistory: () => ({}),
+  RouterLink: { template: '<a><slot /></a>' },
+  RouterView: { template: '<div />' },
+}))
+
+import RequestsSettings from '../RequestsSettings.vue'
+
+/** The panels fetch on mount; this page is only about which one of them is on screen. */
+const stubs = {
+  RequestIndexersPanel: { template: '<div>sources panel</div>' },
+  DownloadClientsPanel: { template: '<div>clients panel</div>' },
+  RequestAutomationPanel: { template: '<div>automation panel</div>' },
+}
+
+function mountPage(tab?: string) {
+  routerState.currentQuery = tab ? { tab } : {}
+  routerState.replacedQuery = null
+  return mount(RequestsSettings, { props: { embedded: true }, global: { stubs } })
+}
+
+describe('RequestsSettings', () => {
+  it('offers one tab per thing this page configures', () => {
+    const wrapper = mountPage()
+
+    const labels = wrapper.findAll('[role="tab"]').map((tab) => tab.text())
+    expect(labels).toEqual(['Sources', 'Download clients', 'Automation'])
+  })
+
+  /** Only the panel being looked at, so three concurrent loads do not happen on every visit. */
+  it('renders only the panel for the active tab', async () => {
+    const wrapper = mountPage()
+    expect(wrapper.text()).toContain('sources panel')
+    expect(wrapper.text()).not.toContain('clients panel')
+
+    await wrapper.findAll('[role="tab"]')[1]?.trigger('click')
+
+    expect(wrapper.text()).toContain('clients panel')
+    expect(wrapper.text()).not.toContain('sources panel')
+  })
+
+  /** The tab is in the URL, so a link to one lands on it and a reload stays put. */
+  it('opens the tab named in the query, and writes the chosen one back', async () => {
+    const wrapper = mountPage('automation')
+    expect(wrapper.text()).toContain('automation panel')
+
+    await wrapper.findAll('[role="tab"]')[0]?.trigger('click')
+
+    expect(routerState.replacedQuery).toEqual({ tab: 'sources' })
+  })
+
+  it('falls back to the first tab when the query names one that does not exist', () => {
+    const wrapper = mountPage('nonsense')
+
+    expect(wrapper.text()).toContain('sources panel')
+  })
+})
diff --git a/client/src/features/settings/__tests__/SearchHealth.spec.ts b/client/src/features/settings/__tests__/SearchHealth.spec.ts
new file mode 100644
index 000000000..6da9c8e1c
--- /dev/null
+++ b/client/src/features/settings/__tests__/SearchHealth.spec.ts
@@ -0,0 +1,40 @@
+import { mount } from '@vue/test-utils'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import SearchHealth from '../SearchHealth.vue'
+
+const NOW = new Date('2026-08-19T12:00:00Z')
+
+function render(props: { lastSearchAt: string | null; lastSearchOk: boolean | null; searchFailureStreak: number; enabled: boolean }) {
+  return mount(SearchHealth, { props })
+}
+
+describe('SearchHealth', () => {
+  beforeEach(() => {
+    vi.useFakeTimers()
+    vi.setSystemTime(NOW)
+  })
+
+  afterEach(() => vi.useRealTimers())
+
+  it('shows a single failed search with its recency', () => {
+    const wrapper = render({ lastSearchAt: '2026-08-19T11:54:00Z', lastSearchOk: false, searchFailureStreak: 1, enabled: true })
+
+    expect(wrapper.text()).toContain('Last search failed')
+    expect(wrapper.text()).toContain('last searched 6 minutes ago')
+    expect(wrapper.find('[title]').attributes('title')).toBeTruthy()
+  })
+
+  it('shows the consecutive failure count after repeated failures', () => {
+    const wrapper = render({ lastSearchAt: '2026-08-19T11:54:00Z', lastSearchOk: false, searchFailureStreak: 4, enabled: true })
+
+    expect(wrapper.text()).toContain('4 searches failed in a row')
+  })
+
+  it.each([
+    { lastSearchAt: null, lastSearchOk: null, searchFailureStreak: 0, enabled: true },
+    { lastSearchAt: '2026-08-19T11:54:00Z', lastSearchOk: true, searchFailureStreak: 0, enabled: true },
+    { lastSearchAt: '2026-08-19T11:54:00Z', lastSearchOk: false, searchFailureStreak: 2, enabled: false },
+  ])('stays quiet when the source is not currently failing', (props) => {
+    expect(render(props).text()).toBe('')
+  })
+})
diff --git a/client/src/features/settings/__tests__/SettingsEditorSheet.spec.ts b/client/src/features/settings/__tests__/SettingsEditorSheet.spec.ts
new file mode 100644
index 000000000..e10ded2fc
--- /dev/null
+++ b/client/src/features/settings/__tests__/SettingsEditorSheet.spec.ts
@@ -0,0 +1,159 @@
+import { flushPromises, mount } from '@vue/test-utils'
+import { afterEach, describe, expect, it } from 'vitest'
+import SettingsEditorSheet from '../components/SettingsEditorSheet.vue'
+import type { EditorMenuAction } from '../lib/editor-actions'
+
+/**
+ * The real menu opens on a pointer gesture jsdom does not raise, so its content is rendered flat.
+ * What that costs is the open/closed state, which is reka's to get right rather than this file's.
+ */
+const DROPDOWN_STUBS = {
+  DropdownMenu: { template: '<div><slot /></div>' },
+  DropdownMenuTrigger: { template: '<div><slot /></div>' },
+  DropdownMenuContent: { template: '<div><slot /></div>' },
+  DropdownMenuItem: { emits: ['click'], template: '<button @click="$emit(\'click\')"><slot /></button>' },
+  DropdownMenuSeparator: { template: '<hr />' },
+}
+
+function mountSheet(props: { dirty?: boolean; removable?: boolean; removeConfirm?: string; menuActions?: EditorMenuAction[] } = {}) {
+  return mount(SettingsEditorSheet, {
+    props: { open: true, title: 'My Prowlarr', description: 'Settings for this indexer.', ...props },
+    slots: { default: '<p>form body</p>' },
+    global: { stubs: DROPDOWN_STUBS },
+  })
+}
+
+function textOf(selector: string): string {
+  return [...document.body.querySelectorAll(selector)].map((el) => el.textContent ?? '').join(' ')
+}
+
+function clickByText(text: string, within: ParentNode = document.body) {
+  const button = [...within.querySelectorAll('button')].find((candidate) => (candidate.textContent ?? '').includes(text))
+  if (button === undefined) throw new Error(`no button labelled "${text}"`)
+  button.click()
+}
+
+/** The armed question and its two answers, which is the only place an action is actually run. */
+function confirmation(): HTMLElement {
+  const question = document.body.querySelector('[role="alert"]')
+  if (question?.parentElement == null) throw new Error('nothing is awaiting confirmation')
+  return question.parentElement
+}
+
+describe('SettingsEditorSheet', () => {
+  afterEach(() => {
+    document.body.innerHTML = ''
+  })
+
+  it('closes straight away when nothing has been typed', async () => {
+    const wrapper = mountSheet({ dirty: false })
+    await flushPromises()
+
+    clickByText('Cancel')
+    await flushPromises()
+
+    expect(wrapper.emitted('cancel')).toHaveLength(1)
+    expect(textOf('[role="dialog"]')).not.toContain('Discard your changes?')
+  })
+
+  /**
+   * The inline form it replaces could not lose anything by being scrolled past. A sheet closes on
+   * a scrim click and on Escape, so it has to ask before throwing typed changes away.
+   */
+  it('asks before discarding changes, and only closes once that is confirmed', async () => {
+    const wrapper = mountSheet({ dirty: true })
+    await flushPromises()
+
+    clickByText('Cancel')
+    await flushPromises()
+
+    expect(wrapper.emitted('cancel')).toBeUndefined()
+    expect(textOf('[role="dialog"]')).toContain('Discard your changes?')
+
+    clickByText('Discard changes')
+    await flushPromises()
+
+    expect(wrapper.emitted('cancel')).toHaveLength(1)
+  })
+
+  it('offers no remove action while there is nothing yet to remove', async () => {
+    mountSheet({ removable: false })
+    await flushPromises()
+
+    expect(textOf('[role="dialog"]')).not.toContain('Delete')
+  })
+
+  /**
+   * The question is answered in the footer rather than in a dialog: a dialog over the sheet hides
+   * and slides the sheet away, so the record being removed leaves the screen mid-question.
+   */
+  it('asks in the footer before removing, and says what the removal costs', async () => {
+    const wrapper = mountSheet({ removable: true, removeConfirm: 'Delete this source?' })
+    await flushPromises()
+
+    clickByText('Delete')
+    await flushPromises()
+
+    expect(wrapper.emitted('remove')).toBeUndefined()
+    expect(textOf('[role="alert"]')).toContain('Delete this source?')
+
+    clickByText('Delete', confirmation())
+    await flushPromises()
+
+    expect(wrapper.emitted('remove')).toHaveLength(1)
+  })
+
+  it('removes nothing when the question is dismissed', async () => {
+    const wrapper = mountSheet({ removable: true })
+    await flushPromises()
+
+    clickByText('Delete')
+    await flushPromises()
+
+    clickByText('Cancel', confirmation())
+    await flushPromises()
+
+    expect(wrapper.emitted('remove')).toBeUndefined()
+    expect(document.body.querySelector('[role="alert"]')).toBeNull()
+  })
+
+  /**
+   * Anything acting on what the record is built on rather than on the record itself, such as the
+   * plugin behind a source. It is one menu so the form keeps a single row of buttons under it.
+   */
+  it('runs a menu action that asks nothing on the first click', async () => {
+    const wrapper = mountSheet({ menuActions: [{ id: 'plugin-update', label: 'Update plugin' }] })
+    await flushPromises()
+
+    clickByText('Update plugin')
+    await flushPromises()
+
+    expect(wrapper.emitted('action')).toEqual([['plugin-update']])
+  })
+
+  it('holds a menu action that asks first until the question is answered', async () => {
+    const wrapper = mountSheet({
+      menuActions: [
+        {
+          id: 'plugin-remove',
+          label: 'Delete plugin',
+          danger: true,
+          confirm: 'Delete the Demo plugin?',
+          consequence: '1 source and its credential will be permanently deleted.',
+        },
+      ],
+    })
+    await flushPromises()
+
+    clickByText('Delete plugin')
+    await flushPromises()
+
+    expect(wrapper.emitted('action')).toBeUndefined()
+    expect(textOf('[role="alert"]')).toContain('1 source and its credential will be permanently deleted.')
+
+    clickByText('Delete plugin', confirmation())
+    await flushPromises()
+
+    expect(wrapper.emitted('action')).toEqual([['plugin-remove']])
+  })
+})
diff --git a/client/src/features/settings/__tests__/SettingsNav.spec.ts b/client/src/features/settings/__tests__/SettingsNav.spec.ts
index c81eab1a7..f408ac70e 100644
--- a/client/src/features/settings/__tests__/SettingsNav.spec.ts
+++ b/client/src/features/settings/__tests__/SettingsNav.spec.ts
@@ -12,10 +12,20 @@ const permState = {
 
 const routeState = { name: 'settings-appearance-theme' }
 
+const push = vi.fn<(to: { name: string }) => void>()
+
 vi.mock('vue-router', () => ({
   useRoute: () => ({ name: routeState.name }),
+  useRouter: () => ({ push }),
 }))
 
+const navStatus = vi.hoisted(() => ({ scanning: false }))
+
+vi.mock('../composables/useSettingsNavStatus', async () => {
+  const { computed: makeComputed } = await import('vue')
+  return { useSettingsNavStatus: () => ({ isLibraryScanning: makeComputed(() => navStatus.scanning) }) }
+})
+
 vi.mock('@/features/auth/composables/usePermissions', () => ({
   usePermissions: () => ({
     isSuperuser: computed(() => permState.isSuperuser),
@@ -24,10 +34,11 @@ vi.mock('@/features/auth/composables/usePermissions', () => ({
   }),
 }))
 
-function mountNav(opts?: { su?: boolean; perms?: string[]; demo?: boolean; routeName?: string }) {
+function mountNav(opts?: { su?: boolean; perms?: string[]; demo?: boolean; routeName?: string; scanning?: boolean }) {
   permState.isSuperuser = opts?.su ?? false
   permState.permissions = opts?.perms ?? []
   permState.demoRestricted = opts?.demo ?? false
+  navStatus.scanning = opts?.scanning ?? false
   routeState.name = opts?.routeName ?? 'settings-appearance-theme'
   return mount(SettingsNav, {
     global: { stubs: { RouterLink: RouterLinkStub } },
@@ -56,6 +67,7 @@ async function search(wrapper: Wrapper, term: string): Promise<string[]> {
 describe('SettingsNav', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    push.mockClear()
   })
 
   it('places an icon-only back action beside search', () => {
@@ -98,7 +110,7 @@ describe('SettingsNav', () => {
     })
 
     it('shows every group to a superuser', () => {
-      expect(groupLabels(mountNav({ su: true }))).toEqual(['You', 'Library', 'Devices & sync', 'Server'])
+      expect(groupLabels(mountNav({ su: true }))).toEqual(['You', 'Library', 'Devices', 'Accounts', 'Server'])
     })
 
     it('shows the library group to a user who can manage libraries', () => {
@@ -115,16 +127,26 @@ describe('SettingsNav', () => {
       expect(itemLabels(mountNav({ perms: ['manage_libraries'] }))).toContain('Libraries')
     })
 
-    it('shows metadata destinations with manage_metadata_config', () => {
+    it('collapses the metadata destinations behind a single row', () => {
       const labels = itemLabels(mountNav({ perms: ['manage_metadata_config'] }))
+      expect(labels).toContain('Metadata')
+      expect(labels).not.toContain('Providers')
+    })
+
+    it('shows metadata destinations with manage_metadata_config', () => {
+      const labels = childLabels(mountNav({ perms: ['manage_metadata_config'], routeName: 'settings-metadata-providers' }))
       expect(labels).toContain('Providers')
       expect(labels).toContain('Field Rules')
       expect(labels).toContain('Confidence Score')
     })
 
     it('keeps custom fields behind manage_libraries rather than metadata config', () => {
-      expect(itemLabels(mountNav({ perms: ['manage_metadata_config'] }))).not.toContain('Custom Fields')
-      expect(itemLabels(mountNav({ perms: ['manage_libraries'] }))).toContain('Custom Fields')
+      expect(childLabels(mountNav({ perms: ['manage_metadata_config'], routeName: 'settings-metadata-providers' }))).not.toContain('Custom Fields')
+      expect(childLabels(mountNav({ perms: ['manage_libraries'], routeName: 'settings-metadata-custom-fields' }))).toContain('Custom Fields')
+    })
+
+    it('drops the metadata row entirely when no child is reachable', () => {
+      expect(itemLabels(mountNav({ perms: ['manage_app_settings'] }))).not.toContain('Metadata')
     })
 
     it('shows file naming and maintenance with manage_app_settings', () => {
@@ -152,37 +174,43 @@ describe('SettingsNav', () => {
       expect(itemLabels(mountNav({ perms: ['email_send'] }))).toContain('Email')
     })
 
-    it('lists connected services as their own destinations', () => {
-      const labels = itemLabels(mountNav({ perms: ['hardcover_sync'] }))
-      expect(labels).toContain('Hardcover')
-      expect(labels).not.toContain('Readwise')
+    it('lists connected services under Accounts as their own destinations', () => {
+      const wrapper = mountNav({ perms: ['hardcover_sync'] })
+      expect(itemLabels(wrapper)).toContain('Hardcover')
+      expect(itemLabels(wrapper)).not.toContain('Readwise')
+      expect(groupLabels(wrapper)).toContain('Accounts')
     })
   })
 
   describe('server section', () => {
     it('shows users only with manage_users', () => {
-      expect(itemLabels(mountNav())).not.toContain('Users')
-      expect(itemLabels(mountNav({ perms: ['manage_users'] }))).toContain('Users')
+      expect(itemLabels(mountNav())).not.toContain('Users & Access')
+      expect(childLabels(mountNav({ perms: ['manage_users'], routeName: 'settings-admin-users' }))).toContain('Users')
     })
 
     it('shows account activity with view_user_activity', () => {
-      expect(itemLabels(mountNav({ perms: ['view_user_activity'] }))).toContain('Account Activity')
+      const labels = childLabels(mountNav({ perms: ['view_user_activity'], routeName: 'settings-admin-account-activity' }))
+      expect(labels).toContain('Account Activity')
     })
 
     it('keeps magic links and the audit log for superusers only', () => {
-      const adminLabels = itemLabels(mountNav({ perms: ['manage_app_settings'] }))
-      expect(adminLabels).not.toContain('Magic Links')
-      expect(adminLabels).not.toContain('Audit Log')
+      const admin = mountNav({ perms: ['manage_app_settings'], routeName: 'settings-admin-oidc' })
+      expect(childLabels(admin)).not.toContain('Magic Links')
+      expect(itemLabels(admin)).not.toContain('Audit Log')
 
-      const superuserLabels = itemLabels(mountNav({ su: true }))
-      expect(superuserLabels).toContain('Magic Links')
-      expect(superuserLabels).toContain('Audit Log')
+      const superuser = mountNav({ su: true, routeName: 'settings-admin-magic-links' })
+      expect(childLabels(superuser)).toContain('Magic Links')
+      expect(itemLabels(superuser)).toContain('Audit Log')
     })
 
     it('shows single sign-on and server fonts with manage_app_settings', () => {
-      const labels = itemLabels(mountNav({ perms: ['manage_app_settings'] }))
-      expect(labels).toContain('OIDC / SSO')
-      expect(labels).toContain('Server Fonts')
+      const wrapper = mountNav({ perms: ['manage_app_settings'], routeName: 'settings-admin-oidc' })
+      expect(childLabels(wrapper)).toContain('OIDC / SSO')
+      expect(itemLabels(wrapper)).toContain('Server Fonts')
+    })
+
+    it('drops the access row entirely when no child is reachable', () => {
+      expect(itemLabels(mountNav({ perms: ['manage_book_dock'] }))).not.toContain('Users & Access')
     })
 
     it('shows the book dock with manage_book_dock', () => {
@@ -220,10 +248,90 @@ describe('SettingsNav', () => {
       expect(activeBranch?.classes()).not.toContain('font-normal')
     })
 
-    it('points a parent row at its first child', () => {
-      const wrapper = mountNav()
-      const display = wrapper.findAllComponents(RouterLinkStub).find((link) => link.text() === 'Display')
-      expect(display?.props('to')).toEqual({ name: 'settings-appearance-theme' })
+    it('marks a collapsible row with a chevron and leaves a destination without one', () => {
+      const wrapper = mountNav({ perms: ['manage_libraries'] })
+      const rows = wrapper.findAll('[data-testid="settings-nav-item"]')
+      const metadata = rows.find((node) => node.text().includes('Metadata'))
+      const libraries = rows.find((node) => node.text().includes('Libraries'))
+
+      expect(metadata?.find('[data-testid="settings-nav-item-chevron"]').exists()).toBe(true)
+      expect(libraries?.find('[data-testid="settings-nav-item-chevron"]').exists()).toBe(false)
+    })
+
+    it('turns the chevron only while the branch is open', async () => {
+      const wrapper = mountNav({ routeName: 'settings-appearance-layout' })
+      const display = wrapper.findAll('[data-testid="settings-nav-item"]').find((node) => node.text().includes('Display'))
+      const chevron = () => display?.get('[data-testid="settings-nav-item-chevron"]')
+
+      expect(chevron()?.classes()).toContain('rotate-90')
+      await display?.trigger('click')
+      expect(chevron()?.classes()).not.toContain('rotate-90')
+    })
+
+    it('renders a grouping row as a disclosure button rather than a link', () => {
+      const wrapper = mountNav({ routeName: 'settings-reader-pdf' })
+      const display = wrapper.findAll('[data-testid="settings-nav-item"]').find((node) => node.text().includes('Display'))
+
+      expect(display?.element.tagName).toBe('BUTTON')
+      expect(display?.attributes('aria-expanded')).toBe('false')
+      expect(wrapper.findAllComponents(RouterLinkStub).some((link) => link.text() === 'Display')).toBe(false)
+    })
+
+    it('opens a closed branch and jumps to its first page', async () => {
+      const wrapper = mountNav({ routeName: 'settings-reader-pdf' })
+      const display = wrapper.findAll('[data-testid="settings-nav-item"]').find((node) => node.text().includes('Display'))
+
+      await display?.trigger('click')
+
+      expect(push).toHaveBeenCalledWith({ name: 'settings-appearance-theme' })
+      expect(childLabels(wrapper)).toContain('Theme')
+    })
+
+    it('closes an open branch again without navigating away', async () => {
+      const wrapper = mountNav({ routeName: 'settings-appearance-layout' })
+      const display = wrapper.findAll('[data-testid="settings-nav-item"]').find((node) => node.text().includes('Display'))
+      expect(childLabels(wrapper)).toContain('Layout')
+
+      await display?.trigger('click')
+
+      expect(childLabels(wrapper)).not.toContain('Layout')
+      expect(display?.attributes('aria-expanded')).toBe('false')
+      expect(push).not.toHaveBeenCalled()
+    })
+
+    it('keeps a closed branch highlighted while its page is still open', async () => {
+      const wrapper = mountNav({ routeName: 'settings-appearance-layout' })
+      const display = wrapper.findAll('[data-testid="settings-nav-item"]').find((node) => node.text().includes('Display'))
+
+      await display?.trigger('click')
+
+      expect(display?.classes()).toContain('bg-sidebar-accent')
+    })
+
+    it('opens only one branch at a time', async () => {
+      const wrapper = mountNav({ routeName: 'settings-appearance-layout' })
+      const reader = wrapper.findAll('[data-testid="settings-nav-item"]').find((node) => node.text().includes('Reader'))
+
+      await reader?.trigger('click')
+
+      expect(childLabels(wrapper)).toContain('eBook')
+      expect(childLabels(wrapper)).not.toContain('Layout')
+    })
+  })
+
+  describe('live status', () => {
+    it('flags a running scan on the libraries row', () => {
+      const wrapper = mountNav({ perms: ['manage_libraries'], scanning: true })
+      const libraries = wrapper.findAll('[data-testid="settings-nav-item"]').find((node) => node.text().includes('Libraries'))
+      const status = libraries?.get('[data-testid="settings-nav-item-status"]')
+
+      expect(status?.text()).toBe('Scanning')
+      expect(status?.attributes('role')).toBe('status')
+    })
+
+    it('shows no status while nothing is scanning', () => {
+      const wrapper = mountNav({ perms: ['manage_libraries'] })
+      expect(wrapper.find('[data-testid="settings-nav-item-status"]').exists()).toBe(false)
     })
   })
 
diff --git a/client/src/features/settings/__tests__/SettingsSidebar.spec.ts b/client/src/features/settings/__tests__/SettingsSidebar.spec.ts
index 9f4e4a39f..66951ea35 100644
--- a/client/src/features/settings/__tests__/SettingsSidebar.spec.ts
+++ b/client/src/features/settings/__tests__/SettingsSidebar.spec.ts
@@ -12,6 +12,7 @@ const permState = {
 
 vi.mock('vue-router', () => ({
   useRoute: () => ({ name: 'settings-appearance-theme' }),
+  useRouter: () => ({ push: vi.fn<(to: { name: string }) => void>() }),
 }))
 
 vi.mock('@/features/auth/composables/usePermissions', () => ({
@@ -57,7 +58,7 @@ describe('SettingsSidebar', () => {
   it('collapses to one popover per group when the sidebar is a rail', () => {
     const wrapper = mountSidebar({ rail: true, su: true })
     expect(wrapper.findComponent({ name: 'SettingsNav' }).exists()).toBe(false)
-    expect(wrapper.findAll('[data-testid="rail-group"]')).toHaveLength(4)
+    expect(wrapper.findAll('[data-testid="rail-group"]')).toHaveLength(5)
   })
 
   it('flattens nested destinations into the rail popovers', () => {
diff --git a/client/src/features/settings/__tests__/settings-nav.spec.ts b/client/src/features/settings/__tests__/settings-nav.spec.ts
index cc616e84f..730fa2faf 100644
--- a/client/src/features/settings/__tests__/settings-nav.spec.ts
+++ b/client/src/features/settings/__tests__/settings-nav.spec.ts
@@ -54,7 +54,7 @@ describe('visibleSettingsNav', () => {
   })
 
   it('keeps every group for a superuser', () => {
-    expect(visibleSettingsNav(SUPERUSER).map((group) => group.id)).toEqual(['you', 'library', 'devices', 'server'])
+    expect(visibleSettingsNav(SUPERUSER).map((group) => group.id)).toEqual(['you', 'library', 'devices', 'accounts', 'server'])
   })
 
   it('hides notifications without notification access', () => {
@@ -85,9 +85,25 @@ describe('visibleSettingsNav', () => {
   it('only exposes the metadata pages the permission allows', () => {
     const library = visibleSettingsNav({ ...NOBODY, permissions: ['manage_libraries'] }).find((group) => group.id === 'library')
     const ids = library?.items.map((item) => item.id) ?? []
+    const metadataChildren = library?.items.find((item) => item.id === 'metadata')?.children?.map((child) => child.id) ?? []
+
     expect(ids).toContain('libraries')
-    expect(ids).toContain('metadata-custom-fields')
-    expect(ids).not.toContain('metadata-providers')
+    expect(metadataChildren).toContain('metadata-custom-fields')
+    expect(metadataChildren).not.toContain('metadata-providers')
+  })
+
+  it('drops a grouping row once every child behind it is hidden', () => {
+    const library = visibleSettingsNav({ ...NOBODY, permissions: ['manage_app_settings'] }).find((group) => group.id === 'library')
+    expect(library?.items.map((item) => item.id)).not.toContain('metadata')
+
+    const server = visibleSettingsNav({ ...NOBODY, permissions: [Permission.ManageBookDock] }).find((group) => group.id === 'server')
+    expect(server?.items.map((item) => item.id)).not.toContain('users-access')
+  })
+
+  it('keeps a grouping row when a single child survives', () => {
+    const server = visibleSettingsNav({ ...NOBODY, permissions: ['manage_users'] }).find((group) => group.id === 'server')
+    const access = server?.items.find((item) => item.id === 'users-access')
+    expect(access?.children?.map((child) => child.id)).toEqual(['users'])
   })
 })
 
diff --git a/client/src/features/settings/__tests__/system-tabs.spec.ts b/client/src/features/settings/__tests__/system-tabs.spec.ts
index 8881811d9..13a748c2f 100644
--- a/client/src/features/settings/__tests__/system-tabs.spec.ts
+++ b/client/src/features/settings/__tests__/system-tabs.spec.ts
@@ -1,46 +1,14 @@
 import { describe, expect, it } from 'vitest'
-import { Permission } from '@bookorbit/types'
-import { SYSTEM_TABS, SYSTEM_TAB_INFO, normalizeSystemTab } from '../lib/system-tabs'
+import { SYSTEM_TABS, normalizeSystemTab } from '../lib/system-tabs'
 
 describe('system-tabs', () => {
   describe('SYSTEM_TABS', () => {
-    it('contains exactly file-naming, book-dock, maintenance, audit-log', () => {
-      expect(SYSTEM_TABS).toEqual(['file-naming', 'book-dock', 'maintenance', 'audit-log'])
+    it('contains exactly file-naming, book-dock, requests, maintenance, audit-log', () => {
+      expect(SYSTEM_TABS).toEqual(['file-naming', 'book-dock', 'requests', 'maintenance', 'audit-log'])
     })
 
-    it('has length 4', () => {
-      expect(SYSTEM_TABS.length).toBe(4)
-    })
-  })
-
-  describe('SYSTEM_TAB_INFO', () => {
-    it('has an entry for every tab', () => {
-      for (const tab of SYSTEM_TABS) {
-        expect(SYSTEM_TAB_INFO[tab]).toBeDefined()
-      }
-    })
-
-    it('every entry has a permission', () => {
-      for (const tab of SYSTEM_TABS) {
-        const info = SYSTEM_TAB_INFO[tab]
-        expect(info.permission === null || typeof info.permission === 'string').toBe(true)
-      }
-    })
-
-    it('file-naming has manage_app_settings permission', () => {
-      expect(SYSTEM_TAB_INFO['file-naming'].permission).toBe(Permission.ManageAppSettings)
-    })
-
-    it('book-dock requires management permission', () => {
-      expect(SYSTEM_TAB_INFO['book-dock'].permission).toBe(Permission.ManageBookDock)
-    })
-
-    it('maintenance has manage_app_settings permission', () => {
-      expect(SYSTEM_TAB_INFO.maintenance.permission).toBe(Permission.ManageAppSettings)
-    })
-
-    it('audit-log has null permission (superuser only)', () => {
-      expect(SYSTEM_TAB_INFO['audit-log'].permission).toBeNull()
+    it('has length 5', () => {
+      expect(SYSTEM_TABS.length).toBe(5)
     })
   })
 
@@ -73,6 +41,10 @@ describe('system-tabs', () => {
       expect(normalizeSystemTab('book-dock')).toBe('book-dock')
     })
 
+    it('returns requests when given "requests"', () => {
+      expect(normalizeSystemTab('requests')).toBe('requests')
+    })
+
     it('returns maintenance when given "maintenance"', () => {
       expect(normalizeSystemTab('maintenance')).toBe('maintenance')
     })
diff --git a/client/src/features/settings/__tests__/useSettingsDraft.spec.ts b/client/src/features/settings/__tests__/useSettingsDraft.spec.ts
new file mode 100644
index 000000000..f9b5b925a
--- /dev/null
+++ b/client/src/features/settings/__tests__/useSettingsDraft.spec.ts
@@ -0,0 +1,72 @@
+import { describe, expect, it } from 'vitest'
+
+import { useSettingsDraft } from '../composables/useSettingsDraft'
+
+interface Row {
+  id: number | null
+  name: string
+}
+
+describe('useSettingsDraft', () => {
+  it('starts closed with nothing being edited', () => {
+    const { draft, open, isDirty } = useSettingsDraft<Row>()
+
+    expect(draft.value).toBeNull()
+    expect(open.value).toBe(false)
+    expect(isDirty.value).toBe(false)
+  })
+
+  it('opens on a record and reports it untouched', () => {
+    const { draft, open, isDirty, start } = useSettingsDraft<Row>()
+
+    start({ id: 1, name: 'Jackett' })
+
+    expect(draft.value).toEqual({ id: 1, name: 'Jackett' })
+    expect(open.value).toBe(true)
+    expect(isDirty.value).toBe(false)
+  })
+
+  it('reports a typed change, and forgets it once marked pristine', () => {
+    const { draft, isDirty, start, markPristine } = useSettingsDraft<Row>()
+    start({ id: 1, name: 'Jackett' })
+
+    draft.value!.name = 'Prowlarr'
+    expect(isDirty.value).toBe(true)
+
+    markPristine()
+    expect(isDirty.value).toBe(false)
+  })
+
+  /** The sheet animates out, and unmounting the form it renders in the same tick skips that. */
+  it('keeps the record after closing, so the sheet has something to animate out', () => {
+    const { draft, open, start, close } = useSettingsDraft<Row>()
+    start({ id: 1, name: 'Jackett' })
+
+    close()
+
+    expect(open.value).toBe(false)
+    expect(draft.value).toEqual({ id: 1, name: 'Jackett' })
+  })
+
+  /** Otherwise the row behind a closed editor is refused a Test forever. */
+  it('stops reporting dirty once the editor is closed', () => {
+    const { draft, isDirty, start, close } = useSettingsDraft<Row>()
+    start({ id: 1, name: 'Jackett' })
+    draft.value!.name = 'Prowlarr'
+
+    close()
+
+    expect(isDirty.value).toBe(false)
+  })
+
+  it('replaces the record left behind when the next one opens', () => {
+    const { draft, open, start, close } = useSettingsDraft<Row>()
+    start({ id: 1, name: 'Jackett' })
+    close()
+
+    start({ id: 2, name: 'NZBHydra' })
+
+    expect(open.value).toBe(true)
+    expect(draft.value).toEqual({ id: 2, name: 'NZBHydra' })
+  })
+})
diff --git a/client/src/features/settings/components/AdapterTypePicker.vue b/client/src/features/settings/components/AdapterTypePicker.vue
new file mode 100644
index 000000000..637a2ea07
--- /dev/null
+++ b/client/src/features/settings/components/AdapterTypePicker.vue
@@ -0,0 +1,56 @@
+<script setup lang="ts">
+export interface AdapterTypeOption {
+  type: string
+  label: string
+  description?: string
+  builtIn: boolean
+}
+
+/**
+ * Choosing the kind of thing before filling the form in, rather than a select inside the form that
+ * rewrites base URL, categories and every adapter setting under a half-filled draft.
+ */
+defineProps<{
+  options: AdapterTypeOption[]
+  selected: string | null
+  legend: string
+  name: string
+  builtInLabel: string
+  pluginLabel: string
+}>()
+
+const emit = defineEmits<{ select: [type: string] }>()
+
+function handleSelect(type: string) {
+  emit('select', type)
+}
+</script>
+
+<template>
+  <fieldset class="min-w-0">
+    <legend class="sr-only">{{ legend }}</legend>
+    <div class="grid gap-2 sm:grid-cols-2">
+      <label v-for="option in options" :key="option.type" class="min-w-0 cursor-pointer">
+        <input
+          type="radio"
+          class="peer sr-only"
+          :name="name"
+          :value="option.type"
+          :checked="selected === option.type"
+          @change="handleSelect(option.type)"
+        />
+        <span
+          class="flex h-full flex-col gap-1 rounded-lg border border-border bg-card p-3 transition-colors peer-checked:border-primary peer-checked:ring-1 peer-checked:ring-primary peer-focus-visible:ring-2 peer-focus-visible:ring-ring hover:border-ring"
+        >
+          <span class="flex items-start justify-between gap-2">
+            <span class="settings-label min-w-0">{{ option.label }}</span>
+            <span class="shrink-0 rounded-full bg-muted px-2 py-0.5 text-[11px] font-medium text-muted-foreground">
+              {{ option.builtIn ? builtInLabel : pluginLabel }}
+            </span>
+          </span>
+          <span v-if="option.description" class="settings-hint">{{ option.description }}</span>
+        </span>
+      </label>
+    </div>
+  </fieldset>
+</template>
diff --git a/client/src/features/settings/components/FieldHint.vue b/client/src/features/settings/components/FieldHint.vue
new file mode 100644
index 000000000..419e630f8
--- /dev/null
+++ b/client/src/features/settings/components/FieldHint.vue
@@ -0,0 +1,15 @@
+<script setup lang="ts">
+/**
+ * One line under a control. A settings form that sets three sentences of prose beside every input
+ * reads as documentation with inputs embedded in it, so a hint says the one thing worth saying and
+ * the rest belongs in the docs.
+ */
+defineProps<{
+  /** Short enough to sit on one line beside the field it belongs to. */
+  brief: string
+}>()
+</script>
+
+<template>
+  <p class="settings-hint">{{ brief }}</p>
+</template>
diff --git a/client/src/features/settings/components/PluginDirectoryLink.vue b/client/src/features/settings/components/PluginDirectoryLink.vue
new file mode 100644
index 000000000..3670570b0
--- /dev/null
+++ b/client/src/features/settings/components/PluginDirectoryLink.vue
@@ -0,0 +1,27 @@
+<script setup lang="ts">
+import { useI18n } from 'vue-i18n'
+import { ExternalLink } from '@lucide/vue'
+
+/**
+ * The way out to the plugin collection, sized as a link rather than as a card.
+ *
+ * It belongs inside the sentence that explains what a plugin is, in the group hint and in the empty
+ * panel alike. Given its own bordered card it read at the weight of a configured source, and above
+ * both group headings it belonged to neither.
+ */
+const OPEN_PLUGIN_DIRECTORY_URL = 'https://github.com/orbit-plugins/bookorbit-open-plugins'
+
+const { t } = useI18n()
+</script>
+
+<template>
+  <a
+    :href="OPEN_PLUGIN_DIRECTORY_URL"
+    target="_blank"
+    rel="noopener noreferrer"
+    class="inline-flex items-center gap-1 rounded-sm align-baseline text-primary focus-visible:ring-2 focus-visible:ring-ring focus-visible:outline-none"
+  >
+    <span class="underline underline-offset-2">{{ t('settings.system.requests.indexers.plugins.directoryLink') }}</span>
+    <ExternalLink :size="12" class="shrink-0" aria-hidden="true" />
+  </a>
+</template>
diff --git a/client/src/features/settings/components/PluginVersionBadge.vue b/client/src/features/settings/components/PluginVersionBadge.vue
new file mode 100644
index 000000000..1d4616e4f
--- /dev/null
+++ b/client/src/features/settings/components/PluginVersionBadge.vue
@@ -0,0 +1,20 @@
+<script setup lang="ts">
+import { computed } from 'vue'
+import { useI18n } from 'vue-i18n'
+
+const props = defineProps<{ version?: string }>()
+
+const { t } = useI18n()
+
+const accessibleLabel = computed(() =>
+  props.version
+    ? t('settings.system.requests.indexers.plugins.versionLabel', { version: props.version })
+    : t('settings.system.requests.indexers.plugins.versionUnknown'),
+)
+</script>
+
+<template>
+  <span class="rounded-full bg-muted px-2 py-0.5 font-mono text-[11px] text-muted-foreground" :aria-label="accessibleLabel" :title="accessibleLabel">
+    v{{ version ?? '?' }}
+  </span>
+</template>
diff --git a/client/src/features/settings/components/ReleaseProfileEditor.vue b/client/src/features/settings/components/ReleaseProfileEditor.vue
new file mode 100644
index 000000000..d3a2158c4
--- /dev/null
+++ b/client/src/features/settings/components/ReleaseProfileEditor.vue
@@ -0,0 +1,410 @@
+<script setup lang="ts">
+import { computed, ref, watch } from 'vue'
+import { useI18n } from 'vue-i18n'
+import { ArrowDown, ArrowUp, Plus, X } from '@lucide/vue'
+import {
+  AUDIO_FORMAT_LIST,
+  COMIC_FORMAT_LIST,
+  EBOOK_FORMAT_LIST,
+  MAX_RELEASE_TIER_NAME_LENGTH,
+  MAX_RELEASE_TIERS,
+  REQUEST_LANGUAGE_CODES,
+} from '@bookorbit/types'
+import type { BookRequestMediaKind, IndexerItem, ReleaseFileLayout, ReleaseTier, ReleaseTierConditions } from '@bookorbit/types'
+import { Button } from '@/components/ui/button'
+import TokenSelect from '@/components/ui/TokenSelect.vue'
+import { formatLanguageName } from '@/i18n/formatters'
+
+/**
+ * One medium's release profile: an ordered list of the shapes an operator will accept, best first.
+ * Order is the whole meaning here, so reordering is a first-class control rather than a detail.
+ */
+const props = defineProps<{
+  mediaKind: BookRequestMediaKind
+  tiers: ReleaseTier[]
+  indexers: readonly Pick<IndexerItem, 'id' | 'name'>[]
+}>()
+
+const emit = defineEmits<{ update: [mediaKind: BookRequestMediaKind, tiers: ReleaseTier[]] }>()
+
+const { t, locale } = useI18n()
+
+/**
+ * The list this editor draws, held locally so a chip responds to the click rather than to the save.
+ *
+ * Driven straight from the prop, every control on a tier waited for its own round trip before it
+ * looked pressed, which is also what made a debounce impossible: the save was the only thing that
+ * moved the UI. The prop is still the authority; it is adopted whenever it says something this
+ * editor did not.
+ */
+const tiers = ref<ReleaseTier[]>(clone(props.tiers))
+/** What `tiers` was last taken from, so an unrelated save re-emitting the settings is not a change. */
+let adopted = JSON.stringify(props.tiers)
+/** True while the server has not yet echoed the latest local profile back. */
+let dirty = false
+
+watch(
+  () => props.tiers,
+  (next) => {
+    const serialized = JSON.stringify(next)
+    if (dirty) {
+      // A different settings control can return the old profile while this editor's debounce is
+      // still waiting. Ignore that stale echo; the matching reply from this profile's own save is
+      // what makes the prop authoritative again.
+      if (serialized === adopted) dirty = false
+      return
+    }
+    if (serialized === adopted) return
+    adopted = serialized
+    tiers.value = clone(next)
+  },
+)
+
+function clone(list: ReleaseTier[]): ReleaseTier[] {
+  return list.map((tier) => ({ ...tier, conditions: { ...tier.conditions } }))
+}
+
+/** Offered from the same lists the matcher accepts, so a form can never state an impossible tier. */
+const FORMATS: Record<BookRequestMediaKind, readonly string[]> = {
+  ebook: EBOOK_FORMAT_LIST,
+  audiobook: AUDIO_FORMAT_LIST,
+  comic: [...COMIC_FORMAT_LIST, 'pdf'],
+}
+
+/** Bitrate and channels describe an encode, which an ebook or a comic does not have. */
+const isAudio = computed(() => props.mediaKind === 'audiobook')
+const formats = computed(() => FORMATS[props.mediaKind])
+const languageOptions = computed(() =>
+  REQUEST_LANGUAGE_CODES.map((code) => ({ value: code, label: formatLanguageName(code) })).sort((left, right) =>
+    left.label.localeCompare(right.label, locale.value),
+  ),
+)
+const indexerOptions = computed(() => props.indexers.map((indexer) => ({ value: String(indexer.id), label: indexer.name })))
+
+/** One hint for both pickers, so each field points at the same sentence rather than repeating it. */
+const multiSelectHintId = `release-profile-multi-select-hint-${props.mediaKind}`
+const canAdd = computed(() => tiers.value.length < MAX_RELEASE_TIERS)
+/**
+ * Shown only once a tier actually sets a floor. MyAnonaMouse publishes MediaInfo for some torrents
+ * and not others, so a floor silently matches nothing on a book nobody measured, and the fix - a
+ * tier below it without one - is not something an operator would guess from an empty result.
+ */
+const warnsAboutBitrate = computed(() => tiers.value.some((tier) => tier.conditions.minBitrateKbps !== undefined))
+const LAYOUTS: ReleaseFileLayout[] = ['single', 'multi']
+
+function commit(next: ReleaseTier[]) {
+  tiers.value = next
+  adopted = JSON.stringify(next)
+  dirty = true
+  emit('update', props.mediaKind, next)
+}
+
+function patch(index: number, conditions: Partial<ReleaseTierConditions>) {
+  commit(tiers.value.map((tier, i) => (i === index ? { ...tier, conditions: prune({ ...tier.conditions, ...conditions }) } : tier)))
+}
+
+/**
+ * An absent key and an empty one mean different things to the matcher: `formats: []` would be
+ * stored as a condition that constrains nothing, and a cleared number must stop being a floor
+ * rather than become a floor of zero.
+ */
+function prune(conditions: ReleaseTierConditions): ReleaseTierConditions {
+  const next: ReleaseTierConditions = { ...conditions }
+  if (next.formats && next.formats.length === 0) delete next.formats
+  if (next.languages && next.languages.length === 0) delete next.languages
+  if (next.indexerIds && next.indexerIds.length === 0) delete next.indexerIds
+  if (next.minBitrateKbps === undefined || Number.isNaN(next.minBitrateKbps)) delete next.minBitrateKbps
+  if (next.minSeeders === undefined || Number.isNaN(next.minSeeders)) delete next.minSeeders
+  if (next.channels === undefined || Number.isNaN(next.channels)) delete next.channels
+  if (next.maxSizeBytes === undefined || Number.isNaN(next.maxSizeBytes)) delete next.maxSizeBytes
+  if (next.freeleechOnly === false) delete next.freeleechOnly
+  if (next.excludeVipOnly === false) delete next.excludeVipOnly
+  return next
+}
+
+function addTier() {
+  if (!canAdd.value) return
+  const tier: ReleaseTier = {
+    id: crypto.randomUUID(),
+    name: t('settings.system.requests.profiles.newTier', { position: tiers.value.length + 1 }),
+    conditions: {},
+  }
+  commit([...tiers.value, tier])
+}
+
+function removeTier(index: number) {
+  commit(tiers.value.filter((_, i) => i !== index))
+}
+
+/** Buttons rather than drag: the list is short, and this stays usable from a keyboard. */
+function move(index: number, delta: number) {
+  const target = index + delta
+  if (target < 0 || target >= tiers.value.length) return
+  const next = [...tiers.value]
+  const [moved] = next.splice(index, 1)
+  if (!moved) return
+  next.splice(target, 0, moved)
+  commit(next)
+}
+
+function handleName(index: number, event: Event) {
+  const name = (event.target as HTMLInputElement).value.trim()
+  commit(tiers.value.map((tier, i) => (i === index ? { ...tier, name } : tier)))
+}
+
+function toggleFormat(index: number, format: string) {
+  const current = tiers.value[index]?.conditions.formats ?? []
+  const next = current.includes(format) ? current.filter((value) => value !== format) : [...current, format]
+  patch(index, { formats: next })
+}
+
+function handleLayout(index: number, event: Event) {
+  const value = (event.target as HTMLSelectElement).value
+  patch(index, { fileLayout: value === '' ? undefined : (value as ReleaseFileLayout) })
+}
+
+function handleNumber(index: number, key: 'minBitrateKbps' | 'minSeeders', event: Event) {
+  const raw = (event.target as HTMLInputElement).value.trim()
+  patch(index, { [key]: raw === '' ? undefined : Number(raw) })
+}
+
+/** The two the matcher understands: 1 is mono, 2 is stereo. Anything else it treats as unstated. */
+const MONO = 1
+const STEREO = 2
+
+function handleChannels(index: number, event: Event) {
+  const value = Number((event.target as HTMLSelectElement).value)
+  patch(index, { channels: value === MONO || value === STEREO ? value : undefined })
+}
+
+/** Stored in bytes and entered in megabytes, because nobody types a ceiling in bytes. */
+const BYTES_PER_MEGABYTE = 1024 * 1024
+
+function sizeInMegabytes(bytes: number | undefined): number | '' {
+  return bytes === undefined ? '' : Math.round(bytes / BYTES_PER_MEGABYTE)
+}
+
+function handleMaxSize(index: number, event: Event) {
+  const raw = (event.target as HTMLInputElement).value.trim()
+  const megabytes = Number(raw)
+  patch(index, { maxSizeBytes: raw === '' || !Number.isFinite(megabytes) || megabytes <= 0 ? undefined : megabytes * BYTES_PER_MEGABYTE })
+}
+
+function handleLanguages(index: number, languages: string[]) {
+  patch(index, { languages })
+}
+
+function handleIndexers(index: number, indexerIds: string[]) {
+  patch(index, { indexerIds: indexerIds.map(Number).filter(Number.isInteger) })
+}
+
+function handleFreeleech(index: number, event: Event) {
+  patch(index, { freeleechOnly: (event.target as HTMLInputElement).checked })
+}
+
+function handleExcludeVip(index: number, event: Event) {
+  patch(index, { excludeVipOnly: (event.target as HTMLInputElement).checked })
+}
+
+function hasFormat(index: number, format: string): boolean {
+  return (tiers.value[index]?.conditions.formats ?? []).includes(format)
+}
+</script>
+
+<template>
+  <div>
+    <p v-if="tiers.length === 0" class="settings-hint settings-prose">
+      {{ t('settings.system.requests.profiles.empty') }}
+    </p>
+
+    <ol v-else class="grid gap-2">
+      <li v-for="(tier, index) in tiers" :key="tier.id" class="rounded-lg border border-border bg-card p-3">
+        <div class="flex flex-wrap items-center gap-2">
+          <span
+            class="flex size-6 shrink-0 items-center justify-center rounded-md border border-border bg-muted text-[11px] font-semibold tabular-nums text-muted-foreground"
+            aria-hidden="true"
+          >
+            {{ index + 1 }}
+          </span>
+
+          <input
+            :value="tier.name"
+            type="text"
+            class="min-w-0 flex-1 rounded-md border border-input bg-background px-2 py-1 text-xs text-foreground focus-visible:ring-2 focus-visible:ring-ring focus-visible:outline-none"
+            :aria-label="t('settings.system.requests.profiles.tierName')"
+            :maxlength="MAX_RELEASE_TIER_NAME_LENGTH"
+            @change="handleName(index, $event)"
+          />
+
+          <div class="flex items-center gap-1">
+            <Button
+              variant="ghost"
+              size="icon"
+              :disabled="index === 0"
+              :aria-label="t('settings.system.requests.profiles.moveUp')"
+              @click="move(index, -1)"
+            >
+              <ArrowUp :size="14" aria-hidden="true" />
+            </Button>
+            <Button
+              variant="ghost"
+              size="icon"
+              :disabled="index === tiers.length - 1"
+              :aria-label="t('settings.system.requests.profiles.moveDown')"
+              @click="move(index, 1)"
+            >
+              <ArrowDown :size="14" aria-hidden="true" />
+            </Button>
+            <Button variant="ghost" size="icon" :aria-label="t('settings.system.requests.profiles.removeTier')" @click="removeTier(index)">
+              <X :size="14" aria-hidden="true" />
+            </Button>
+          </div>
+        </div>
+
+        <div class="mt-2.5 flex flex-wrap items-center gap-x-4 gap-y-2">
+          <div class="flex flex-wrap items-center gap-1.5">
+            <span class="text-[11px] font-semibold tracking-wide text-muted-foreground uppercase">
+              {{ t('settings.system.requests.profiles.formats') }}
+            </span>
+            <button
+              v-for="format in formats"
+              :key="format"
+              type="button"
+              class="rounded-full border px-2 py-0.5 text-xs uppercase transition-colors focus-visible:ring-2 focus-visible:ring-ring focus-visible:outline-none motion-reduce:transition-none"
+              :class="
+                hasFormat(index, format)
+                  ? 'border-primary bg-primary text-primary-foreground'
+                  : 'border-border text-muted-foreground hover:border-ring hover:text-foreground'
+              "
+              :aria-pressed="hasFormat(index, format)"
+              @click="toggleFormat(index, format)"
+            >
+              {{ format }}
+            </button>
+          </div>
+
+          <label class="flex items-center gap-1.5 text-xs text-muted-foreground">
+            {{ t('settings.system.requests.profiles.files') }}
+            <select
+              :value="tier.conditions.fileLayout ?? ''"
+              class="rounded-md border border-input bg-background px-1.5 py-1 text-xs text-foreground"
+              @change="handleLayout(index, $event)"
+            >
+              <option value="">{{ t('settings.system.requests.profiles.anyLayout') }}</option>
+              <option v-for="layout in LAYOUTS" :key="layout" :value="layout">
+                {{ t(`bookRequests.releases.fileLayout.${layout}`) }}
+              </option>
+            </select>
+          </label>
+
+          <label v-if="isAudio" class="flex items-center gap-1.5 text-xs text-muted-foreground">
+            {{ t('settings.system.requests.profiles.minBitrate') }}
+            <input
+              :value="tier.conditions.minBitrateKbps ?? ''"
+              type="number"
+              min="0"
+              step="16"
+              class="w-16 rounded-md border border-input bg-background px-1.5 py-1 text-xs tabular-nums text-foreground"
+              @change="handleNumber(index, 'minBitrateKbps', $event)"
+            />
+          </label>
+
+          <label v-if="isAudio" class="flex items-center gap-1.5 text-xs text-muted-foreground">
+            {{ t('settings.system.requests.profiles.channels') }}
+            <select
+              :value="tier.conditions.channels ?? ''"
+              class="rounded-md border border-input bg-background px-1.5 py-1 text-xs text-foreground"
+              @change="handleChannels(index, $event)"
+            >
+              <option value="">{{ t('settings.system.requests.profiles.anyChannels') }}</option>
+              <option :value="MONO">{{ t('settings.system.requests.profiles.mono') }}</option>
+              <option :value="STEREO">{{ t('settings.system.requests.profiles.stereo') }}</option>
+            </select>
+          </label>
+
+          <label class="flex items-center gap-1.5 text-xs text-muted-foreground">
+            {{ t('settings.system.requests.profiles.minSeeders') }}
+            <input
+              :value="tier.conditions.minSeeders ?? ''"
+              type="number"
+              min="0"
+              class="w-16 rounded-md border border-input bg-background px-1.5 py-1 text-xs tabular-nums text-foreground"
+              @change="handleNumber(index, 'minSeeders', $event)"
+            />
+          </label>
+
+          <label class="flex items-center gap-1.5 text-xs text-muted-foreground">
+            {{ t('settings.system.requests.profiles.maxSize') }}
+            <input
+              :value="sizeInMegabytes(tier.conditions.maxSizeBytes)"
+              type="number"
+              min="0"
+              class="w-20 rounded-md border border-input bg-background px-1.5 py-1 text-xs tabular-nums text-foreground"
+              @change="handleMaxSize(index, $event)"
+            />
+          </label>
+
+          <label class="flex items-center gap-1.5 text-xs text-muted-foreground">
+            <input
+              type="checkbox"
+              class="accent-primary"
+              :checked="tier.conditions.freeleechOnly === true"
+              @change="handleFreeleech(index, $event)"
+            />
+            {{ t('bookRequests.releases.freeleech') }}
+          </label>
+
+          <label class="flex items-center gap-1.5 text-xs text-muted-foreground">
+            <input
+              type="checkbox"
+              class="accent-primary"
+              :checked="tier.conditions.excludeVipOnly === true"
+              @change="handleExcludeVip(index, $event)"
+            />
+            {{ t('bookRequests.releases.hideVipOnly') }}
+          </label>
+
+          <div class="flex min-w-48 flex-1 basis-56 flex-col items-stretch gap-1">
+            <label :for="`${tier.id}-languages`" class="text-xs text-muted-foreground">
+              {{ t('settings.system.requests.profiles.languages') }}
+            </label>
+            <TokenSelect
+              :input-id="`${tier.id}-languages`"
+              :options="languageOptions"
+              :model-value="tier.conditions.languages ?? []"
+              :placeholder="t('settings.system.requests.profiles.multiSelectAny')"
+              :described-by="multiSelectHintId"
+              @update:model-value="handleLanguages(index, $event)"
+            />
+          </div>
+
+          <div class="flex min-w-48 flex-1 basis-56 flex-col items-stretch gap-1">
+            <label :for="`${tier.id}-indexers`" class="text-xs text-muted-foreground">
+              {{ t('settings.system.requests.profiles.indexers') }}
+            </label>
+            <TokenSelect
+              :input-id="`${tier.id}-indexers`"
+              :options="indexerOptions"
+              :model-value="tier.conditions.indexerIds?.map(String) ?? []"
+              :placeholder="t('settings.system.requests.profiles.multiSelectAny')"
+              :described-by="multiSelectHintId"
+              :disabled="indexers.length === 0"
+              @update:model-value="handleIndexers(index, $event)"
+            />
+          </div>
+        </div>
+      </li>
+    </ol>
+
+    <p :id="multiSelectHintId" class="sr-only">{{ t('settings.system.requests.profiles.multiSelectHint') }}</p>
+
+    <p v-if="warnsAboutBitrate" class="settings-hint settings-prose mt-2">
+      {{ t('settings.system.requests.profiles.bitrateNote') }}
+    </p>
+
+    <Button variant="outline" size="sm" class="mt-2.5" :disabled="!canAdd" @click="addTier">
+      <Plus :size="14" aria-hidden="true" />
+      {{ t('settings.system.requests.profiles.addTier') }}
+    </Button>
+  </div>
+</template>
diff --git a/client/src/features/settings/components/RequestDestinationRow.vue b/client/src/features/settings/components/RequestDestinationRow.vue
new file mode 100644
index 000000000..83a99b843
--- /dev/null
+++ b/client/src/features/settings/components/RequestDestinationRow.vue
@@ -0,0 +1,105 @@
+<script setup lang="ts">
+import { computed } from 'vue'
+import { useI18n } from 'vue-i18n'
+import { X } from '@lucide/vue'
+import type { BookRequestMediaKind, Library, RequestDestination } from '@bookorbit/types'
+import { Button } from '@/components/ui/button'
+
+const props = defineProps<{
+  mediaKind: BookRequestMediaKind
+  libraries: Library[]
+  destination: RequestDestination
+}>()
+
+const emit = defineEmits<{ update: [mediaKind: BookRequestMediaKind, destination: RequestDestination] }>()
+
+const { t } = useI18n()
+
+const selectedLibrary = computed(() => props.libraries.find((library) => library.id === props.destination.libraryId) ?? null)
+const folders = computed(() => selectedLibrary.value?.folders ?? [])
+
+/**
+ * A default set by an operator who can reach more libraries than this one can.
+ *
+ * The select has no option matching the stored id, so it rendered blank and read as "no default" -
+ * one keystroke away from an operator helpfully setting the destination to something they can see
+ * and silently rerouting every request of that medium. A disabled placeholder says what is
+ * actually stored instead, and is not something they can pick.
+ */
+const libraryIsHidden = computed(() => props.destination.libraryId !== null && selectedLibrary.value === null)
+const folderIsHidden = computed(
+  () => props.destination.folderId !== null && !folders.value.some((folder) => folder.id === props.destination.folderId),
+)
+
+/**
+ * A select cuts a long path off at its end, which is the only part that differs when every folder
+ * sits under the same root: three rows all reading `/path/to/library/p...` name nothing.
+ * The last two segments are what the operator recognises, and the full path stays on hover.
+ */
+function folderLabel(path: string): string {
+  const segments = path.split('/').filter(Boolean)
+  return segments.length > 2 ? `.../${segments.slice(-2).join('/')}` : path
+}
+
+/**
+ * Changing the library takes its first folder rather than keeping the one on screen: a folder from
+ * the previous library would file every request of this medium into that library instead.
+ */
+function handleLibraryChange(event: Event) {
+  const value = (event.target as HTMLSelectElement).value
+  const libraryId = value === '' ? null : Number(value)
+  const folderId = props.libraries.find((library) => library.id === libraryId)?.folders?.[0]?.id ?? null
+  emit('update', props.mediaKind, { libraryId, folderId })
+}
+
+function handleFolderChange(event: Event) {
+  emit('update', props.mediaKind, { libraryId: props.destination.libraryId, folderId: Number((event.target as HTMLSelectElement).value) })
+}
+
+function handleClear() {
+  emit('update', props.mediaKind, { libraryId: null, folderId: null })
+}
+</script>
+
+<template>
+  <div class="grid gap-2 sm:grid-cols-[8rem_1fr_1fr_auto] sm:items-end">
+    <span class="text-xs font-medium text-foreground sm:pb-2">{{ t(`bookRequests.mediaKind.${mediaKind}`) }}</span>
+
+    <label class="block">
+      <span class="sr-only">{{
+        t('settings.system.requests.automation.destinationLibraryFor', { medium: t(`bookRequests.mediaKind.${mediaKind}`) })
+      }}</span>
+      <select class="select-field w-full" :value="destination.libraryId ?? ''" @change="handleLibraryChange">
+        <option value="">{{ t('settings.system.requests.automation.destinationUnset') }}</option>
+        <option v-if="libraryIsHidden" :value="destination.libraryId" disabled>
+          {{ t('settings.system.requests.automation.destinationHiddenLibrary') }}
+        </option>
+        <option v-for="library in libraries" :key="library.id" :value="library.id">{{ library.name }}</option>
+      </select>
+    </label>
+
+    <label class="block">
+      <span class="sr-only">{{
+        t('settings.system.requests.automation.destinationFolderFor', { medium: t(`bookRequests.mediaKind.${mediaKind}`) })
+      }}</span>
+      <select class="select-field w-full" :value="destination.folderId ?? ''" :disabled="destination.libraryId === null" @change="handleFolderChange">
+        <option value="" disabled>{{ t('settings.system.requests.automation.selectFolder') }}</option>
+        <option v-if="folderIsHidden" :value="destination.folderId" disabled>
+          {{ t('settings.system.requests.automation.destinationHiddenFolder') }}
+        </option>
+        <option v-for="folder in folders" :key="folder.id" :value="folder.id" :title="folder.path">{{ folderLabel(folder.path) }}</option>
+      </select>
+    </label>
+
+    <Button
+      variant="ghost"
+      size="icon-sm"
+      class="justify-self-start sm:justify-self-auto"
+      :disabled="destination.libraryId === null"
+      :aria-label="t('settings.system.requests.automation.destinationClearFor', { medium: t(`bookRequests.mediaKind.${mediaKind}`) })"
+      @click="handleClear"
+    >
+      <X :size="15" aria-hidden="true" />
+    </Button>
+  </div>
+</template>
diff --git a/client/src/features/settings/components/RequestSourceRow.vue b/client/src/features/settings/components/RequestSourceRow.vue
new file mode 100644
index 000000000..820dc5f24
--- /dev/null
+++ b/client/src/features/settings/components/RequestSourceRow.vue
@@ -0,0 +1,204 @@
+<script setup lang="ts">
+import { computed } from 'vue'
+import { useI18n } from 'vue-i18n'
+import { Loader2, Pencil, Plug, Server, Trash2, TriangleAlert, Upload } from '@lucide/vue'
+import type { IndexerItem } from '@bookorbit/types'
+import { Button } from '@/components/ui/button'
+import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from '@/components/ui/tooltip'
+import ToggleSwitch from '@/components/ui/ToggleSwitch.vue'
+import ConnectionHealth from '../ConnectionHealth.vue'
+import SearchHealth from '../SearchHealth.vue'
+import { sourceDotClass } from '@/features/book-requests/sourceColors'
+import PluginVersionBadge from './PluginVersionBadge.vue'
+
+/**
+ * One configured source. The same row in both groups on the Requests page: a plugin and a Torznab
+ * endpoint are added in different ways but are the same thing once they exist, and rendering them
+ * differently would say they are not.
+ */
+const props = defineProps<{
+  indexer: IndexerItem
+  testing: boolean
+  /** False once a plugin behind a row is gone, which the row has to explain rather than hide. */
+  available: boolean
+  plugin?: boolean
+  /** The installed plugin release. Missing for legacy plugins that predate this metadata. */
+  pluginVersion?: string
+  /** True while this row's enabled flag is in flight, so the switch cannot be double-flipped. */
+  busy?: boolean
+  /**
+   * Whether the plugin behind this row can be updated or removed here. Off for a Torznab row,
+   * which is compiled in, and for anyone who is not an administrator.
+   */
+  managePlugin?: boolean
+  /** True while this plugin's removal is in flight, so its own two controls go inert. */
+  pluginBusy?: boolean
+}>()
+
+const emit = defineEmits<{ test: []; edit: []; toggle: [enabled: boolean]; updatePlugin: []; removePlugin: [] }>()
+
+const { t } = useI18n()
+
+const failing = computed(() => props.indexer.enabled && props.indexer.lastTestOk === false)
+/** Mirrors `SearchHealth`'s own rule, so the sentence below only appears under the badge. */
+const searchFailing = computed(() => props.indexer.enabled && props.indexer.lastSearchOk === false && props.indexer.searchFailureStreak > 0)
+
+function handleToggle(enabled: boolean) {
+  emit('toggle', enabled)
+}
+
+function handleTest() {
+  emit('test')
+}
+
+function handleEdit() {
+  emit('edit')
+}
+
+function handleUpdatePlugin() {
+  emit('updatePlugin')
+}
+
+function handleRemovePlugin() {
+  emit('removePlugin')
+}
+</script>
+
+<template>
+  <div class="bg-card px-4 py-3.5 md:px-5 md:py-4" :class="failing ? 'rounded-[inherit] ring-1 ring-destructive/40' : ''">
+    <div class="flex flex-wrap items-start justify-between gap-3">
+      <div class="flex min-w-0 flex-1 basis-72 gap-3">
+        <span
+          class="flex size-8 shrink-0 items-center justify-center rounded-lg"
+          :class="failing ? 'bg-destructive/12 text-destructive' : 'bg-muted text-muted-foreground'"
+          aria-hidden="true"
+        >
+          <TriangleAlert v-if="failing" :size="17" />
+          <Plug v-else-if="plugin" :size="17" />
+          <Server v-else :size="17" />
+        </span>
+
+        <div class="min-w-0">
+          <div class="flex flex-wrap items-center gap-2">
+            <!-- The assignment shown where it is made. A dot rather than a coloured name: the
+                 colour is this source's mark in the release picker, not a property of its title,
+                 and tinted text here would fail the contrast the tokens are tuned for. -->
+            <span
+              v-if="indexer.color"
+              class="size-2 shrink-0 rounded-full"
+              :class="sourceDotClass(indexer.color)"
+              :aria-label="t(`settings.system.requests.indexers.color.options.${indexer.color}`)"
+              role="img"
+            ></span>
+            <p class="settings-label">{{ indexer.name }}</p>
+            <PluginVersionBadge v-if="plugin" :version="pluginVersion" />
+            <ConnectionHealth :last-tested-at="indexer.lastTestedAt" :last-test-ok="indexer.lastTestOk" :enabled="indexer.enabled" />
+            <!-- Beside it rather than instead of it: "reachable" and "answering searches" are two
+                 different facts about a source, and a tracker can be the first without the second. -->
+            <SearchHealth
+              :last-search-at="indexer.lastSearchAt"
+              :last-search-ok="indexer.lastSearchOk"
+              :search-failure-streak="indexer.searchFailureStreak"
+              :enabled="indexer.enabled"
+            />
+          </div>
+
+          <div class="mt-1 flex flex-wrap items-center gap-x-2 gap-y-1 text-xs text-muted-foreground">
+            <span class="font-mono break-all">{{ indexer.baseUrl }}</span>
+          </div>
+
+          <p v-if="!available" role="status" class="mt-1.5 text-xs text-destructive">
+            {{ t('settings.system.requests.indexers.unavailable', { type: indexer.adapterType }) }}
+          </p>
+          <p v-if="failing && indexer.lastErrorMessage" class="mt-1.5 text-xs text-destructive">{{ indexer.lastErrorMessage }}</p>
+          <p v-if="searchFailing && indexer.lastSearchError" class="mt-1.5 text-xs text-foreground">{{ indexer.lastSearchError }}</p>
+        </div>
+      </div>
+
+      <div class="flex shrink-0 items-center gap-1.5">
+        <!--
+          Turning a source off is the ordinary thing to do with one that is noisy, rate limited or
+          temporarily broken, and it is reversible. Reaching it through the editor put it behind the
+          same door as changing a credential, so it lives on the row and the badge beside the name
+          already reads "Disabled" once it is flipped.
+        -->
+        <ToggleSwitch
+          class="me-1.5"
+          :model-value="indexer.enabled"
+          :disabled="busy"
+          :aria-label="t('settings.system.requests.indexers.toggleAria', { name: indexer.name })"
+          @update:model-value="handleToggle"
+        />
+        <TooltipProvider :delay-duration="0">
+          <Tooltip>
+            <TooltipTrigger as-child>
+              <Button
+                size="icon-sm"
+                variant="outline"
+                :disabled="testing"
+                :aria-label="t('settings.system.requests.indexers.test')"
+                @click="handleTest"
+              >
+                <Loader2 v-if="testing" class="animate-spin" aria-hidden="true" />
+                <Plug v-else :size="15" aria-hidden="true" />
+              </Button>
+            </TooltipTrigger>
+            <TooltipContent>{{ t('settings.system.requests.indexers.test') }}</TooltipContent>
+          </Tooltip>
+
+          <Tooltip>
+            <TooltipTrigger as-child>
+              <Button
+                size="icon-sm"
+                variant="outline"
+                :aria-label="t('settings.system.requests.indexers.editName', { name: indexer.name })"
+                @click="handleEdit"
+              >
+                <Pencil :size="15" aria-hidden="true" />
+              </Button>
+            </TooltipTrigger>
+            <TooltipContent>{{ t('settings.system.requests.indexers.editName', { name: indexer.name }) }}</TooltipContent>
+          </Tooltip>
+
+          <!--
+            The plugin behind the row, not the row. It is installed once and every source of its
+            type runs it, so it is kept apart from this source's own controls by a divider and
+            says which of the two it acts on.
+          -->
+          <template v-if="managePlugin">
+            <span class="mx-0.5 h-5 w-px bg-border" aria-hidden="true"></span>
+            <Tooltip v-if="available">
+              <TooltipTrigger as-child>
+                <Button
+                  size="icon-sm"
+                  variant="outline"
+                  :disabled="pluginBusy"
+                  :aria-label="t('settings.system.requests.indexers.plugins.update')"
+                  @click="handleUpdatePlugin"
+                >
+                  <Upload :size="15" aria-hidden="true" />
+                </Button>
+              </TooltipTrigger>
+              <TooltipContent>{{ t('settings.system.requests.indexers.plugins.update') }}</TooltipContent>
+            </Tooltip>
+            <Tooltip>
+              <TooltipTrigger as-child>
+                <Button
+                  size="icon-sm"
+                  variant="destructive-outline"
+                  :disabled="pluginBusy"
+                  :aria-label="t('settings.system.requests.indexers.plugins.removeAction')"
+                  @click="handleRemovePlugin"
+                >
+                  <Loader2 v-if="pluginBusy" class="animate-spin" aria-hidden="true" />
+                  <Trash2 v-else :size="15" aria-hidden="true" />
+                </Button>
+              </TooltipTrigger>
+              <TooltipContent>{{ t('settings.system.requests.indexers.plugins.removeAction') }}</TooltipContent>
+            </Tooltip>
+          </template>
+        </TooltipProvider>
+      </div>
+    </div>
+  </div>
+</template>
diff --git a/client/src/features/settings/components/RequestSourcesEmpty.vue b/client/src/features/settings/components/RequestSourcesEmpty.vue
new file mode 100644
index 000000000..65f37a6d2
--- /dev/null
+++ b/client/src/features/settings/components/RequestSourcesEmpty.vue
@@ -0,0 +1,79 @@
+<script setup lang="ts">
+import { useI18n } from 'vue-i18n'
+import { Plug, Plus, Search, Server, Upload } from '@lucide/vue'
+import { Button } from '@/components/ui/button'
+import PluginDirectoryLink from './PluginDirectoryLink.vue'
+import SettingsEmptyPanel from './SettingsEmptyPanel.vue'
+
+/**
+ * The Sources tab with nothing on it at all.
+ *
+ * There are exactly two ways in, and they are the two groups this replaces, so they are offered at
+ * the same size as each other with each button beside the sentence that justifies it. That is the
+ * whole reason this is not the plain one-action panel the other groups use.
+ */
+const props = defineProps<{
+  /** False for anyone who is not an administrator, who is left with the one door they can open. */
+  canInstallPlugins: boolean
+}>()
+
+const emit = defineEmits<{ installPlugin: []; addIndexer: [] }>()
+
+const { t } = useI18n()
+
+function handleInstallPlugin() {
+  emit('installPlugin')
+}
+
+function handleAddIndexer() {
+  emit('addIndexer')
+}
+</script>
+
+<template>
+  <SettingsEmptyPanel
+    :title="t('settings.system.requests.indexers.empty.title')"
+    :body="props.canInstallPlugins ? t('settings.system.requests.indexers.empty.body') : t('settings.system.requests.indexers.empty.bodyOneWay')"
+    :note="t('settings.system.requests.indexers.empty.responsibility')"
+  >
+    <template #icon>
+      <Search :size="18" />
+    </template>
+
+    <div class="grid gap-3" :class="props.canInstallPlugins ? 'sm:grid-cols-2' : 'max-w-sm'">
+      <!-- Not offered to anyone who cannot install one: a plugin runs its code in the server. -->
+      <div v-if="props.canInstallPlugins" class="flex flex-col rounded-lg border border-border bg-card p-4 shadow-xs">
+        <div class="flex items-center gap-2 text-muted-foreground">
+          <Plug :size="15" aria-hidden="true" />
+          <h3 class="text-sm font-medium text-foreground">{{ t('settings.system.requests.indexers.empty.pluginTitle') }}</h3>
+        </div>
+        <p class="mt-1.5 flex-1 text-xs leading-relaxed text-muted-foreground">
+          {{ t('settings.system.requests.indexers.empty.pluginBody') }}
+          <PluginDirectoryLink />
+        </p>
+        <div class="mt-3.5">
+          <Button size="sm" @click="handleInstallPlugin">
+            <Upload :size="15" aria-hidden="true" />
+            {{ t('settings.system.requests.indexers.plugins.install') }}
+          </Button>
+        </div>
+      </div>
+
+      <div class="flex flex-col rounded-lg border border-border bg-card p-4 shadow-xs">
+        <div class="flex items-center gap-2 text-muted-foreground">
+          <Server :size="15" aria-hidden="true" />
+          <h3 class="text-sm font-medium text-foreground">{{ t('settings.system.requests.indexers.empty.torznabTitle') }}</h3>
+        </div>
+        <p class="mt-1.5 flex-1 text-xs leading-relaxed text-muted-foreground">
+          {{ t('settings.system.requests.indexers.empty.torznabBody') }}
+        </p>
+        <div class="mt-3.5">
+          <Button size="sm" @click="handleAddIndexer">
+            <Plus :size="15" aria-hidden="true" />
+            {{ t('settings.system.requests.indexers.add') }}
+          </Button>
+        </div>
+      </div>
+    </div>
+  </SettingsEmptyPanel>
+</template>
diff --git a/client/src/features/settings/components/SettingsEditorSheet.vue b/client/src/features/settings/components/SettingsEditorSheet.vue
new file mode 100644
index 000000000..4d903835a
--- /dev/null
+++ b/client/src/features/settings/components/SettingsEditorSheet.vue
@@ -0,0 +1,229 @@
+<script setup lang="ts">
+import { computed, nextTick, ref, watch } from 'vue'
+import { useI18n } from 'vue-i18n'
+import { useMediaQuery } from '@vueuse/core'
+import { Loader2, MoreHorizontal, X } from '@lucide/vue'
+import { Button } from '@/components/ui/button'
+import ConfirmDialog from '@/components/ui/ConfirmDialog.vue'
+import { DropdownMenu, DropdownMenuContent, DropdownMenuItem, DropdownMenuSeparator, DropdownMenuTrigger } from '@/components/ui/dropdown-menu'
+import { Sheet, SheetContent, SheetDescription, SheetTitle } from '@/components/ui/sheet'
+import type { EditorMenuAction } from '../lib/editor-actions'
+
+/**
+ * One editor for every list on the Requests page. It exists so the list stops moving: the row
+ * being edited stays where it was instead of the form opening a full page below it, and Save stays
+ * on screen instead of sitting at the bottom of a form the reader has to scroll to reach.
+ *
+ * Every control except the close button lives in the footer. Actions spread across a header, a
+ * form and a footer left no rule about where to look for one, and put two red buttons that removed
+ * different things in two different places.
+ */
+const props = defineProps<{
+  open: boolean
+  title: string
+  /** Read to assistive technology in place of the visible body, which is a form. */
+  description: string
+  /** Blocks a close that would throw typed changes away. */
+  dirty?: boolean
+  busy?: boolean
+  /** Hidden while creating, because there is nothing yet to remove. */
+  removable?: boolean
+  removeLabel?: string
+  /** The question the footer asks before removing, and what the removal costs. */
+  removeConfirm?: string
+  removeConsequence?: string
+  /** Anything acting on what the record is built on rather than on the record itself. */
+  menuActions?: EditorMenuAction[]
+}>()
+
+const emit = defineEmits<{ save: []; cancel: []; remove: []; action: [id: string] }>()
+
+const { t } = useI18n()
+
+/** Tailwind's `sm`. Below it a side sheet is a slot, so it takes the height of the screen instead. */
+const isNarrowViewport = useMediaQuery('(max-width: 639px)')
+const side = computed(() => (isNarrowViewport.value ? ('bottom' as const) : ('right' as const)))
+const sizeClass = computed(() => (isNarrowViewport.value ? 'h-[92svh] rounded-t-xl' : 'w-full sm:max-w-[40rem]'))
+
+const confirmingDiscard = ref(false)
+
+const REMOVE_ACTION = 'remove'
+
+const menu = computed<EditorMenuAction[]>(() => {
+  const entries: EditorMenuAction[] = []
+  if (props.removable) {
+    entries.push({
+      id: REMOVE_ACTION,
+      label: props.removeLabel ?? t('common.delete'),
+      danger: true,
+      confirm: props.removeConfirm ?? t('settings.editor.removeQuestion'),
+      consequence: props.removeConsequence,
+    })
+  }
+  return [...entries, ...(props.menuActions ?? [])]
+})
+
+/**
+ * The armed action, confirmed in the footer rather than in a dialog. A dialog over the sheet is a
+ * dialog over a dialog: reka hides and slides the sheet away to open it, so the record being
+ * removed leaves the screen at the moment the question about it is asked.
+ */
+const pendingId = ref<string | null>(null)
+const pending = computed(() => menu.value.find((entry) => entry.id === pendingId.value) ?? null)
+
+const confirmBar = ref<HTMLElement | null>(null)
+
+watch(
+  () => props.open,
+  () => {
+    pendingId.value = null
+  },
+)
+
+/** The menu closes as it arms, so the answer to its question has to take the focus it left behind. */
+watch(pending, async (entry) => {
+  if (entry === null) return
+  await nextTick()
+  confirmBar.value?.querySelector('button')?.focus()
+})
+
+/** Every path out of the sheet lands here, so the guard cannot be walked around by one of them. */
+function requestClose() {
+  if (props.busy) return
+  pendingId.value = null
+  if (props.dirty) {
+    confirmingDiscard.value = true
+    return
+  }
+  emit('cancel')
+}
+
+function handleOpenChange(open: boolean) {
+  if (!open) requestClose()
+}
+
+function handleDiscard() {
+  confirmingDiscard.value = false
+  emit('cancel')
+}
+
+function cancelDiscard() {
+  confirmingDiscard.value = false
+}
+
+function handleSave() {
+  emit('save')
+}
+
+function handleMenuSelect(entry: EditorMenuAction) {
+  if (entry.confirm) pendingId.value = entry.id
+  else runAction(entry.id)
+}
+
+function runAction(id: string) {
+  if (id === REMOVE_ACTION) emit('remove')
+  else emit('action', id)
+}
+
+function confirmPending() {
+  const entry = pending.value
+  if (entry === null) return
+  pendingId.value = null
+  runAction(entry.id)
+}
+
+function cancelPending() {
+  pendingId.value = null
+}
+</script>
+
+<template>
+  <Sheet :open="open" @update:open="handleOpenChange">
+    <SheetContent :side="side" hide-close class="gap-0 p-0" :class="sizeClass">
+      <div class="flex min-h-0 flex-1 flex-col">
+        <header class="flex items-start justify-between gap-3 border-b border-border px-4 py-3.5 md:px-5">
+          <div class="min-w-0">
+            <div class="flex flex-wrap items-center gap-2">
+              <SheetTitle class="settings-label truncate">{{ title }}</SheetTitle>
+              <slot name="badge" />
+            </div>
+            <SheetDescription class="sr-only">{{ description }}</SheetDescription>
+            <div class="mt-1.5 empty:mt-0"><slot name="status" /></div>
+          </div>
+
+          <Button size="sm" variant="outline" class="shrink-0" :disabled="busy" @click="requestClose">
+            <X :size="15" aria-hidden="true" />
+            <span class="sr-only">{{ t('common.close') }}</span>
+          </Button>
+        </header>
+
+        <div class="flex min-h-0 flex-1 flex-col gap-6 overflow-y-auto px-4 py-4 md:px-5">
+          <slot />
+        </div>
+
+        <footer class="border-t border-border bg-card px-4 py-3 md:px-5">
+          <!-- Overridable, so a step that is a choice rather than a form can name its own action. -->
+          <slot name="footer" :request-close="requestClose">
+            <!-- The answer keeps to the right whether or not the question fits beside it. -->
+            <div v-if="pending" ref="confirmBar" class="flex flex-wrap items-center gap-3">
+              <p role="alert" class="min-w-0 flex-1 text-xs">
+                <span class="text-foreground">{{ pending.confirm }}</span>
+                <span v-if="pending.consequence" class="ms-1 text-muted-foreground">{{ pending.consequence }}</span>
+              </p>
+              <div class="ml-auto flex shrink-0 items-center gap-2">
+                <Button size="sm" variant="destructive" :disabled="busy" @click="confirmPending">
+                  <Loader2 v-if="busy" class="animate-spin" aria-hidden="true" />
+                  {{ pending.label }}
+                </Button>
+                <Button size="sm" variant="outline" :disabled="busy" @click="cancelPending">{{ t('common.cancel') }}</Button>
+              </div>
+            </div>
+
+            <!-- Wraps rather than crushes: a narrow sheet cannot hold four controls on one line. -->
+            <div v-else class="flex flex-wrap items-center gap-3">
+              <div class="flex items-center gap-2">
+                <Button size="sm" :disabled="busy" @click="handleSave">
+                  <Loader2 v-if="busy" class="animate-spin" aria-hidden="true" />
+                  {{ t('common.save') }}
+                </Button>
+                <Button size="sm" variant="outline" :disabled="busy" @click="requestClose">{{ t('common.cancel') }}</Button>
+              </div>
+
+              <div class="ms-auto flex shrink-0 items-center gap-1.5">
+                <slot name="actions" />
+                <DropdownMenu v-if="menu.length > 0">
+                  <DropdownMenuTrigger as-child>
+                    <Button size="icon-sm" variant="outline" :disabled="busy" :aria-label="t('settings.editor.moreActions')">
+                      <MoreHorizontal :size="16" aria-hidden="true" />
+                    </Button>
+                  </DropdownMenuTrigger>
+                  <DropdownMenuContent align="end" class="w-56">
+                    <template v-for="entry in menu" :key="entry.id">
+                      <DropdownMenuSeparator v-if="entry.separated" />
+                      <DropdownMenuItem
+                        :variant="entry.danger ? 'destructive' : 'default'"
+                        :disabled="entry.disabled"
+                        @click="handleMenuSelect(entry)"
+                      >
+                        {{ entry.label }}
+                      </DropdownMenuItem>
+                    </template>
+                  </DropdownMenuContent>
+                </DropdownMenu>
+              </div>
+            </div>
+          </slot>
+        </footer>
+      </div>
+    </SheetContent>
+  </Sheet>
+
+  <ConfirmDialog
+    :open="confirmingDiscard"
+    :title="t('settings.editor.discardTitle')"
+    :description="t('settings.editor.discardDescription')"
+    :confirm-label="t('settings.editor.discardConfirm')"
+    @confirm="handleDiscard"
+    @cancel="cancelDiscard"
+  />
+</template>
diff --git a/client/src/features/settings/components/SettingsEmptyPanel.vue b/client/src/features/settings/components/SettingsEmptyPanel.vue
new file mode 100644
index 000000000..eadea1916
--- /dev/null
+++ b/client/src/features/settings/components/SettingsEmptyPanel.vue
@@ -0,0 +1,50 @@
+<script setup lang="ts">
+import { useId } from 'vue'
+import { Info } from '@lucide/vue'
+
+/**
+ * A settings group with nothing in it at all, given enough room to say what that costs.
+ *
+ * A group with no rows has a heading with nothing to head, so this takes the heading's place rather
+ * than sitting under it. It leads with the consequence instead of with instructions, because "none
+ * yet" never said the part that matters, and the actions it is given belong beside that sentence
+ * rather than in the far corner of the page.
+ *
+ * Deliberately narrow and kept to a single column. A settings panel runs the full width of a very
+ * wide display, and a few sentences and a button stretched across all of it read as a page that
+ * failed to load rather than as a message.
+ *
+ * Only for a group that is genuinely empty. One that still has rows says so on a single line.
+ */
+defineProps<{
+  title: string
+  body: string
+  /** A qualifying fact set apart from the actions, for what the leading sentence would overstate. */
+  note?: string
+}>()
+
+const headingId = `settings-empty-${useId()}`
+</script>
+
+<template>
+  <section :aria-labelledby="headingId" class="settings-empty-state max-w-3xl p-5 text-start md:p-6">
+    <div class="flex gap-3.5">
+      <span class="flex size-9 shrink-0 items-center justify-center rounded-lg bg-muted text-muted-foreground" aria-hidden="true">
+        <slot name="icon" />
+      </span>
+
+      <!-- One column for everything the icon does not sit in, so the panel has a single left edge. -->
+      <div class="min-w-0 flex-1">
+        <h2 :id="headingId" class="font-serif text-base font-semibold tracking-tight text-foreground">{{ title }}</h2>
+        <p role="status" class="mt-1 text-sm text-muted-foreground">{{ body }}</p>
+
+        <div v-if="$slots.default" class="mt-4"><slot /></div>
+
+        <div v-if="note" class="mt-4 flex items-start gap-2 border-t border-border pt-3.5">
+          <Info :size="13" class="mt-0.5 shrink-0 text-muted-foreground" aria-hidden="true" />
+          <p class="settings-hint">{{ note }}</p>
+        </div>
+      </div>
+    </div>
+  </section>
+</template>
diff --git a/client/src/features/settings/components/SettingsField.vue b/client/src/features/settings/components/SettingsField.vue
new file mode 100644
index 000000000..fee5ba766
--- /dev/null
+++ b/client/src/features/settings/components/SettingsField.vue
@@ -0,0 +1,50 @@
+<script setup lang="ts">
+import { computed } from 'vue'
+import { useI18n } from 'vue-i18n'
+import FieldHint from './FieldHint.vue'
+
+/**
+ * The one field layout. Label above, control below, at most one line of hint under that. Width is
+ * the control's business, not the field's, so a number box and a URL box can differ without the
+ * form growing a second layout for them.
+ */
+const props = defineProps<{
+  label: string
+  inputId: string
+  required?: boolean
+  brief?: string
+  /** A validation failure for this field. Replaces the hint, because it is the more urgent fact. */
+  error?: string | null
+}>()
+
+const { t } = useI18n()
+
+const hintId = computed(() => `${props.inputId}-hint`)
+const errorId = computed(() => `${props.inputId}-error`)
+
+/**
+ * Handed to the control through the slot rather than applied here: the control is whatever the
+ * caller renders, and it is the element that has to carry its own description and invalid state.
+ */
+const describedBy = computed(() => {
+  if (props.error) return errorId.value
+  return props.brief ? hintId.value : undefined
+})
+</script>
+
+<template>
+  <div class="flex min-w-0 flex-col gap-1.5">
+    <label :for="inputId" class="settings-label">
+      {{ label }}
+      <template v-if="required">
+        <span class="text-primary" aria-hidden="true">*</span>
+        <span class="sr-only">{{ t('settings.field.required') }}</span>
+      </template>
+    </label>
+
+    <slot :described-by="describedBy" :invalid="Boolean(error)" />
+
+    <p v-if="error" :id="errorId" role="alert" class="text-xs text-destructive">{{ error }}</p>
+    <FieldHint v-else-if="brief" :id="hintId" :brief="brief" />
+  </div>
+</template>
diff --git a/client/src/features/settings/components/SettingsNav.vue b/client/src/features/settings/components/SettingsNav.vue
index 44bc4a5dc..4ac4ac28a 100644
--- a/client/src/features/settings/components/SettingsNav.vue
+++ b/client/src/features/settings/components/SettingsNav.vue
@@ -1,10 +1,11 @@
 <script setup lang="ts">
 import { Button } from '@/components/ui/button'
-import { computed, ref, onMounted, onBeforeUnmount } from 'vue'
+import { computed, ref, watch, onMounted, onBeforeUnmount } from 'vue'
 import { useI18n } from 'vue-i18n'
-import { useRoute } from 'vue-router'
-import { ArrowLeft, Search, X } from '@lucide/vue'
+import { useRoute, useRouter } from 'vue-router'
+import { ArrowLeft, ChevronRight, Search, X } from '@lucide/vue'
 import { usePermissions } from '@/features/auth/composables/usePermissions'
+import { useSettingsNavStatus } from '../composables/useSettingsNavStatus'
 import { visibleSettingsNav, type SettingsNavGroup, type SettingsNavItem } from '../lib/settings-nav'
 interface SearchHit {
   item: SettingsNavItem
@@ -14,6 +15,7 @@ interface SearchHit {
 
 const { t } = useI18n()
 const route = useRoute()
+const router = useRouter()
 const { isSuperuser, userPermissions, isDemoRestrictedAccount } = usePermissions()
 
 const query = ref('')
@@ -27,6 +29,9 @@ const groups = computed(() =>
   }),
 )
 
+const showsLibraryScan = computed(() => groups.value.some((group) => group.items.some((item) => item.status === 'libraryScan')))
+const { isLibraryScanning } = useSettingsNavStatus(showsLibraryScan)
+
 const activeRouteName = computed(() => (typeof route.name === 'string' ? route.name : ''))
 
 function isActive(item: SettingsNavItem): boolean {
@@ -38,11 +43,52 @@ function isBranchActive(item: SettingsNavItem): boolean {
   return item.children?.some(isActive) ?? false
 }
 
+/**
+ * Which branch is open. `null` follows the route, so a deep link or a reload lands with the
+ * relevant branch already expanded; a string pins one open and `''` closes them all. Toggling
+ * writes here, and navigating hands control back to the route.
+ */
+const openBranch = ref<string | null>(null)
+
+watch(activeRouteName, () => {
+  openBranch.value = null
+})
+
+function isBranchOpen(item: SettingsNavItem): boolean {
+  if (!item.children?.length) return false
+  return openBranch.value === null ? isBranchActive(item) : openBranch.value === item.id
+}
+
 /** A parent row opens its first child, since parents are groupings rather than pages. */
 function branchTarget(item: SettingsNavItem): string {
   return item.children?.[0]?.routeName ?? item.routeName
 }
 
+/** Opening a grouping row jumps to its first page; closing it leaves you where you are. */
+function toggleBranch(item: SettingsNavItem): void {
+  if (isBranchOpen(item)) {
+    openBranch.value = ''
+    return
+  }
+  openBranch.value = item.id
+  const target = branchTarget(item)
+  if (target !== activeRouteName.value) void router.push({ name: target })
+}
+
+/** A grouping row is a disclosure, not a destination, so it must not render as a link. */
+function rowTag(item: SettingsNavItem): string {
+  return item.children?.length ? 'button' : 'RouterLink'
+}
+
+function rowProps(item: SettingsNavItem): Record<string, unknown> {
+  if (item.children?.length) return { type: 'button', 'aria-expanded': isBranchOpen(item) }
+  return { to: { name: item.routeName }, 'aria-current': isActive(item) ? 'page' : undefined }
+}
+
+function handleRowClick(item: SettingsNavItem): void {
+  if (item.children?.length) toggleBranch(item)
+}
+
 function searchText(item: SettingsNavItem, group: SettingsNavGroup): string {
   const description = item.descriptionKey ? t(item.descriptionKey) : ''
   return `${t(item.labelKey)} ${description} ${item.keywords ?? ''} ${t(group.labelKey)}`.toLowerCase()
@@ -183,16 +229,17 @@ defineExpose({ focusSearch })
           </div>
 
           <template v-for="item in group.items" :key="item.id">
-            <RouterLink
-              :to="{ name: branchTarget(item) }"
-              class="group relative flex items-center gap-2.5 rounded-md px-2.5 py-1.5 text-sm outline-hidden transition-colors hover:bg-sidebar-accent focus-visible:ring-2 focus-visible:ring-sidebar-ring"
+            <component
+              :is="rowTag(item)"
+              v-bind="rowProps(item)"
+              class="group relative flex w-full items-center gap-2.5 rounded-md px-2.5 py-1.5 text-left text-sm outline-hidden transition-colors hover:bg-sidebar-accent focus-visible:ring-2 focus-visible:ring-sidebar-ring"
               :class="
                 isBranchActive(item)
                   ? 'bg-sidebar-accent font-medium before:absolute before:-left-2 before:top-1.5 before:bottom-1.5 before:w-0.5 before:rounded-full before:bg-sidebar-primary'
                   : 'font-normal'
               "
-              :aria-current="isActive(item) ? 'page' : undefined"
               data-testid="settings-nav-item"
+              @click="handleRowClick(item)"
             >
               <component
                 :is="item.icon"
@@ -209,9 +256,27 @@ defineExpose({ focusSearch })
               >
                 {{ t(item.labelKey) }}
               </span>
-            </RouterLink>
 
-            <div v-if="item.children?.length && isBranchActive(item)" class="ml-4 mt-0.5 mb-1 border-l border-border/70 pl-2">
+              <span
+                v-if="item.status === 'libraryScan' && isLibraryScanning"
+                role="status"
+                class="shrink-0 rounded-full bg-primary/15 px-1.5 py-px text-[10.5px] font-medium text-primary"
+                data-testid="settings-nav-item-status"
+              >
+                {{ t('settings.nav.status.scanning') }}
+              </span>
+
+              <ChevronRight
+                v-if="item.children?.length"
+                :size="13"
+                class="shrink-0 text-muted-foreground motion-safe:transition-transform motion-safe:duration-150"
+                :class="isBranchOpen(item) ? 'rotate-90' : ''"
+                aria-hidden="true"
+                data-testid="settings-nav-item-chevron"
+              />
+            </component>
+
+            <div v-if="isBranchOpen(item)" class="ml-4 mt-0.5 mb-1 border-l border-border/70 pl-2">
               <RouterLink
                 v-for="child in item.children"
                 :key="child.id"
diff --git a/client/src/features/settings/components/SettingsRow.vue b/client/src/features/settings/components/SettingsRow.vue
new file mode 100644
index 000000000..92b7369e7
--- /dev/null
+++ b/client/src/features/settings/components/SettingsRow.vue
@@ -0,0 +1,21 @@
+<script setup lang="ts">
+/**
+ * One shape for every setting: the words on the left at a readable measure, the control parked
+ * in a column on the right. Without the fixed control column each row places its switch wherever
+ * its own sentence happens to end, which is what made a wide settings card unscannable.
+ */
+defineProps<{ label: string; hint?: string; controlId?: string }>()
+</script>
+
+<template>
+  <div class="settings-row">
+    <div class="min-w-0 settings-prose">
+      <label v-if="controlId" :for="controlId" class="settings-label block">{{ label }}</label>
+      <p v-else class="settings-label">{{ label }}</p>
+      <p v-if="hint" class="settings-hint">{{ hint }}</p>
+    </div>
+    <div class="flex shrink-0 items-center gap-3 md:w-48 md:justify-end">
+      <slot />
+    </div>
+  </div>
+</template>
diff --git a/client/src/features/settings/components/SettingsSection.vue b/client/src/features/settings/components/SettingsSection.vue
new file mode 100644
index 000000000..914ed62f7
--- /dev/null
+++ b/client/src/features/settings/components/SettingsSection.vue
@@ -0,0 +1,16 @@
+<script setup lang="ts">
+/** A named group of fields, so a long adapter form can be skimmed instead of read. */
+defineProps<{ title: string; brief?: string }>()
+</script>
+
+<template>
+  <section class="flex flex-col gap-3">
+    <div>
+      <h3 class="settings-group-label mb-0">{{ title }}</h3>
+      <p v-if="brief" class="settings-hint">{{ brief }}</p>
+    </div>
+    <div class="flex flex-col gap-4">
+      <slot />
+    </div>
+  </section>
+</template>
diff --git a/client/src/features/settings/components/SettingsSlider.vue b/client/src/features/settings/components/SettingsSlider.vue
new file mode 100644
index 000000000..ef56b9e39
--- /dev/null
+++ b/client/src/features/settings/components/SettingsSlider.vue
@@ -0,0 +1,33 @@
+<script setup lang="ts">
+/**
+ * A score slider has eleven or twenty-one stops, so a full-width track spends most of its travel
+ * between two values it cannot express. Keep it short and put the number where the eye already is.
+ */
+const props = defineProps<{ id: string; modelValue: number; min: number; max: number; step: number }>()
+const emit = defineEmits<{ 'update:modelValue': [value: number]; change: [] }>()
+
+function handleInput(event: Event) {
+  emit('update:modelValue', Number((event.target as HTMLInputElement).value))
+}
+
+function handleChange() {
+  emit('change')
+}
+</script>
+
+<template>
+  <div class="flex w-full items-center gap-3 md:w-auto">
+    <input
+      :id="props.id"
+      type="range"
+      class="w-full accent-primary cursor-pointer md:w-36"
+      :value="props.modelValue"
+      :min="props.min"
+      :max="props.max"
+      :step="props.step"
+      @input="handleInput"
+      @change="handleChange"
+    />
+    <span class="settings-value w-7 shrink-0 text-right">{{ props.modelValue }}</span>
+  </div>
+</template>
diff --git a/client/src/features/settings/components/SettingsToggleField.vue b/client/src/features/settings/components/SettingsToggleField.vue
new file mode 100644
index 000000000..ece0d3e78
--- /dev/null
+++ b/client/src/features/settings/components/SettingsToggleField.vue
@@ -0,0 +1,39 @@
+<script setup lang="ts">
+import ToggleSwitch from '@/components/ui/ToggleSwitch.vue'
+import FieldHint from './FieldHint.vue'
+
+/**
+ * Switch first, label after. A binary set at one end of a wide row and read at the other takes the
+ * longest eye-travel on the form for the least information.
+ */
+const props = defineProps<{
+  modelValue: boolean
+  label: string
+  inputId: string
+  brief?: string
+  disabled?: boolean
+}>()
+
+const emit = defineEmits<{ 'update:modelValue': [boolean] }>()
+
+function handleChange(value: boolean) {
+  emit('update:modelValue', value)
+}
+</script>
+
+<template>
+  <div class="flex min-w-0 flex-col gap-1">
+    <div class="flex items-center gap-2.5">
+      <!-- `button` is a labelable element, so the label activates the switch the way a checkbox's would. -->
+      <ToggleSwitch
+        :id="inputId"
+        :model-value="modelValue"
+        :disabled="disabled"
+        :aria-describedby="brief ? `${inputId}-hint` : undefined"
+        @update:model-value="handleChange"
+      />
+      <label :for="inputId" class="settings-label cursor-pointer">{{ props.label }}</label>
+    </div>
+    <FieldHint v-if="brief" :id="`${inputId}-hint`" :brief="brief" class="ps-[2.875rem]" />
+  </div>
+</template>
diff --git a/client/src/features/settings/components/SourceColorPicker.vue b/client/src/features/settings/components/SourceColorPicker.vue
new file mode 100644
index 000000000..999324c86
--- /dev/null
+++ b/client/src/features/settings/components/SourceColorPicker.vue
@@ -0,0 +1,68 @@
+<script setup lang="ts">
+import { computed } from 'vue'
+import { useI18n } from 'vue-i18n'
+import { Ban, Check } from '@lucide/vue'
+import { INDEXER_COLORS, type IndexerColor } from '@bookorbit/types'
+import { sourceDotClass } from '@/features/book-requests/sourceColors'
+
+/**
+ * The colour an operator gives one request integration. A closed palette rather than a colour input:
+ * every swatch here resolves to a token tuned separately for light and dark, which a hex value
+ * picked by eye in one theme cannot be, and the picker is the only place that promise can be kept.
+ */
+const props = defineProps<{
+  modelValue: IndexerColor | null
+  inputName: string
+  label?: string
+  hint?: string
+  noneLabel?: string
+}>()
+
+const emit = defineEmits<{ 'update:modelValue': [value: IndexerColor | null] }>()
+
+const { t } = useI18n()
+
+/** Radios cannot carry null, so "no colour" travels as the empty string and is mapped back here. */
+const selected = computed({
+  get: () => props.modelValue ?? '',
+  set: (value: string) => emit('update:modelValue', value === '' ? null : (value as IndexerColor)),
+})
+
+function colorLabel(color: IndexerColor): string {
+  return t(`settings.system.requests.indexers.color.options.${color}`)
+}
+</script>
+
+<template>
+  <fieldset>
+    <legend class="settings-label">{{ label ?? t('settings.system.requests.indexers.color.label') }}</legend>
+    <p class="settings-hint">{{ hint ?? t('settings.system.requests.indexers.color.hint') }}</p>
+
+    <div class="mt-3 flex flex-wrap gap-2">
+      <label v-for="color in INDEXER_COLORS" :key="color" class="cursor-pointer">
+        <input v-model="selected" type="radio" class="peer sr-only" :name="inputName" :value="color" />
+        <span
+          class="flex size-8 items-center justify-center rounded-lg ring-offset-2 ring-offset-card peer-checked:ring-2 peer-checked:ring-primary peer-focus-visible:outline-2 peer-focus-visible:outline-offset-2 peer-focus-visible:outline-ring"
+          :class="sourceDotClass(color)"
+        >
+          <!-- Legible on both, because --background inverts with the theme in the same direction
+               the swatch tokens do: near-white behind a darkened light-mode hue, near-black
+               behind a lifted dark-mode one. -->
+          <Check v-if="modelValue === color" :size="15" class="text-background" aria-hidden="true" />
+        </span>
+        <span class="sr-only">{{ colorLabel(color) }}</span>
+      </label>
+
+      <label class="cursor-pointer">
+        <input v-model="selected" type="radio" class="peer sr-only" :name="inputName" value="" />
+        <span
+          class="flex size-8 items-center justify-center rounded-lg border border-border bg-muted text-muted-foreground ring-offset-2 ring-offset-card peer-checked:ring-2 peer-checked:ring-primary peer-focus-visible:outline-2 peer-focus-visible:outline-offset-2 peer-focus-visible:outline-ring"
+        >
+          <Check v-if="modelValue === null" :size="15" class="text-foreground" aria-hidden="true" />
+          <Ban v-else :size="15" aria-hidden="true" />
+        </span>
+        <span class="sr-only">{{ noneLabel ?? t('settings.system.requests.indexers.color.none') }}</span>
+      </label>
+    </div>
+  </fieldset>
+</template>
diff --git a/client/src/features/settings/composables/__tests__/useSettingsNavStatus.spec.ts b/client/src/features/settings/composables/__tests__/useSettingsNavStatus.spec.ts
new file mode 100644
index 000000000..01585569e
--- /dev/null
+++ b/client/src/features/settings/composables/__tests__/useSettingsNavStatus.spec.ts
@@ -0,0 +1,125 @@
+import { describe, expect, it, vi, afterEach, beforeEach } from 'vitest'
+import { mount } from '@vue/test-utils'
+import { defineComponent, nextTick, ref, type Ref } from 'vue'
+import { useSettingsNavStatus } from '../useSettingsNavStatus'
+
+const harness = vi.hoisted(() => ({
+  fetchCount: 0,
+  subscribed: [] as number[],
+  setLibraries: (() => {}) as (ids: number[]) => void,
+  setScanning: (() => {}) as (ids: number[]) => void,
+  reset: (() => {}) as () => void,
+}))
+
+vi.mock('@/features/library/composables/useLibraries', async () => {
+  const { ref: makeRef } = await import('vue')
+  const libraries = makeRef<{ id: number }[]>([])
+  harness.setLibraries = (ids) => {
+    libraries.value = ids.map((id) => ({ id }))
+  }
+  return {
+    useLibraries: () => ({
+      libraries,
+      fetchLibraries: () => {
+        harness.fetchCount += 1
+      },
+    }),
+  }
+})
+
+vi.mock('@/features/scanner/composables/useScanProgress', async () => {
+  const { ref: makeRef } = await import('vue')
+  const scanning = makeRef<number[]>([])
+  harness.setScanning = (ids) => {
+    scanning.value = ids
+  }
+  return {
+    useScanProgress: () => ({
+      subscribeLibrary: (id: number) => harness.subscribed.push(id),
+      isScanning: (id: number) => scanning.value.includes(id),
+    }),
+  }
+})
+
+/** The mocked composables share one module-level ref, so a leftover mount keeps watching it. */
+const mounted: { unmount: () => void }[] = []
+
+function mountStatus(enabled: Ref<boolean>) {
+  const seen = { isLibraryScanning: ref(false) }
+  const wrapper = mount(
+    defineComponent({
+      setup() {
+        seen.isLibraryScanning = useSettingsNavStatus(enabled).isLibraryScanning as Ref<boolean>
+        return () => null
+      },
+    }),
+  )
+  mounted.push(wrapper)
+  return { wrapper, seen }
+}
+
+describe('useSettingsNavStatus', () => {
+  afterEach(() => {
+    while (mounted.length) mounted.pop()?.unmount()
+  })
+
+  beforeEach(() => {
+    harness.fetchCount = 0
+    harness.subscribed = []
+    harness.setLibraries([])
+    harness.setScanning([])
+  })
+
+  it('stays inert while the libraries row is hidden', async () => {
+    harness.setLibraries([1, 2])
+    harness.setScanning([1])
+    const { seen } = mountStatus(ref(false))
+    await nextTick()
+
+    expect(harness.fetchCount).toBe(0)
+    expect(harness.subscribed).toEqual([])
+    expect(seen.isLibraryScanning.value).toBe(false)
+  })
+
+  it('loads the libraries and joins their scan rooms once enabled', async () => {
+    harness.setLibraries([4, 7])
+    mountStatus(ref(true))
+    await nextTick()
+
+    expect(harness.fetchCount).toBeGreaterThan(0)
+    expect(harness.subscribed).toEqual([4, 7])
+  })
+
+  it('reports a scan running on any visible library', async () => {
+    harness.setLibraries([4, 7])
+    const { seen } = mountStatus(ref(true))
+    await nextTick()
+    expect(seen.isLibraryScanning.value).toBe(false)
+
+    harness.setScanning([7])
+    await nextTick()
+    expect(seen.isLibraryScanning.value).toBe(true)
+  })
+
+  it('subscribes to libraries that arrive after the first render', async () => {
+    mountStatus(ref(true))
+    await nextTick()
+    expect(harness.subscribed).toEqual([])
+
+    harness.setLibraries([9])
+    await nextTick()
+    expect(harness.subscribed).toEqual([9])
+  })
+
+  it('starts working when the row becomes visible later', async () => {
+    const enabled = ref(false)
+    harness.setLibraries([3])
+    mountStatus(enabled)
+    await nextTick()
+    expect(harness.subscribed).toEqual([])
+
+    enabled.value = true
+    await nextTick()
+    expect(harness.subscribed).toEqual([3])
+  })
+})
diff --git a/client/src/features/settings/composables/useIndexerDraft.ts b/client/src/features/settings/composables/useIndexerDraft.ts
new file mode 100644
index 000000000..95b09676b
--- /dev/null
+++ b/client/src/features/settings/composables/useIndexerDraft.ts
@@ -0,0 +1,451 @@
+import { computed, reactive, ref, type Ref } from 'vue'
+import { useI18n } from 'vue-i18n'
+import { toast } from 'vue-sonner'
+import { BOOK_REQUEST_MEDIA_KINDS, INDEXER_ADAPTER_TYPES, pickUnusedIndexerColor } from '@bookorbit/types'
+import { useSettingsDraft } from './useSettingsDraft'
+import type {
+  BookRequestMediaKind,
+  CreateIndexerPayload,
+  IndexerAdapterDescriptor,
+  IndexerColor,
+  IndexerItem,
+  IndexerSettingsField,
+  NetworkProfile,
+  UpdateIndexerPayload,
+} from '@bookorbit/types'
+
+import type { IndexerFailure } from '@/features/book-requests/composables/useIndexers'
+
+/** Category numbers are a list, so they are edited as one rather than as punctuation in a box. */
+export type CategoryDraft = Record<BookRequestMediaKind, string[]>
+
+export interface IndexerDraft {
+  id: number | null
+  name: string
+  /** Null is a real choice here, not an unset field: it is the neutral chip the picker falls back to. */
+  color: IndexerColor | null
+  adapterType: string
+  baseUrl: string
+  credential: string
+  /** Only sent when the operator actually typed one, so editing does not wipe a stored secret. */
+  credentialTouched: boolean
+  credentialCleared: boolean
+  enabled: boolean
+  allowPrivateAddress: boolean
+  categories: CategoryDraft
+  /**
+   * Held as what the source *is* searched for, because that is what the form shows and what an
+   * operator reasons about. Inverted into the stored opt-out on the way to the payload.
+   */
+  searchedMediaKinds: BookRequestMediaKind[]
+  /** Positive here too, for the same reason: the form asks whether the source is given the ISBN. */
+  searchByIsbn: boolean
+  /** Keyed by the adapter's own declared field names, so a plugin's fields round-trip unchanged. */
+  settings: Record<string, unknown>
+  resolvers: string[]
+  proxyUrl: string
+}
+
+/** The fields a save can be rejected for, so the diagnosis lands on the box that caused it. */
+export type FieldKey = 'name' | 'baseUrl' | 'credential'
+
+/**
+ * Server codes carry the copy; the English `message` is a last resort for anything unmapped, which
+ * beats swallowing a diagnosis the operator needs to act on.
+ */
+const SAVE_ERROR_KEYS: Record<string, string> = {
+  INDEXER_NAME_TAKEN: 'settings.system.requests.indexers.errors.nameTaken',
+  INDEXER_URL_UNSAFE: 'settings.system.requests.indexers.errors.urlUnsafe',
+  INDEXER_URL_PRIVATE: 'settings.system.requests.indexers.errors.urlPrivate',
+  INDEXER_CREDENTIAL_REQUIRED: 'settings.system.requests.indexers.errors.credentialRequired',
+  INDEXER_SETTINGS_INVALID: 'settings.system.requests.indexers.errors.invalidSettings',
+  REQUEST_ENCRYPTION_KEY_MISSING: 'settings.system.requests.errors.encryptionKeyMissing',
+  REQUEST_ENCRYPTION_KEY_CHANGED: 'settings.system.requests.errors.encryptionKeyChanged',
+}
+
+/** Which box a rejection belongs under. Anything unmapped stays a toast, rather than nowhere. */
+const SAVE_ERROR_FIELDS: Record<string, FieldKey> = {
+  INDEXER_NAME_TAKEN: 'name',
+  INDEXER_URL_UNSAFE: 'baseUrl',
+  INDEXER_URL_PRIVATE: 'baseUrl',
+  INDEXER_CREDENTIAL_REQUIRED: 'credential',
+  REQUEST_ENCRYPTION_KEY_MISSING: 'credential',
+  REQUEST_ENCRYPTION_KEY_CHANGED: 'credential',
+}
+
+/** Compiled in rather than loaded from disk, which is what separates a source from a plugin one. */
+export function isBuiltInAdapter(type: string): boolean {
+  return (INDEXER_ADAPTER_TYPES as readonly string[]).includes(type)
+}
+
+export interface IndexerDraftOptions {
+  indexers: Ref<IndexerItem[]>
+  adapterFor: (type: string) => IndexerAdapterDescriptor | undefined
+  /** The adapter's display name, which prefers a translated key over untranslated plugin English. */
+  adapterLabel: (adapter: IndexerAdapterDescriptor) => string
+  save: (id: number | null, payload: CreateIndexerPayload | UpdateIndexerPayload) => Promise<IndexerFailure | null>
+}
+
+/**
+ * The indexer editor: one draft row, the boxes that make it up, and what a rejected save says.
+ *
+ * The draft is held apart from the stored row on purpose. An adapter loaded at runtime names its
+ * own settings fields, so the form is shaped by the descriptor rather than by a fixed schema, and
+ * a value the running build no longer declares has to survive being opened without being sent back.
+ */
+export function useIndexerDraft(options: IndexerDraftOptions) {
+  const { t } = useI18n()
+  const { indexers, adapterFor, adapterLabel, save } = options
+
+  const { draft, open: editorOpen, isDirty, start, close } = useSettingsDraft<IndexerDraft>()
+  const credentialVisible = ref(false)
+  const fieldErrors = reactive<Partial<Record<FieldKey, string>>>({})
+  const currentAdapter = computed(() => (draft.value ? adapterFor(draft.value.adapterType) : undefined))
+  const editingIndexer = computed(() => (draft.value?.id === null ? null : (indexers.value.find((row) => row.id === draft.value?.id) ?? null)))
+
+  const sheetTitle = computed(() => {
+    if (draft.value === null) return ''
+    return draft.value.id === null ? t('settings.system.requests.indexers.add') : draft.value.name || t('settings.system.requests.indexers.edit')
+  })
+
+  /**
+   * Nothing to scope when the adapter carries a single medium: the block would be one live switch
+   * that turns the source off entirely, next to two rows saying the source does not carry them.
+   * That is the Enabled switch with extra steps, so the whole thing is left out.
+   */
+  const canScopeMediaKinds = computed(() => (currentAdapter.value?.mediaKinds.length ?? BOOK_REQUEST_MEDIA_KINDS.length) > 1)
+
+  function describeFailure(failure: IndexerFailure): string {
+    const key = failure.errorCode ? SAVE_ERROR_KEYS[failure.errorCode] : undefined
+    if (key) return t(key)
+    return failure.message ?? t('settings.system.requests.indexers.errors.saveFailed')
+  }
+
+  function toCategoryDraft(categories: Record<BookRequestMediaKind, number[]>): CategoryDraft {
+    return {
+      ebook: categories.ebook.map(String),
+      audiobook: categories.audiobook.map(String),
+      comic: categories.comic.map(String),
+    }
+  }
+
+  /** An adapter's declared defaults, so a fresh row starts where the adapter says it should. */
+  function defaultSettings(adapter: IndexerAdapterDescriptor | undefined): Record<string, unknown> {
+    const settings: Record<string, unknown> = {}
+    for (const field of adapter?.settingsFields ?? []) {
+      if (field.default !== undefined) settings[field.key] = field.default
+    }
+    return settings
+  }
+
+  function emptyDraft(adapterType: string): IndexerDraft {
+    const adapter = adapterFor(adapterType)
+    return {
+      id: null,
+      name: '',
+      color: pickUnusedIndexerColor(indexers.value.map((indexer) => indexer.color)),
+      adapterType,
+      baseUrl: adapter?.defaultBaseUrl ?? '',
+      credential: '',
+      credentialTouched: false,
+      credentialCleared: false,
+      enabled: true,
+      allowPrivateAddress: false,
+      categories: toCategoryDraft(adapter?.defaultCategories ?? { ebook: [], audiobook: [], comic: [] }),
+      searchedMediaKinds: [...BOOK_REQUEST_MEDIA_KINDS],
+      searchByIsbn: true,
+      settings: defaultSettings(adapter),
+      resolvers: [],
+      proxyUrl: '',
+    }
+  }
+
+  function openDraft(next: IndexerDraft) {
+    start(next)
+    credentialVisible.value = false
+    clearFieldErrors()
+  }
+
+  /** Torznab is the only built-in, so adding an indexer is adding a Torznab one. Nothing to pick. */
+  function startCreate() {
+    openDraft(emptyDraft('torznab'))
+  }
+
+  /**
+   * Straight to the form for one adapter, skipping the picker, because the type is already settled.
+   * Installing a plugin only teaches the server a new type; until an indexer uses that type nothing
+   * searches, so the step after installing is this one and it should not have to be gone looking for.
+   */
+  function startCreateFor(type: string) {
+    const adapter = adapterFor(type)
+    openDraft({ ...emptyDraft(type), name: adapter ? adapterLabel(adapter) : '' })
+  }
+
+  function startEdit(indexer: IndexerItem) {
+    const adapter = adapterFor(indexer.adapterType)
+    openDraft({
+      id: indexer.id,
+      name: indexer.name,
+      color: indexer.color,
+      adapterType: indexer.adapterType,
+      baseUrl: indexer.baseUrl,
+      credential: '',
+      credentialTouched: false,
+      credentialCleared: false,
+      enabled: indexer.enabled,
+      allowPrivateAddress: indexer.allowPrivateAddress,
+      categories: toCategoryDraft(indexer.categories),
+      searchedMediaKinds: BOOK_REQUEST_MEDIA_KINDS.filter((mediaKind) => !indexer.disabledMediaKinds.includes(mediaKind)),
+      searchByIsbn: !indexer.isbnSearchDisabled,
+      settings: normalizeDeclaredSettings(adapter, { ...defaultSettings(adapter), ...indexer.settings }),
+      resolvers: [...(indexer.networkProfile?.resolvers ?? [])],
+      proxyUrl: indexer.networkProfile?.proxyUrl ?? '',
+    })
+  }
+
+  function cancelEdit() {
+    close()
+    clearFieldErrors()
+  }
+
+  function clearFieldErrors() {
+    for (const key of Object.keys(fieldErrors) as FieldKey[]) delete fieldErrors[key]
+  }
+
+  function clearFieldError(field: FieldKey) {
+    delete fieldErrors[field]
+  }
+
+  function handleNameInput() {
+    clearFieldError('name')
+  }
+
+  function handleBaseUrlInput() {
+    clearFieldError('baseUrl')
+  }
+
+  function markCredentialTouched() {
+    if (!draft.value) return
+    draft.value.credentialTouched = draft.value.credential.length > 0
+    draft.value.credentialCleared = false
+    clearFieldError('credential')
+  }
+
+  const canClearCredential = computed(() => editingIndexer.value?.hasCredential === true && currentAdapter.value?.requiresCredential !== true)
+
+  function toggleClearCredential() {
+    const current = draft.value
+    if (!current) return
+    current.credentialCleared = !current.credentialCleared
+    if (current.credentialCleared) {
+      current.credential = ''
+      current.credentialTouched = false
+    }
+    clearFieldError('credential')
+  }
+
+  function toggleCredentialVisible() {
+    credentialVisible.value = !credentialVisible.value
+  }
+
+  function setSetting(key: string, value: unknown) {
+    if (draft.value) draft.value.settings[key] = value
+  }
+
+  /**
+   * A cleared number box is not a zero. `Number('')` is 0, so emptying a plugin's "minimum
+   * seeders" used to store a floor of zero rather than removing the floor, which the server then
+   * kept because zero is a perfectly valid value for the field.
+   */
+  function handleSettingInput(field: IndexerSettingsField, event: Event) {
+    const raw = (event.target as HTMLInputElement).value
+    if (field.type !== 'number') {
+      setSetting(field.key, raw)
+      return
+    }
+    setSetting(field.key, raw.trim() === '' ? undefined : Number(raw))
+  }
+
+  /** A list-shaped adapter setting is stored as the comma-separated string the adapter expects. */
+  function settingList(field: IndexerSettingsField): string[] {
+    const raw = draft.value?.settings[field.key]
+    if (typeof raw !== 'string') return []
+    return normalizeSettingEntries(field, raw)
+  }
+
+  function setSettingList(field: IndexerSettingsField, values: string[]) {
+    setSetting(field.key, values.join(','))
+  }
+
+  /** Old plugin values are repaired as the editor opens, before they can return to the server. */
+  function normalizeDeclaredSettings(adapter: IndexerAdapterDescriptor | undefined, settings: Record<string, unknown>): Record<string, unknown> {
+    const normalized = { ...settings }
+    for (const field of adapter?.settingsFields ?? []) {
+      if (field.format !== 'list') continue
+      const raw = normalized[field.key]
+      const values = typeof raw === 'string' ? normalizeSettingEntries(field, raw) : []
+      const defaults = typeof field.default === 'string' ? normalizeSettingEntries(field, field.default) : []
+      normalized[field.key] = (values.length >= (field.minItems ?? 0) ? values : defaults).join(',')
+    }
+    return normalized
+  }
+
+  function normalizeSettingEntries(field: IndexerSettingsField, raw: string): string[] {
+    const entries = raw
+      .split(',')
+      .map((entry) => entry.trim())
+      .filter(Boolean)
+    if (!field.options) return [...new Set(entries)]
+
+    const canonical = new Map(field.options.map((option) => [option.toLowerCase(), option]))
+    return [...new Set(entries.map((entry) => canonical.get(entry.toLowerCase())).filter((entry): entry is string => entry !== undefined))]
+  }
+
+  function isSettingOptionSelected(field: IndexerSettingsField, option: string): boolean {
+    return settingList(field).includes(option)
+  }
+
+  function isSettingOptionLocked(field: IndexerSettingsField, option: string): boolean {
+    const values = settingList(field)
+    return values.includes(option) && values.length <= (field.minItems ?? 0)
+  }
+
+  function toggleSettingOption(field: IndexerSettingsField, option: string): void {
+    const values = settingList(field)
+    if (values.includes(option)) {
+      if (values.length <= (field.minItems ?? 0)) return
+      setSettingList(
+        field,
+        values.filter((value) => value !== option),
+      )
+      return
+    }
+    setSettingList(field, [...values, option])
+  }
+
+  function canRestoreSettingDefault(field: IndexerSettingsField): boolean {
+    if (typeof field.default !== 'string') return false
+    return settingList(field).join(',') !== normalizeSettingEntries(field, field.default).join(',')
+  }
+
+  function restoreSettingDefault(field: IndexerSettingsField): void {
+    if (typeof field.default === 'string') setSettingList(field, normalizeSettingEntries(field, field.default))
+  }
+
+  /** Anything that is not a whole category number is refused as it is typed, not on save. */
+  function normalizeCategory(raw: string): string | null {
+    return /^\d+$/.test(raw) ? String(Number(raw)) : null
+  }
+
+  function parseCategories(values: string[]): number[] {
+    return values.map(Number).filter((entry) => Number.isInteger(entry) && entry >= 0)
+  }
+
+  /**
+   * What the adapter itself can answer for. A medium it does not carry is shown off and inert rather
+   * than hidden, because "this source has no ebooks" is the fact the operator needs; a missing row
+   * reads as a form that forgot something.
+   */
+  function adapterCarries(mediaKind: BookRequestMediaKind): boolean {
+    const adapter = currentAdapter.value
+    return !adapter || adapter.mediaKinds.includes(mediaKind)
+  }
+
+  function isMediaKindSearched(mediaKind: BookRequestMediaKind): boolean {
+    return adapterCarries(mediaKind) && (draft.value?.searchedMediaKinds.includes(mediaKind) ?? false)
+  }
+
+  function toggleMediaKind(mediaKind: BookRequestMediaKind): void {
+    const current = draft.value
+    if (!current || !adapterCarries(mediaKind)) return
+    current.searchedMediaKinds = current.searchedMediaKinds.includes(mediaKind)
+      ? current.searchedMediaKinds.filter((kind) => kind !== mediaKind)
+      : [...current.searchedMediaKinds, mediaKind]
+  }
+
+  function toPayload(current: IndexerDraft): CreateIndexerPayload {
+    return {
+      name: current.name.trim(),
+      adapterType: current.adapterType,
+      baseUrl: current.baseUrl.trim(),
+      color: current.color,
+      ...(current.credentialCleared ? { credential: '' } : current.credentialTouched ? { credential: current.credential } : {}),
+      enabled: current.enabled,
+      allowPrivateAddress: current.allowPrivateAddress,
+      categories: {
+        ebook: parseCategories(current.categories.ebook),
+        audiobook: parseCategories(current.categories.audiobook),
+        comic: parseCategories(current.categories.comic),
+      },
+      disabledMediaKinds: BOOK_REQUEST_MEDIA_KINDS.filter((mediaKind) => !current.searchedMediaKinds.includes(mediaKind)),
+      isbnSearchDisabled: !current.searchByIsbn,
+      settings: current.settings,
+      networkProfile: toNetworkProfile(current),
+    }
+  }
+
+  /** Null rather than an empty object, so "nothing configured" stays the default path. */
+  function toNetworkProfile(current: IndexerDraft): NetworkProfile | null {
+    const resolvers = current.resolvers.map((entry) => entry.trim()).filter(Boolean)
+    const proxyUrl = current.proxyUrl.trim()
+    if (resolvers.length === 0 && !proxyUrl) return null
+    return { ...(resolvers.length > 0 ? { resolvers } : {}), ...(proxyUrl ? { proxyUrl } : {}) }
+  }
+
+  async function handleSave() {
+    const current = draft.value
+    if (!current) return
+
+    clearFieldErrors()
+    if (!current.name.trim()) fieldErrors.name = t('settings.system.requests.indexers.errors.nameRequired')
+    if (!current.baseUrl.trim()) fieldErrors.baseUrl = t('settings.system.requests.indexers.errors.urlRequired')
+    if (Object.keys(fieldErrors).length > 0) return
+
+    const failure = await save(current.id, toPayload(current))
+    if (failure) {
+      const field = failure.errorCode ? SAVE_ERROR_FIELDS[failure.errorCode] : undefined
+      if (field) fieldErrors[field] = describeFailure(failure)
+      else toast.error(describeFailure(failure))
+      return
+    }
+    toast.success(t('settings.system.requests.indexers.saved'))
+    cancelEdit()
+  }
+
+  return {
+    draft,
+    editorOpen,
+    credentialVisible,
+    fieldErrors,
+    isDirty,
+    currentAdapter,
+    editingIndexer,
+    sheetTitle,
+    canScopeMediaKinds,
+    describeFailure,
+    startCreate,
+    startCreateFor,
+    startEdit,
+    cancelEdit,
+    handleNameInput,
+    handleBaseUrlInput,
+    markCredentialTouched,
+    canClearCredential,
+    toggleClearCredential,
+    toggleCredentialVisible,
+    setSetting,
+    handleSettingInput,
+    settingList,
+    setSettingList,
+    isSettingOptionSelected,
+    isSettingOptionLocked,
+    toggleSettingOption,
+    canRestoreSettingDefault,
+    restoreSettingDefault,
+    normalizeCategory,
+    adapterCarries,
+    isMediaKindSearched,
+    toggleMediaKind,
+    handleSave,
+  }
+}
diff --git a/client/src/features/settings/composables/useIndexerPlugins.ts b/client/src/features/settings/composables/useIndexerPlugins.ts
new file mode 100644
index 000000000..9ad95fe6b
--- /dev/null
+++ b/client/src/features/settings/composables/useIndexerPlugins.ts
@@ -0,0 +1,328 @@
+import { computed, onScopeDispose, ref, type Ref } from 'vue'
+import { useI18n } from 'vue-i18n'
+import { toast } from 'vue-sonner'
+import type { IndexerAdapterDescriptor, IndexerItem, IndexerPluginFailure, PluginInspection, PluginInstallResult } from '@bookorbit/types'
+
+import { isBuiltInAdapter } from './useIndexerDraft'
+
+/** A plugin row: one that failed to load, one installed but never filled in, or a working source. */
+export type PluginRow =
+  | { kind: 'broken'; key: string; failure: IndexerPluginFailure }
+  | { kind: 'pending'; key: string; adapter: IndexerAdapterDescriptor }
+  | { kind: 'source'; key: string; indexer: IndexerItem }
+
+export interface IndexerPluginsOptions {
+  indexers: Ref<IndexerItem[]>
+  adapters: Ref<IndexerAdapterDescriptor[]>
+  pluginFailures: Ref<IndexerPluginFailure[]>
+  adapterFor: (type: string) => IndexerAdapterDescriptor | undefined
+  inspectPlugin: (file: File) => Promise<{ inspection: PluginInspection | null; error?: string | null }>
+  installPlugin: (file: File) => Promise<{ inspection: PluginInstallResult | null; error?: string | null }>
+  removePlugin: (type: string) => Promise<boolean>
+  fetchIndexers: (options?: { silent?: boolean; withAdapters?: boolean }) => Promise<void>
+  /** The type currently open in the editor, so removing its plugin closes the form behind it. */
+  editingType: Ref<string | null>
+  cancelEdit: () => void
+  /** A first install continues straight into the indexer the plugin exists to enable. */
+  startCreateFor: (type: string) => void
+}
+
+/**
+ * Installing, updating and removing indexer plugins, and the one list the page reads.
+ *
+ * A plugin and the indexer using it are two records here but one thing to the person reading the
+ * page, so they are folded into a single list rather than sitting in separate sections. Everything
+ * that changes what is installed also refetches, because the adapter set is what the form is
+ * shaped by.
+ */
+export function useIndexerPlugins(options: IndexerPluginsOptions) {
+  const { t } = useI18n()
+  const { indexers, adapters, pluginFailures, adapterFor, inspectPlugin, installPlugin, removePlugin, fetchIndexers } = options
+  const { editingType, cancelEdit, startCreateFor } = options
+
+  const pluginInput = ref<HTMLInputElement | null>(null)
+  const pluginFile = ref<File | null>(null)
+  const pluginReview = ref<PluginInspection | null>(null)
+  const pluginError = ref<string | null>(null)
+  const pluginBusy = ref(false)
+  /**
+   * A plugin is normally loaded into the running server the moment it is written, so this stays off.
+   * It is set only when the server reports the file landed but would not load there, which is the one
+   * case a restart can still fix.
+   */
+  const pluginRestartPending = ref(false)
+  /** Which plugin that was, so the notice can be retired once the restart has actually loaded it. */
+  let restartPendingType: string | null = null
+  const removingPlugin = ref<string | null>(null)
+  /** The plugin whose Update entry opened the picker, so the file can be held to that type. */
+  const updatingPlugin = ref<string | null>(null)
+  /**
+   * The plugin a removal has been asked about. A type and label are enough even when a previous
+   * removal already deleted its file and left configured sources behind.
+   */
+  const pluginPendingRemoval = ref<{ type: string; label: string } | null>(null)
+
+  /**
+   * How many configured indexers each plugin actually backs. An installed plugin that nothing uses
+   * searches nothing, and that is invisible otherwise: the row looks identical either way.
+   */
+  const indexerCountByType = computed(() => {
+    const counts = new Map<string, number>()
+    for (const indexer of indexers.value) counts.set(indexer.adapterType, (counts.get(indexer.adapterType) ?? 0) + 1)
+    return counts
+  })
+
+  /**
+   * One list rather than two.
+   *
+   * A plugin and the indexer using it are two records here but one thing to the person reading the
+   * page: they carry the same name, and a plugin listed apart from the indexers reads as sitting in
+   * the wrong list. So an installed plugin nothing uses appears in this list as the row it is on the
+   * way to becoming, and finishing it is a step on that row rather than a different section.
+   *
+   * Only a plugin does this. Torznab is compiled in and always offerable, so an unconfigured torznab
+   * is not an object anyone owns and would be a permanent row for a thing that does not exist.
+   */
+  const pluginRows = computed<PluginRow[]>(() => {
+    const configured = new Set<string>()
+    const rows: PluginRow[] = []
+
+    // Failures first: a plugin that did not load is the one thing here somebody has to act on.
+    for (const failure of pluginFailures.value) rows.push({ kind: 'broken', key: `broken-${failure.directory}`, failure })
+
+    for (const indexer of indexers.value) {
+      if (isBuiltInAdapter(indexer.adapterType)) continue
+      configured.add(indexer.adapterType)
+      rows.push({ kind: 'source', key: `source-${indexer.id}`, indexer })
+    }
+
+    for (const adapter of adapters.value) {
+      if (adapter.builtIn || configured.has(adapter.type)) continue
+      rows.push({ kind: 'pending', key: `pending-${adapter.type}`, adapter })
+    }
+
+    return rows
+  })
+
+  /** Torznab is the only built-in, so this group is exactly the Prowlarr and Jackett endpoints. */
+  const torznabRows = computed(() => indexers.value.filter((indexer) => isBuiltInAdapter(indexer.adapterType)))
+
+  /**
+   * Nothing at all, which is what a fresh install looks like and the only state that gets its own
+   * panel. A plugin that failed to load counts as something: it is the one row somebody has to act
+   * on, and burying it under "no sources yet" would say the opposite.
+   */
+  const nothingConfigured = computed(() => pluginRows.value.length === 0 && torznabRows.value.length === 0)
+
+  /**
+   * Rows exist and not one of them is on, which searches exactly as far as having none: the rows
+   * are all still on screen looking configured, so this is the one misconfiguration the list
+   * cannot show by itself.
+   */
+  const allSourcesDisabled = computed(() => indexers.value.length > 0 && indexers.value.every((indexer) => !indexer.enabled))
+
+  /** Every non-built-in source belongs to a plugin, including one whose plugin file is already gone. */
+  const editingPluginType = computed(() => {
+    const type = editingType.value
+    return type && !isBuiltInAdapter(type) ? type : null
+  })
+
+  /** The loaded plugin behind the source being edited, if its file is still available. */
+  const editingPlugin = computed(() => {
+    if (editingPluginType.value === null) return undefined
+    return adapters.value.find((adapter) => adapter.type === editingPluginType.value && !adapter.builtIn)
+  })
+
+  /** Removing the plugin also deletes every source built on it, not only the one being looked at. */
+  const pluginUseCount = computed(() => indexerCountByType.value.get(editingPluginType.value ?? '') ?? 0)
+
+  const pluginUsage = computed(() =>
+    pluginUseCount.value > 0
+      ? t('settings.system.requests.indexers.plugins.usedBy', { count: pluginUseCount.value })
+      : t('settings.system.requests.indexers.plugins.unused'),
+  )
+
+  const pendingRemovalUsage = computed(() => indexerCountByType.value.get(pluginPendingRemoval.value?.type ?? '') ?? 0)
+
+  function askRemovePlugin(plugin: IndexerAdapterDescriptor) {
+    pluginPendingRemoval.value = { type: plugin.type, label: plugin.label }
+  }
+
+  function askRemovePluginType(type: string, label: string) {
+    pluginPendingRemoval.value = { type, label }
+  }
+
+  function cancelRemovePlugin() {
+    pluginPendingRemoval.value = null
+  }
+
+  function confirmRemovePlugin() {
+    const plugin = pluginPendingRemoval.value
+    if (plugin === null) return
+    pluginPendingRemoval.value = null
+    void removeInstalledPlugin(plugin.type)
+  }
+
+  /** The row hands back its adapter type; the descriptor is what the picker and the question need. */
+  function handleRowPluginUpdate(type: string) {
+    const adapter = adapterFor(type)
+    if (adapter) startPluginUpdate(adapter)
+  }
+
+  function handleRowPluginRemove(type: string) {
+    const adapter = adapterFor(type)
+    const source = indexers.value.find((indexer) => indexer.adapterType === type)
+    if (adapter) askRemovePlugin(adapter)
+    else askRemovePluginType(type, source?.name ?? type)
+  }
+
+  function startPluginInstall() {
+    updatingPlugin.value = null
+    pluginInput.value?.click()
+  }
+
+  /**
+   * The same picker, aimed at one plugin. Updating is installing the file again, so it goes through
+   * the same inspection and the same review; what the row adds is which plugin the operator meant.
+   */
+  function startPluginUpdate(plugin: IndexerAdapterDescriptor) {
+    updatingPlugin.value = plugin.type
+    pluginInput.value?.click()
+  }
+
+  async function handlePluginChosen(event: Event) {
+    const input = event.target as HTMLInputElement
+    const file = input.files?.[0] ?? null
+    // Cleared so choosing the same file twice still fires a change event.
+    input.value = ''
+    if (!file) return
+
+    pluginFile.value = file
+    pluginError.value = null
+    pluginBusy.value = true
+    try {
+      const { inspection, error } = await inspectPlugin(file)
+      if (!inspection) {
+        pluginError.value = error ?? t('settings.system.requests.indexers.plugins.inspectFailed')
+        toast.error(pluginError.value)
+        return
+      }
+      // A file chosen from one plugin's Update button has to be that plugin. Without this, updating
+      // LibriVox from a file that declares itself as something else quietly installs the something
+      // else and leaves LibriVox untouched.
+      const expected = updatingPlugin.value
+      if (expected !== null && inspection.type !== expected) {
+        pluginError.value = t('settings.system.requests.indexers.plugins.wrongType', { found: inspection.type, expected })
+        toast.error(pluginError.value)
+        return
+      }
+
+      pluginReview.value = inspection
+    } finally {
+      pluginBusy.value = false
+    }
+  }
+
+  function cancelPluginInstall() {
+    pluginReview.value = null
+    pluginFile.value = null
+    pluginError.value = null
+    updatingPlugin.value = null
+  }
+
+  async function confirmPluginInstall() {
+    const file = pluginFile.value
+    if (!file) return
+
+    pluginBusy.value = true
+    try {
+      const { inspection, error } = await installPlugin(file)
+      if (!inspection) {
+        toast.error(error ?? t('settings.system.requests.indexers.plugins.installFailed'))
+        return
+      }
+      const { type, label, active, replaces } = inspection
+      toast.success(t('settings.system.requests.indexers.plugins.installed', { label }))
+      pluginRestartPending.value = !active
+      restartPendingType = active ? null : type
+      cancelPluginInstall()
+      // Silent, or the populated panel this was started from blanks into a spinner; with adapters,
+      // because the plugin is exactly what changed the adapter list.
+      await fetchIndexers({ silent: true, withAdapters: true })
+      // A first install continues into the indexer it exists to enable. A replacement does not: the
+      // indexers using it are already configured and are not waiting on anything.
+      if (active && !replaces) startCreateFor(type)
+    } finally {
+      pluginBusy.value = false
+    }
+  }
+
+  /**
+   * "Restart BookOrbit to use it" is advice the page never took back: the restart happens in a
+   * terminal, and coming back to a tab that has been sitting open leaves the notice standing until
+   * the whole page is reloaded. Coming back to the tab is exactly the moment to ask again.
+   */
+  async function recheckPluginRestart() {
+    const type = restartPendingType
+    if (!pluginRestartPending.value || !type) return
+
+    await fetchIndexers({ silent: true, withAdapters: true })
+    if (!adapters.value.some((adapter) => adapter.type === type)) return
+    pluginRestartPending.value = false
+    restartPendingType = null
+  }
+
+  function handleWindowFocus() {
+    void recheckPluginRestart()
+  }
+
+  window.addEventListener('focus', handleWindowFocus)
+  onScopeDispose(() => window.removeEventListener('focus', handleWindowFocus))
+
+  async function removeInstalledPlugin(type: string) {
+    removingPlugin.value = type
+    try {
+      const removed = await removePlugin(type)
+      if (!removed) {
+        toast.error(t('settings.system.requests.indexers.plugins.removeFailed'))
+        return
+      }
+      toast.success(t('settings.system.requests.indexers.plugins.removed', { type }))
+      if (editingType.value === type) cancelEdit()
+      await fetchIndexers({ silent: true, withAdapters: true })
+    } finally {
+      removingPlugin.value = null
+    }
+  }
+
+  return {
+    pluginInput,
+    pluginReview,
+    pluginError,
+    pluginBusy,
+    pluginRestartPending,
+    removingPlugin,
+    pluginPendingRemoval,
+    pluginRows,
+    torznabRows,
+    nothingConfigured,
+    allSourcesDisabled,
+    editingPluginType,
+    editingPlugin,
+    pluginUseCount,
+    pluginUsage,
+    pendingRemovalUsage,
+    askRemovePlugin,
+    askRemovePluginType,
+    cancelRemovePlugin,
+    confirmRemovePlugin,
+    handleRowPluginUpdate,
+    handleRowPluginRemove,
+    startPluginInstall,
+    startPluginUpdate,
+    handlePluginChosen,
+    cancelPluginInstall,
+    confirmPluginInstall,
+    removeInstalledPlugin,
+  }
+}
diff --git a/client/src/features/settings/composables/useSettingsDraft.ts b/client/src/features/settings/composables/useSettingsDraft.ts
new file mode 100644
index 000000000..0404575fd
--- /dev/null
+++ b/client/src/features/settings/composables/useSettingsDraft.ts
@@ -0,0 +1,59 @@
+import { computed, ref, type Ref } from 'vue'
+
+/**
+ * The lifecycle every settings editor sheet shares: one record being edited, whether it has been
+ * touched since it opened, and whether its sheet is on screen.
+ *
+ * Extracted because the indexer editor and the download client editor had the same four pieces of
+ * state written out twice, and the second copy had already drifted. What is not shared is the
+ * record itself and its secret field: an indexer holds an API key and a client holds a password,
+ * with different rules about clearing them, and generalising that would cost more indirection than
+ * the two dozen lines it saves.
+ *
+ * `open` is deliberately separate from `draft !== null`, and closing leaves the record behind.
+ * Dropping it in the same tick as `open` goes false is what made the sheet vanish instead of
+ * sliding away: the form it renders unmounts before the exit animation has a frame to run in. The
+ * record left behind is invisible - the sheet it belongs to is closed - and the next `start`
+ * replaces it.
+ */
+export interface SettingsDraft<T> {
+  /** The record being edited, or the last one edited once its sheet has been closed. */
+  draft: Ref<T | null>
+  /** Whether the sheet is on screen. This, not the record, is what the sheet binds to. */
+  open: Ref<boolean>
+  /** Whether the *open* editor has anything typed into it that has not been saved. */
+  isDirty: Ref<boolean>
+  /** Opens the editor on a record, discarding whatever was there. */
+  start: (next: T) => void
+  /** Treats the draft as it currently stands as untouched, after a save or a settled first step. */
+  markPristine: () => void
+  /** Closes the editor. The record stays until the next one replaces it. */
+  close: () => void
+}
+
+export function useSettingsDraft<T extends object>(): SettingsDraft<T> {
+  const draft = ref<T | null>(null) as Ref<T | null>
+  const open = ref(false)
+  /** The draft as it was opened, serialized, so closing can tell a typo from an untouched form. */
+  const pristine = ref('')
+
+  // Gated on `open`, because a closed editor has nothing unsaved: the record it left behind must
+  // not go on reporting itself dirty to the list behind it, where it would disable Test forever.
+  const isDirty = computed(() => open.value && draft.value !== null && JSON.stringify(draft.value) !== pristine.value)
+
+  function start(next: T) {
+    draft.value = next
+    pristine.value = JSON.stringify(next)
+    open.value = true
+  }
+
+  function markPristine() {
+    if (draft.value) pristine.value = JSON.stringify(draft.value)
+  }
+
+  function close() {
+    open.value = false
+  }
+
+  return { draft, open, isDirty, start, markPristine, close }
+}
diff --git a/client/src/features/settings/composables/useSettingsNavStatus.ts b/client/src/features/settings/composables/useSettingsNavStatus.ts
new file mode 100644
index 000000000..466301b98
--- /dev/null
+++ b/client/src/features/settings/composables/useSettingsNavStatus.ts
@@ -0,0 +1,29 @@
+import { computed, watch, type Ref } from 'vue'
+import { useLibraries } from '@/features/library/composables/useLibraries'
+import { useScanProgress } from '@/features/scanner/composables/useScanProgress'
+
+/**
+ * Live signals the settings rail renders beside a row.
+ *
+ * Gated on `enabled` so a user whose permissions hide the Libraries row never fetches the library
+ * list or joins the scan rooms. Both dependencies are module-level singletons, so an enabled rail
+ * reuses whatever the rest of the app has already loaded and connected.
+ */
+export function useSettingsNavStatus(enabled: Ref<boolean>) {
+  const { libraries, fetchLibraries } = useLibraries()
+  const { subscribeLibrary, isScanning } = useScanProgress()
+
+  watch(
+    [enabled, libraries],
+    ([isEnabled, list]) => {
+      if (!isEnabled) return
+      void fetchLibraries()
+      for (const library of list) subscribeLibrary(library.id)
+    },
+    { immediate: true },
+  )
+
+  const isLibraryScanning = computed(() => enabled.value && libraries.value.some((library) => isScanning(library.id)))
+
+  return { isLibraryScanning }
+}
diff --git a/client/src/features/settings/lib/editor-actions.ts b/client/src/features/settings/lib/editor-actions.ts
new file mode 100644
index 000000000..f2590aa6f
--- /dev/null
+++ b/client/src/features/settings/lib/editor-actions.ts
@@ -0,0 +1,17 @@
+/**
+ * An entry in a settings editor's overflow menu. Anything that acts on something other than the
+ * record being edited belongs here rather than beside Save, where it reads as part of the form.
+ */
+export interface EditorMenuAction {
+  id: string
+  label: string
+  /** Drawn as destructive in the menu. Styling only; the confirm step is `confirm`. */
+  danger?: boolean
+  /** The question the footer asks before running this. Without one it runs on the first click. */
+  confirm?: string
+  /** What running it costs beyond the obvious, such as what else stops working. */
+  consequence?: string
+  /** Draws a divider above the entry, to separate the record from what it is built on. */
+  separated?: boolean
+  disabled?: boolean
+}
diff --git a/client/src/features/settings/lib/settings-nav.ts b/client/src/features/settings/lib/settings-nav.ts
index 5648ef54b..bdfaee2e7 100644
--- a/client/src/features/settings/lib/settings-nav.ts
+++ b/client/src/features/settings/lib/settings-nav.ts
@@ -5,6 +5,7 @@ import {
   BookMarked,
   BookOpen,
   Database,
+  DownloadCloud,
   FileText,
   Filter,
   Folder,
@@ -16,6 +17,7 @@ import {
   LayoutGrid,
   Library,
   LibraryBig,
+  Link2,
   Lock,
   Mail,
   Palette,
@@ -25,6 +27,7 @@ import {
   Server,
   Shield,
   ShieldCheck,
+  ShieldUser,
   SlidersHorizontal,
   Smartphone,
   Sparkles,
@@ -45,6 +48,9 @@ export interface SettingsNavContext {
   isDemoRestricted: boolean
 }
 
+/** Live signals the rail renders beside a row. Resolved by the nav, not stored in this file. */
+export type SettingsNavStatus = 'libraryScan'
+
 export interface SettingsNavItem {
   id: string
   routeName: string
@@ -53,6 +59,7 @@ export interface SettingsNavItem {
   icon: Component
   /** Extra English search terms so the rail search finds a page by concept, not just by title. */
   keywords?: string
+  status?: SettingsNavStatus
   isVisible?: (context: SettingsNavContext) => boolean
   children?: SettingsNavItem[]
 }
@@ -239,70 +246,80 @@ export const SETTINGS_NAV: readonly SettingsNavGroup[] = [
         descriptionKey: 'settings.nav.descriptions.libraries',
         icon: Folder,
         keywords: 'library folder path scan watch ignore mount storage',
+        status: 'libraryScan',
         isVisible: anyPermission('manage_libraries'),
       },
       {
-        id: 'metadata-providers',
+        id: 'metadata',
         routeName: 'settings-metadata-providers',
-        labelKey: 'settings.metadata.tabs.providers',
-        descriptionKey: 'settings.metadata.tabSubtitles.providers',
+        labelKey: 'settings.common.nav.metadata',
         icon: Database,
-        keywords: 'provider source google books open library comicvine priority credentials',
-        isVisible: anyPermission('manage_metadata_config'),
-      },
-      {
-        id: 'metadata-field-rules',
-        routeName: 'settings-metadata-field-rules',
-        labelKey: 'settings.metadata.tabs.field-rules',
-        descriptionKey: 'settings.metadata.tabSubtitles.field-rules',
-        icon: SlidersHorizontal,
-        keywords: 'field rule merge strategy overwrite protect title author series',
-        isVisible: anyPermission('manage_metadata_config'),
-      },
-      {
-        id: 'metadata-custom-fields',
-        routeName: 'settings-metadata-custom-fields',
-        labelKey: 'settings.metadata.tabs.custom-fields',
-        descriptionKey: 'settings.metadata.tabSubtitles.custom-fields',
-        icon: Tag,
-        keywords: 'custom field column attribute picker',
-        isVisible: anyPermission('manage_libraries'),
-      },
-      {
-        id: 'metadata-score',
-        routeName: 'settings-metadata-score',
-        labelKey: 'settings.metadata.tabs.score',
-        descriptionKey: 'settings.metadata.tabSubtitles.score',
-        icon: Star,
-        keywords: 'score weight match confidence similarity threshold',
-        isVisible: anyPermission('manage_metadata_config'),
-      },
-      {
-        id: 'metadata-auto-fetch',
-        routeName: 'settings-metadata-auto-fetch',
-        labelKey: 'settings.metadata.tabs.auto-fetch',
-        descriptionKey: 'settings.metadata.tabSubtitles.auto-fetch',
-        icon: Zap,
-        keywords: 'auto fetch schedule missing fields import books conditions',
-        isVisible: anyPermission('manage_metadata_config'),
-      },
-      {
-        id: 'metadata-authors',
-        routeName: 'settings-metadata-authors',
-        labelKey: 'settings.metadata.tabs.authors',
-        descriptionKey: 'settings.metadata.tabSubtitles.authors',
-        icon: Sparkles,
-        keywords: 'author biography photo enrichment',
-        isVisible: anyPermission('manage_metadata_config'),
-      },
-      {
-        id: 'metadata-genre-blocklist',
-        routeName: 'settings-metadata-genre-blocklist',
-        labelKey: 'settings.metadata.tabs.genre-blocklist',
-        descriptionKey: 'settings.metadata.tabSubtitles.genre-blocklist',
-        icon: Filter,
-        keywords: 'genre tag blocklist exclude ignore',
-        isVisible: anyPermission('manage_metadata_config'),
+        keywords: 'metadata provider field rule score author genre custom field',
+        children: [
+          {
+            id: 'metadata-providers',
+            routeName: 'settings-metadata-providers',
+            labelKey: 'settings.metadata.tabs.providers',
+            descriptionKey: 'settings.metadata.tabSubtitles.providers',
+            icon: Database,
+            keywords: 'provider source google books open library comicvine priority credentials',
+            isVisible: anyPermission('manage_metadata_config'),
+          },
+          {
+            id: 'metadata-field-rules',
+            routeName: 'settings-metadata-field-rules',
+            labelKey: 'settings.metadata.tabs.field-rules',
+            descriptionKey: 'settings.metadata.tabSubtitles.field-rules',
+            icon: SlidersHorizontal,
+            keywords: 'field rule merge strategy overwrite protect title author series',
+            isVisible: anyPermission('manage_metadata_config'),
+          },
+          {
+            id: 'metadata-custom-fields',
+            routeName: 'settings-metadata-custom-fields',
+            labelKey: 'settings.metadata.tabs.custom-fields',
+            descriptionKey: 'settings.metadata.tabSubtitles.custom-fields',
+            icon: Tag,
+            keywords: 'custom field column attribute picker',
+            isVisible: anyPermission('manage_libraries'),
+          },
+          {
+            id: 'metadata-score',
+            routeName: 'settings-metadata-score',
+            labelKey: 'settings.metadata.tabs.score',
+            descriptionKey: 'settings.metadata.tabSubtitles.score',
+            icon: Star,
+            keywords: 'score weight match confidence similarity threshold',
+            isVisible: anyPermission('manage_metadata_config'),
+          },
+          {
+            id: 'metadata-auto-fetch',
+            routeName: 'settings-metadata-auto-fetch',
+            labelKey: 'settings.metadata.tabs.auto-fetch',
+            descriptionKey: 'settings.metadata.tabSubtitles.auto-fetch',
+            icon: Zap,
+            keywords: 'auto fetch schedule missing fields import books conditions',
+            isVisible: anyPermission('manage_metadata_config'),
+          },
+          {
+            id: 'metadata-authors',
+            routeName: 'settings-metadata-authors',
+            labelKey: 'settings.metadata.tabs.authors',
+            descriptionKey: 'settings.metadata.tabSubtitles.authors',
+            icon: Sparkles,
+            keywords: 'author biography photo enrichment',
+            isVisible: anyPermission('manage_metadata_config'),
+          },
+          {
+            id: 'metadata-genre-blocklist',
+            routeName: 'settings-metadata-genre-blocklist',
+            labelKey: 'settings.metadata.tabs.genre-blocklist',
+            descriptionKey: 'settings.metadata.tabSubtitles.genre-blocklist',
+            icon: Filter,
+            keywords: 'genre tag blocklist exclude ignore',
+            isVisible: anyPermission('manage_metadata_config'),
+          },
+        ],
       },
       {
         id: 'file-naming',
@@ -365,6 +382,13 @@ export const SETTINGS_NAV: readonly SettingsNavGroup[] = [
         keywords: 'email smtp kindle send to device template sender',
         isVisible: anyPermission('email_send', 'manage_email'),
       },
+    ],
+  },
+  {
+    id: 'accounts',
+    labelKey: 'settings.nav.groups.accounts',
+    icon: Link2,
+    items: [
       {
         id: 'hardcover',
         routeName: 'settings-hardcover',
@@ -400,49 +424,58 @@ export const SETTINGS_NAV: readonly SettingsNavGroup[] = [
     icon: Server,
     items: [
       {
-        id: 'users',
+        id: 'users-access',
         routeName: 'settings-admin-users',
-        labelKey: 'settings.admin.tabs.users',
-        descriptionKey: 'settings.nav.descriptions.users',
-        icon: Users,
-        keywords: 'user role permission invite admin superuser account',
-        isVisible: anyPermission('manage_users'),
+        labelKey: 'settings.common.nav.usersAccess',
+        icon: ShieldUser,
+        keywords: 'user role permission invite admin superuser sso login access',
+        children: [
+          {
+            id: 'users',
+            routeName: 'settings-admin-users',
+            labelKey: 'settings.admin.tabs.users',
+            descriptionKey: 'settings.nav.descriptions.users',
+            icon: Users,
+            keywords: 'user role permission invite admin superuser account',
+            isVisible: anyPermission('manage_users'),
+          },
+          {
+            id: 'account-activity',
+            routeName: 'settings-admin-account-activity',
+            labelKey: 'settings.admin.tabs.account-activity',
+            descriptionKey: 'settings.nav.descriptions.accountActivity',
+            icon: Activity,
+            keywords: 'activity session login usage reading insights',
+            isVisible: anyPermission('view_user_activity'),
+          },
+          {
+            id: 'magic-links',
+            routeName: 'settings-admin-magic-links',
+            labelKey: 'settings.admin.tabs.magic-links',
+            descriptionKey: 'settings.nav.descriptions.magicLinks',
+            icon: KeyRound,
+            keywords: 'magic link share passwordless expiry token invite',
+            isVisible: superuserOnly,
+          },
+          {
+            id: 'oidc',
+            routeName: 'settings-admin-oidc',
+            labelKey: 'settings.admin.tabs.oidc',
+            descriptionKey: 'settings.nav.descriptions.oidc',
+            icon: ShieldCheck,
+            keywords: 'oidc sso single sign on auth provider claims',
+            isVisible: anyPermission('manage_app_settings'),
+          },
+        ],
       },
       {
-        id: 'account-activity',
-        routeName: 'settings-admin-account-activity',
-        labelKey: 'settings.admin.tabs.account-activity',
-        descriptionKey: 'settings.nav.descriptions.accountActivity',
-        icon: Activity,
-        keywords: 'activity session login usage reading insights',
-        isVisible: anyPermission('view_user_activity'),
-      },
-      {
-        id: 'magic-links',
-        routeName: 'settings-admin-magic-links',
-        labelKey: 'settings.admin.tabs.magic-links',
-        descriptionKey: 'settings.nav.descriptions.magicLinks',
-        icon: KeyRound,
-        keywords: 'magic link share passwordless expiry token invite',
-        isVisible: superuserOnly,
-      },
-      {
-        id: 'oidc',
-        routeName: 'settings-admin-oidc',
-        labelKey: 'settings.admin.tabs.oidc',
-        descriptionKey: 'settings.nav.descriptions.oidc',
-        icon: ShieldCheck,
-        keywords: 'oidc sso single sign on auth provider claims',
-        isVisible: anyPermission('manage_app_settings'),
-      },
-      {
-        id: 'server-fonts',
-        routeName: 'settings-admin-server-fonts',
-        labelKey: 'settings.admin.tabs.server-fonts',
-        descriptionKey: 'settings.nav.descriptions.serverFonts',
-        icon: Type,
-        keywords: 'server font upload typeface available readers',
-        isVisible: anyPermission('manage_app_settings'),
+        id: 'requests',
+        routeName: 'settings-admin-requests',
+        labelKey: 'settings.system.tabs.requests',
+        descriptionKey: 'settings.nav.descriptions.requests',
+        icon: DownloadCloud,
+        keywords: 'request download client qbittorrent torrent magnet path mapping hardlink',
+        isVisible: anyPermission(Permission.ManageAppSettings),
       },
       {
         id: 'book-dock',
@@ -453,6 +486,15 @@ export const SETTINGS_NAV: readonly SettingsNavGroup[] = [
         keywords: 'dock quick action book page toolbar',
         isVisible: anyPermission(Permission.ManageBookDock),
       },
+      {
+        id: 'server-fonts',
+        routeName: 'settings-admin-server-fonts',
+        labelKey: 'settings.admin.tabs.server-fonts',
+        descriptionKey: 'settings.nav.descriptions.serverFonts',
+        icon: Type,
+        keywords: 'server font upload typeface available readers',
+        isVisible: anyPermission('manage_app_settings'),
+      },
       {
         id: 'audit-log',
         routeName: 'settings-admin-audit-log',
@@ -470,12 +512,19 @@ function isItemVisible(item: SettingsNavItem, context: SettingsNavContext): bool
   return item.isVisible ? item.isVisible(context) : true
 }
 
+/** A grouping row is only a destination through its children, so it dies with the last of them. */
+function visibleItem(item: SettingsNavItem, context: SettingsNavContext): SettingsNavItem | null {
+  if (!isItemVisible(item, context)) return null
+  if (!item.children) return item
+  const children = item.children.filter((child) => isItemVisible(child, context))
+  if (children.length === 0) return null
+  return { ...item, children }
+}
+
 export function visibleSettingsNav(context: SettingsNavContext): SettingsNavGroup[] {
   return SETTINGS_NAV.map((group) => ({
     ...group,
-    items: group.items
-      .filter((item) => isItemVisible(item, context))
-      .map((item) => (item.children ? { ...item, children: item.children.filter((child) => isItemVisible(child, context)) } : item)),
+    items: group.items.map((item) => visibleItem(item, context)).filter((item): item is SettingsNavItem => item !== null),
   })).filter((group) => group.items.length > 0)
 }
 
diff --git a/client/src/features/settings/lib/system-tabs.ts b/client/src/features/settings/lib/system-tabs.ts
index 4fd8e302f..e4ef99f03 100644
--- a/client/src/features/settings/lib/system-tabs.ts
+++ b/client/src/features/settings/lib/system-tabs.ts
@@ -1,28 +1,7 @@
-import { Permission } from '@bookorbit/types'
-
-export const SYSTEM_TABS = ['file-naming', 'book-dock', 'maintenance', 'audit-log'] as const
+export const SYSTEM_TABS = ['file-naming', 'book-dock', 'requests', 'maintenance', 'audit-log'] as const
 
 export type SystemTab = (typeof SYSTEM_TABS)[number]
 
-type SystemTabInfo = {
-  permission: Permission | null
-}
-
-export const SYSTEM_TAB_INFO: Record<SystemTab, SystemTabInfo> = {
-  'file-naming': {
-    permission: Permission.ManageAppSettings,
-  },
-  'book-dock': {
-    permission: Permission.ManageBookDock,
-  },
-  maintenance: {
-    permission: Permission.ManageAppSettings,
-  },
-  'audit-log': {
-    permission: null,
-  },
-}
-
 export function normalizeSystemTab(value: unknown): SystemTab {
   if (typeof value === 'string' && SYSTEM_TABS.includes(value as SystemTab)) {
     return value as SystemTab
diff --git a/client/src/locales/en.json b/client/src/locales/en.json
index f8aaea3de..e4617d2b3 100644
--- a/client/src/locales/en.json
+++ b/client/src/locales/en.json
@@ -14,7 +14,9 @@
     "previous": "Previous",
     "retry": "Retry",
     "yes": "Yes",
-    "no": "No"
+    "no": "No",
+    "show": "Show",
+    "hide": "Hide"
   },
   "settings": {
     "privacySharing": {
@@ -1369,6 +1371,7 @@
         "display": "Display",
         "reader": "Reader",
         "metadata": "Metadata",
+        "usersAccess": "Users & Access",
         "email": "Email",
         "opds": "OPDS",
         "kobo": "Kobo",
@@ -2792,8 +2795,428 @@
       "tabs": {
         "file-naming": "File Naming",
         "book-dock": "Book Dock",
+        "requests": "Requests",
         "maintenance": "Maintenance",
         "audit-log": "Audit Log"
+      },
+      "requests": {
+        "title": "Requests",
+        "subtitle": "Where releases are found, what fetches them, and what happens once they land.",
+        "tabs": {
+          "sources": "Sources",
+          "clients": "Download clients",
+          "automation": "Automation"
+        },
+        "loading": "Loading download clients...",
+        "clients": "Download clients",
+        "addClient": "Add client",
+        "editClient": "Edit client",
+        "deleteClient": "Delete {name}",
+        "clientsEmpty": {
+          "title": "No download client yet",
+          "body": "A direct HTTP download needs no client. Connect one so BookOrbit can fetch what a tracker offers as a torrent too.",
+          "note": "qBittorrent, Transmission and Deluge are supported."
+        },
+        "summary": "{type} - category {category}, priority {priority}",
+        "disabled": "Disabled",
+        "test": "Test connection",
+        "testSaveFirst": "Save your changes before testing",
+        "testOk": "Connected to {client} {version}",
+        "testOkNoVersion": "Connected to {client}",
+        "lastTestOk": "Last tested {time}: connected",
+        "lastTestFailed": "Last tested {time}: {error}",
+        "saved": "Download client saved",
+        "deleted": "Download client removed",
+        "clientTypes": {
+          "qbittorrent": "qBittorrent",
+          "transmission": "Transmission",
+          "deluge": "Deluge"
+        },
+        "color": {
+          "label": "Color",
+          "hint": "Marks this client in transfer details. The transfer protocol keeps its own color.",
+          "none": "No color"
+        },
+        "fields": {
+          "name": "Name",
+          "type": "Client type",
+          "baseUrl": "Base URL",
+          "username": "Username",
+          "password": "Password",
+          "passwordKeep": "Leave blank to keep the stored password",
+          "passwordClear": "Clear",
+          "passwordKeepAction": "Keep",
+          "passwordWillClear": "The stored password is removed when you save",
+          "category": "Category",
+          "categoryHint": "Tags the torrents BookOrbit adds, so it only ever acts on its own.",
+          "priority": "Priority",
+          "enabled": "Enabled",
+          "useHardlinks": "Use hardlinks",
+          "allowPrivateAddress": "Allow private addresses",
+          "allowPrivateAddressHint": "Needed when the client runs on your local network or the same machine.",
+          "passwordBrief": "Stored encrypted.",
+          "useHardlinksBrief": "Seeds without using the disk twice. Falls back to a copy across filesystems."
+        },
+        "mappings": {
+          "title": "Path mappings",
+          "hint": "Translate the paths the client reports into paths BookOrbit can open. Needed when the two run in separate containers.",
+          "add": "Add mapping",
+          "remove": "Remove mapping",
+          "remotePath": "Client path",
+          "localPath": "BookOrbit path",
+          "brief": "Required. Declares the directory BookOrbit may import from; when the client sees the same files at the same paths, map the download directory to itself.",
+          "identityExample": "Same filesystem? Use the same path on both sides, for example /downloads on the left and /downloads on the right."
+        },
+        "hardlink": {
+          "test": "Test hardlink",
+          "checking": "Checking...",
+          "works": "Hardlinks work here: imports will not use the disk twice.",
+          "unavailable": "Hardlinks are not available here: imports will copy, using the space twice.",
+          "link_refused": "This filesystem refused the link ({code}): imports will copy, using the space twice.",
+          "download_dir_unwritable": "BookOrbit cannot write to the download directory ({code}), so hardlinking could not be tested.",
+          "localMissing": "BookOrbit cannot see that path.",
+          "dockMissing": "The Book Dock folder is not readable."
+        },
+        "reconciliation": {
+          "action": "Reconcile",
+          "clean": "Every owned client item matches a retained BookOrbit download attempt.",
+          "unsupported": "This client cannot enumerate items by BookOrbit's ownership marker. For Deluge, enable the Label plugin; for Transmission, configure a category folder.",
+          "truncated": "The client returned more than 1,000 owned items. Resolve the visible entries, then reconcile again.",
+          "orphan": "No retained BookOrbit attempt owns this client item.",
+          "failedAttempt": "The client still holds this item, but its attempt for \"{title}\" is marked failed.",
+          "missing": "This {status} attempt is no longer present in the download client.",
+          "adopt": "Attach to {title}",
+          "adopted": "Attached the client item to {title}",
+          "remove": "Remove from client",
+          "removed": "Removed the orphaned client item",
+          "removeTitle": "Remove this orphaned client item?",
+          "removeDescription": "{name} is removed from the download client. Its downloaded files are kept.",
+          "notOrphan": "That client item is still attached to a BookOrbit download attempt.",
+          "notAdoptable": "That client item or failed attempt changed and can no longer be attached. Reconcile again."
+        },
+        "errors": {
+          "loadFailed": "Could not load download clients",
+          "saveFailed": "Could not save that download client",
+          "deleteFailed": "Could not remove that download client",
+          "testFailed": "Could not reach that download client",
+          "nameAndUrlRequired": "A name and a base URL are required",
+          "nameTaken": "A download client with that name already exists",
+          "urlUnsafe": "That base URL could not be reached. Check the address and that it uses http or https.",
+          "urlPrivate": "That address is on a private or local network. Turn on \"Allow private addresses\" if the client runs there.",
+          "encryptionKeyMissing": "Set BOOK_REQUEST_ENCRYPTION_KEY before saving a password. Generate one with: openssl rand -hex 32",
+          "encryptionKeyChanged": "The stored password could not be read. BOOK_REQUEST_ENCRYPTION_KEY may have changed since it was saved.",
+          "pathNotAbsolute": "Path mappings must use absolute paths on both sides",
+          "nameRequired": "Give this client a name.",
+          "urlRequired": "Enter the address BookOrbit should reach this client at.",
+          "mappingRequired": "Add at least one path mapping, so BookOrbit knows which directory it may import from."
+        },
+        "encryptionKeyMissing": "BOOK_REQUEST_ENCRYPTION_KEY is not set, so a client password cannot be saved. Generate one with: openssl rand -hex 32",
+        "confirmDelete": {
+          "title": "Remove this download client?",
+          "description": "{name}'s address and stored password are deleted, and requests downloading there stop updating. Turn it off instead to keep the details.",
+          "confirm": "Remove client"
+        },
+        "indexers": {
+          "title": "Torrent indexers",
+          "hint": "Your own Prowlarr, Jackett or NZBHydra, over Torznab. Add one per Torznab feed you want searched.",
+          "allDisabled": "Every source below is switched off, so no request search will find anything. Switch at least one back on.",
+          "loading": "Loading indexers...",
+          "empty": {
+            "title": "No sources yet",
+            "body": "BookOrbit bundles no sources of its own, so a request search finds nothing until you add one. There are two ways in.",
+            "bodyOneWay": "BookOrbit bundles no sources of its own, so a request search finds nothing until you add one.",
+            "responsibility": "What a source you add indexes is your responsibility.",
+            "pluginTitle": "Install a plugin",
+            "pluginBody": "One file that teaches BookOrbit to search a specific site. You supply it, then fill in its settings.",
+            "torznabTitle": "Add a Torznab indexer",
+            "torznabBody": "Point at a Prowlarr, Jackett or NZBHydra feed you already run. One per feed."
+          },
+          "add": "Add indexer",
+          "edit": "Edit indexer",
+          "delete": "Delete {name}",
+          "none": "No indexer yet.",
+          "disabled": "Disabled",
+          "test": "Test connection",
+          "testSaveFirst": "Save your changes before testing",
+          "testOk": "Connected to {name}",
+          "toggleAria": "Search with {name}",
+          "enabledNotice": "{name} will be searched",
+          "disabledNotice": "{name} will not be searched",
+          "lastTestOk": "Last tested {time}: connected",
+          "lastTestFailed": "Last tested {time}: {error}",
+          "saved": "Indexer saved",
+          "deleted": "Source deleted",
+          "unavailable": "This install has no \"{type}\" indexer type. Change the type or delete its plugin and saved configuration.",
+          "pluginFailed": "The plugin in \"{directory}\" did not load: {reason}",
+          "network": {
+            "title": "Advanced network",
+            "hint": "Only needed when the default path to this source does not work. What is allowed does not change: whatever address is reached is still checked the same way.",
+            "resolvers": "DNS servers",
+            "proxyUrl": "Proxy URL",
+            "proxyHint": "An http or https proxy to send this source's requests through. SOCKS is not supported.",
+            "brief": "Only needed when the default path to this source does not work.",
+            "resolversBrief": "Comma separated. Used instead of the system resolver for this source only; blank uses the system one.",
+            "proxyBrief": "An http or https proxy for this source. SOCKS is not supported."
+          },
+          "types": {
+            "torznab": "Torznab (Jackett, Prowlarr, NZBHydra)"
+          },
+          "fields": {
+            "name": "Name",
+            "type": "Indexer type",
+            "baseUrl": "Base URL",
+            "baseUrlHint": {
+              "torznab": "The torznab feed URL, without the query string. Jackett shows it on each indexer as \"Torznab Feed\"."
+            },
+            "credential": {
+              "apiKey": "API key",
+              "sessionId": "Session ID"
+            },
+            "credentialKeep": "Leave blank to keep the stored credential",
+            "credentialClear": "Clear",
+            "credentialKeepAction": "Keep",
+            "credentialWillClear": "The stored credential is removed when you save",
+            "enabled": "Enabled",
+            "allowPrivateAddress": "Allow private addresses",
+            "credentialBrief": "Stored encrypted.",
+            "allowPrivateAddressBrief": "Off by default. Only needed for a proxy such as Jackett on your local network.",
+            "searchByIsbn": "Search by ISBN",
+            "searchByIsbnBrief": "On by default. Turn it off if this source returns the wrong book for an exact ISBN, and it will be searched by title and author instead."
+          },
+          "color": {
+            "label": "Color",
+            "hint": "Marks this source on every release it returns, so you can tell where a result came from before reading its name. Torrent and direct download keep their own two colors, which is why neither is offered here.",
+            "none": "No color",
+            "options": {
+              "blue": "Blue",
+              "indigo": "Indigo",
+              "purple": "Purple",
+              "pink": "Pink",
+              "red": "Red",
+              "orange": "Orange",
+              "yellow": "Yellow",
+              "lime": "Lime",
+              "green": "Green",
+              "teal": "Teal"
+            }
+          },
+          "mediaKinds": {
+            "label": "Search this source for",
+            "hint": "Turn off a medium this source is not worth asking about. An audiobook-only tracker behind a general proxy still says it carries everything, and searching it for ebooks costs a request on every search.",
+            "notCarried": "This source does not carry it."
+          },
+          "categories": {
+            "title": "Categories",
+            "brief": "The indexer's own category numbers, separated by commas."
+          },
+          "settings": {
+            "restoreDefault": "Restore defaults"
+          },
+          "confirmDelete": {
+            "title": "Delete this source?",
+            "description": "{name}'s address, settings and stored credential are deleted. Turn it off instead to stop searching it without losing them.",
+            "confirm": "Delete source"
+          },
+          "errors": {
+            "loadFailed": "Could not load indexers",
+            "saveFailed": "Could not save that indexer",
+            "deleteFailed": "Could not delete that source",
+            "testFailed": "Could not reach that indexer",
+            "nameAndUrlRequired": "A name and a base URL are required",
+            "nameTaken": "An indexer with that name already exists",
+            "urlUnsafe": "That base URL could not be reached. Check the address and that it uses http or https.",
+            "urlPrivate": "That address is on a private or local network. Turn on \"Allow private addresses\" if the indexer runs there.",
+            "credentialRequired": "That indexer needs a credential before it can be used",
+            "invalidSettings": "One or more source settings are invalid. Review the available choices.",
+            "nameRequired": "Give this indexer a name.",
+            "urlRequired": "Enter the address BookOrbit should search at."
+          },
+          "editName": "Edit {name}",
+          "editorDescription": "Settings for this indexer.",
+          "chooseType": "Choose an indexer type",
+          "chooseTypeHint": "Pick where BookOrbit should search. The form then asks only for what that source needs.",
+          "builtIn": "Built in",
+          "plugin": "Plugin",
+          "typeDescriptions": {
+            "torznab": "Your own Jackett, Prowlarr or NZBHydra. Uses categories and seed goals."
+          },
+          "plugins": {
+            "title": "Plugins",
+            "hint": "A site BookOrbit can search, added as a single plugin file. Install one, then fill in its settings.",
+            "directoryLink": "Browse open library plugins",
+            "none": "No plugin installed. Install one to search a site Torznab does not cover.",
+            "install": "Install plugin",
+            "installed": "Installed {label}.",
+            "installFailed": "That plugin could not be installed.",
+            "inspectFailed": "That file could not be read as a plugin.",
+            "removeAction": "Delete plugin",
+            "removed": "Deleted {type} and its sources.",
+            "removeFailed": "That plugin could not be deleted.",
+            "confirmRemove": "Delete the {label} plugin?",
+            "replaces": "This replaces the {type} plugin already installed.",
+            "restartRequired": "Restart BookOrbit for the plugin change to take effect.",
+            "confirmInstall": "Install plugin",
+            "configure": "Set up",
+            "notSetUp": "Not set up yet",
+            "brokenTitle": "A plugin did not load",
+            "managedHint": "Installed on this server. Updating replaces its code. Deleting permanently removes the plugin and every source of this type.",
+            "missingHint": "The plugin file is already gone. Delete this plugin entry to remove every remaining source, setting and stored credential for its type.",
+            "removeWarning": "{count, plural, one {# source and its saved settings and credential will be permanently deleted with this plugin.} other {# sources and their saved settings and credentials will be permanently deleted with this plugin.}}",
+            "configureAria": "Set up {label}",
+            "usedBy": "{count, plural, one {used by # source} other {used by # sources}}",
+            "unused": "no source uses it yet",
+            "update": "Update plugin",
+            "wrongType": "That file is the {found} plugin, not {expected}.",
+            "replaceTitle": "Replace this plugin?",
+            "replace": "Replace plugin",
+            "reviewTitle": "Install this plugin?",
+            "reviewDescription": "What the file declares about itself, and the code it will run.",
+            "declares": "What it declares",
+            "source": "What it will run",
+            "type": "Type",
+            "version": "Version",
+            "versionLabel": "Plugin version {version}",
+            "versionUnknown": "Plugin version unknown",
+            "versionUnknownValue": "Unknown",
+            "media": "Media",
+            "credential": "Credential",
+            "credentialRequired": "Required",
+            "credentialNone": "None",
+            "trustWarning": "A plugin runs inside BookOrbit with its access to your database, library files and encryption key. Install one only from a source you trust, and read it first.",
+            "sectionTitle": "Plugin",
+            "removeUnusedWarning": "The plugin will be permanently deleted from the server."
+          },
+          "posture": "BookOrbit does not provide or endorse indexer sources. Every source here is one you configured, and you are responsible for what you search and download through it."
+        },
+        "automation": {
+          "title": "Automation",
+          "pipeline": "When a download finishes it passes through the Book Dock, where its title and author are read so the file can be named and filed correctly, and then it moves into the request's destination library on its own. It only stops for you if import checking is on and the file does not match what was requested.",
+          "groupDownloads": "Automatic downloads",
+          "groupImports": "Import checks",
+          "stateOn": "On",
+          "stateOff": "Off",
+          "summaryOff": "Every approved request waits for a person to open the release picker and choose.",
+          "summaryNoRetry": "An approved request downloads its best release on its own, as long as that release scores {score} or more. If it fails, the request waits for a person.",
+          "summaryRetry": "An approved request downloads its best release on its own, as long as that release scores {score} or more. {count, plural, one {It is the only release tried before the request waits for a person.} other {Up to # releases are tried before the request waits for a person.}}",
+          "howDownloads": "How automatic downloads work",
+          "howImports": "How import checks work",
+          "minScoreShort": "Nothing below this is downloaded unattended.",
+          "autoRetryShort": "A failed download falls through to the runner-up.",
+          "maxAttemptsShort": "The first attempt and every retry count towards this.",
+          "verificationShort": "Below this, the file waits in the Book Dock for review.",
+          "loading": "Loading the automation settings...",
+          "loadFailed": "Could not load the automation settings",
+          "saveFailed": "Could not save that setting",
+          "saved": "Automation settings saved",
+          "autoGrab": "Download the best release automatically",
+          "noSourcesConfigured": "No search sources are set up, so nothing will be searched and every approved request will be handed straight back. Add one under Sources.",
+          "noSourcesEnabled": "Every search source is switched off, so nothing will be searched and every approved request will be handed straight back. Switch one back on under Sources.",
+          "autoGrabHint": "When a request is approved, its highest-scoring release goes straight to the download client and nobody has to open the release picker. Off by default, because matching a book to the right release is hard and a person is usually the better judge.",
+          "autoGrabEnabled": "Automatic downloads are on",
+          "autoGrabDisabled": "Automatic downloads are off",
+          "minScore": "Minimum release score",
+          "minScoreHint": "A release scoring below this is never downloaded automatically. Scores run to 100, and how well the title and author match makes up most of one, with format, file size, seeders and source priority behind it. If nothing scores high enough, the request waits for someone to pick a release by hand and says why it stopped.",
+          "autoRetry": "Try the next release after a failure",
+          "autoRetryHint": "When an automatic download fails, the next-best release is tried instead of giving up. This covers a source refusing to hand the file over and a download that dies partway through. It only applies to releases BookOrbit chose itself: one an approver picked by hand stays failed and waits for them.",
+          "maxAttempts": "Attempts per request",
+          "maxAttemptsHint": "Every release BookOrbit sends to a download client for this request counts towards this limit: the first automatic attempt, anything tried after a source turned one down, and anything tried after a download failed. Set it to 1 to stop after the first attempt.",
+          "autoSearch": "Keep looking for requests nothing was found for",
+          "autoSearchShort": "An approved request nothing matched is searched for again later.",
+          "autoSearchHint": "A request is searched for once when it is approved. If nothing good enough turns up, or the book has not been released yet, that request waits at approved and nothing looks for it again. Switch this on and BookOrbit keeps checking on its own, so a release posted next month is still found. It only runs while automatic downloads are on, since a search with nothing to do with what it finds only costs your sources traffic.",
+          "autoSearchEnabledToast": "Requests will be searched for again",
+          "autoSearchDisabledToast": "Requests will only be searched when they are approved",
+          "autoSearchInterval": "Search again after",
+          "autoSearchIntervalShort": "Counted from the last search, and stretched as a request ages.",
+          "autoSearchIntervalHint": "How long to wait before looking again for a request nothing was found for. The wait doubles for each week a request has been waiting, up to eight times this figure, so a long backlog of old requests does not turn into daily traffic against every source you have.",
+          "autoSearchIntervalUnit": "hours",
+          "autoSearchMaxAge": "Stop looking after",
+          "autoSearchMaxAgeShort": "Counted from when the request was made.",
+          "autoSearchMaxAgeHint": "A request older than this is left alone. It stays approved and can still have a release picked by hand at any time; nothing looks for it automatically any more.",
+          "autoSearchMaxAgeUnit": "days",
+          "verify": "Check imports against the request",
+          "verifyOnHint": "Every downloaded file is compared with the book that was requested before it is filed. Anything that does not match closely enough waits in the Book Dock for someone to look at.",
+          "verifyOffHint": "Nothing is held for review. Every download is filed as soon as its title and author have been read, so a mislabelled release lands in your library without warning.",
+          "verificationEnabled": "Import checking is on",
+          "verificationDisabled": "Import checking is off. Downloads will be filed without review",
+          "verification": "Verification threshold",
+          "verificationHint": "How closely a downloaded file has to match the request before it is filed on its own. Anything below this waits in the Book Dock for review instead. This applies to every request, including releases someone picked by hand.",
+          "destinations": "Default destinations",
+          "destinationsHint": "Where a book is filed when nobody chose a library for it. There is one default per medium, because the medium is picked before anything is searched and is the only thing known about the file that early. A destination the requester pinned, or one chosen at approval, is used ahead of these.",
+          "destinationUnset": "No default",
+          "destinationHiddenLibrary": "A library you cannot see",
+          "destinationHiddenFolder": "A folder you cannot see",
+          "selectFolder": "Choose a folder",
+          "destinationLibraryFor": "Default library for {medium} requests",
+          "destinationFolderFor": "Default folder for {medium} requests",
+          "destinationClearFor": "Clear the default destination for {medium} requests",
+          "importFormats": "Import formats",
+          "importFormatsHint": "What to keep when one release carries the same book in more than one format, such as an EPUB and a PDF together. This never applies to a multipart audiobook, because its parts are one book rather than competing editions.",
+          "importFormatsOption": {
+            "all": "All available",
+            "allHint": "Keep every format that came with the release.",
+            "preferred": "Preferred only",
+            "preferredHint": "Keep only the format that sits highest in the destination library's format priority."
+          }
+        },
+        "profiles": {
+          "title": "Release profiles",
+          "hint": "The edition you want, best first. A release is matched against these top to bottom and takes the first tier it fits. This is what unattended downloading chooses from: a release that matches no tier is never downloaded automatically, though it still appears in the picker for you to send by hand. Leave a medium empty and nothing is filtered or refused, and releases rank by score alone.",
+          "bitrateNote": "A bitrate floor turns away a release that states a lower one. Most sources measure very few of their releases, and an unmeasured release is not turned away, so this narrows less than it looks.",
+          "empty": "No profile. Releases for this medium are ranked by score alone.",
+          "addTier": "Add tier",
+          "removeTier": "Remove this tier",
+          "moveUp": "Move this tier up",
+          "moveDown": "Move this tier down",
+          "tierName": "Tier name",
+          "newTier": "Tier {position}",
+          "formats": "Formats",
+          "files": "Files",
+          "anyLayout": "Any",
+          "minBitrate": "Min kbps",
+          "minSeeders": "Min seeders",
+          "channels": "Channels",
+          "anyChannels": "Any",
+          "mono": "Mono",
+          "stereo": "Stereo",
+          "maxSize": "Max MB",
+          "languages": "Languages",
+          "indexers": "Sources",
+          "multiSelectHint": "Choose one or more, or leave it empty to allow any",
+          "multiSelectAny": "Any"
+        },
+        "health": {
+          "ok": "Connected",
+          "failed": "Not reachable",
+          "untested": "Never tested",
+          "disabled": "Disabled",
+          "testedAt": "tested {time}",
+          "failedAt": "failed {time}"
+        },
+        "categoryLabel": "category {category}",
+        "priorityLabel": "priority {priority}",
+        "editClientName": "Edit {name}",
+        "sections": {
+          "connection": "Connection",
+          "search": "What to search",
+          "access": "Access",
+          "availability": "Availability",
+          "behaviour": "Behaviour"
+        },
+        "continueWithType": "Continue",
+        "external": "External",
+        "editorDescription": "Settings for this download client.",
+        "chooseClientType": "Choose a client type",
+        "chooseClientTypeHint": "Pick which program BookOrbit hands torrents to.",
+        "clientTypeDescriptions": {
+          "qbittorrent": "Your own qBittorrent. Needs an address and an account.",
+          "transmission": "Your own Transmission. It has no categories, so the category becomes a subfolder of its download directory.",
+          "deluge": "Your own Deluge. Sign in with the Web UI password; the category needs the Label plugin switched on."
+        },
+        "searchHealth": {
+          "failingOnce": "Last search failed",
+          "failingStreak": "{count} searches failed in a row",
+          "lastSearchAt": "last searched {time}"
+        }
       }
     },
     "nav": {
@@ -2803,10 +3226,14 @@
       "clearSearch": "Clear search",
       "noResults": "No settings match {query}.",
       "shortcutHint": "Press Cmd K to jump to any setting",
+      "status": {
+        "scanning": "Scanning"
+      },
       "groups": {
         "you": "You",
         "library": "Library",
-        "devices": "Devices & sync",
+        "devices": "Devices",
+        "accounts": "Accounts",
         "server": "Server"
       },
       "descriptions": {
@@ -2840,9 +3267,20 @@
         "oidc": "Single sign-on provider, claims, and provisioning.",
         "serverFonts": "Fonts installed for every reader on this server.",
         "bookDock": "Quick actions shown on book pages.",
-        "auditLog": "Who changed what, and when."
+        "auditLog": "Who changed what, and when.",
+        "requests": "Sources, download clients, and what happens to a book once it downloads."
       },
       "backToApp": "Back to library"
+    },
+    "field": {
+      "required": "(required)"
+    },
+    "editor": {
+      "discardTitle": "Discard your changes?",
+      "discardDescription": "This editor has changes that were never saved. Closing it now throws them away.",
+      "discardConfirm": "Discard changes",
+      "moreActions": "More actions",
+      "removeQuestion": "Remove this?"
     }
   },
   "achievements": {
@@ -3033,8 +3471,23 @@
         "email": "Email",
         "administration": "Administration",
         "notifications": "Notifications",
-        "restrictions": "Restrictions"
+        "restrictions": "Restrictions",
+        "libraryBooks": "Library & Books",
+        "bookRequests": "Book Requests",
+        "bookDock": "Book Dock",
+        "devices": "Devices",
+        "readingIntegrations": "Reading Integrations",
+        "emailNotifications": "Email & Notifications",
+        "libraryConfiguration": "Library Configuration",
+        "usersSecurity": "Users & Security",
+        "system": "System"
       },
+      "permissionLevels": {
+        "use": "Use",
+        "manage": "Manage"
+      },
+      "accountRestrictions": "Account Restrictions",
+      "demoRestrictedHint": "Limits this account to the restricted demo experience.",
       "superuserTarget": "Superuser Target",
       "superuserTargetHint": "Content restrictions cannot be applied to superusers.",
       "superuserAccess": {
@@ -3067,6 +3520,8 @@
       "includeGenresHint": "(show only books with these genres)",
       "excludeGenres": "Exclude genres",
       "excludeGenresHint": "(hide books with these genres)",
+      "seeOwnRequestedBooks": "Let this user see books they requested",
+      "seeOwnRequestedBooksHint": "Books that arrived through their own book requests ignore the rules above. Off by default.",
       "searchTagsPlaceholder": "Search tags...",
       "searchGenresPlaceholder": "Search genres...",
       "saving": "Saving...",
@@ -3077,8 +3532,67 @@
         "updateContentFilters": "Failed to update content filters",
         "emailRequired": "Email is required",
         "createSharedAccount": "Failed to create shared account",
-        "createUser": "Failed to create user"
-      }
+        "createUser": "Failed to create user",
+        "nameRequired": "Full name is required",
+        "usernameRequired": "Username is required"
+      },
+      "drawerDescription": "Edit this account's profile, library access, permissions and restrictions.",
+      "createHint": "New accounts hold no permissions until you grant them.",
+      "sectionsLabel": "Account settings",
+      "sections": {
+        "profile": "Profile",
+        "libraries": "Libraries",
+        "permissions": "Permissions",
+        "restrictions": "Restrictions"
+      },
+      "sectionSummary": {
+        "newAccount": "Not created yet",
+        "libraries": "{selected} of {total}",
+        "permissions": "{count, plural, =0 {No permissions} one {1 granted} other {# granted}}",
+        "restrictionsNone": "None",
+        "restrictionsContent": "Content filters",
+        "restrictionsDemo": "Demo restricted",
+        "restrictionsBoth": "Filters and demo mode"
+      },
+      "account": "Account",
+      "status": "Status",
+      "statusHint": "Suspended users cannot sign in or sync devices.",
+      "signInMethod": "Sign-in",
+      "signInMethods": {
+        "password": "Password",
+        "oidc": "Single sign-on",
+        "shared": "Magic link"
+      },
+      "created": "Created",
+      "lockedUntil": "Locked until {time}",
+      "lockedHint": "Too many failed sign-in attempts. Unlock from the users list.",
+      "usernameFixedHint": "Usernames cannot be changed.",
+      "emailHint": "Used for password resets and notifications.",
+      "libraryAccessHint": "Books outside these libraries are invisible to this user.",
+      "selectAll": "Select all",
+      "clearAll": "Clear",
+      "permissionsHint": "What this account is allowed to do. {granted} of {total} granted.",
+      "groupLegend": "{group}: {granted} of {total} granted",
+      "presets": {
+        "label": "Permission preset",
+        "none": "None",
+        "standard": "Standard",
+        "custom": "Custom",
+        "admin": "Admin",
+        "customHint": "This selection does not match a preset."
+      },
+      "filterPermissions": "Filter permissions",
+      "grantedOnly": "Granted only",
+      "noPermissionMatches": "No permissions match that filter.",
+      "clearFilters": "Clear filters",
+      "filteredNotice": "Filtered. Permissions that are hidden keep their current setting.",
+      "contentRestrictionsHint": "Limit which books this user can see, by tag or genre.",
+      "contentRestrictionsAfterCreate": "Content restrictions can be set once the account exists.",
+      "unsavedChanges": "{count, plural, one {1 unsaved change} other {# unsaved changes}}",
+      "libraryBookCount": "{count, plural, =0 {No books} one {1 book} other {# books}}",
+      "dangerZone": "Danger zone",
+      "deleteUserHint": "Permanently removes this account and its reading data. Books in the library are not affected.",
+      "libraryReach": "This account can see {selected} of {total} books."
     },
     "usersPage": {
       "usersTitle": "Users",
@@ -3535,6 +4049,9 @@
       "Collection": "Collection",
       "SmartScope": "Smart scope",
       "BookDockFile": "Book Dock file",
+      "BookRequest": "Book request",
+      "DownloadClient": "Download client",
+      "RequestIndexer": "Indexer",
       "Author": "Author",
       "AppSettings": "Application settings",
       "Genre": "Genre",
@@ -3617,6 +4134,24 @@
       "SmartScopeUpdate": "Update smart scope",
       "SmartScopeDelete": "Delete smart scope",
       "BookDockFinalize": "Finalize Book Dock file",
+      "BookRequestCreate": "Create book request",
+      "BookRequestApprove": "Approve book request",
+      "BookRequestReject": "Reject book request",
+      "BookRequestCancel": "Cancel book request",
+      "BookRequestFulfill": "Fulfil book request",
+      "BookRequestGrab": "Send book request to a download client",
+      "BookRequestImport": "Import a book request download",
+      "BookRequestRemoveDownload": "Remove a book request download from its client",
+      "BookRequestDelete": "Delete book request",
+      "DownloadClientCreate": "Create download client",
+      "DownloadClientUpdate": "Update download client",
+      "DownloadClientDelete": "Delete download client",
+      "RequestIndexerCreate": "Indexer added",
+      "RequestIndexerUpdate": "Indexer updated",
+      "RequestIndexerDelete": "Source deleted",
+      "RequestIndexerPluginInspect": "Indexer plugin inspected",
+      "RequestIndexerPluginInstall": "Indexer plugin installed",
+      "RequestIndexerPluginRemove": "Indexer plugin deleted",
       "AuthorUpdate": "Update author",
       "AuthorDelete": "Delete author",
       "AuthorMerge": "Merge authors",
@@ -5699,9 +6234,718 @@
         "access_denied": "No access",
         "invalid_format": "Bad format",
         "error": "Would fail"
+      },
+      "unit": {
+        "fileCount": "{count, plural, one {# file} other {# files}}",
+        "filesHeading": "{count, plural, one {File in this entry} other {# files in this entry}}",
+        "role": {
+          "content": "Book",
+          "cover": "Cover",
+          "metadata": "Metadata",
+          "supplement": "Extra"
+        }
       }
     }
   },
+  "bookRequests": {
+    "title": "Requests (Beta)",
+    "subtitle": "Ask for books the library does not have yet. This feature is experimental, expect minor bugs.",
+    "tabs": {
+      "search": "Request a book",
+      "mine": "My requests",
+      "all": "All requests"
+    },
+    "mediaKind": {
+      "ebook": "E-book",
+      "audiobook": "Audiobook",
+      "comic": "Comic"
+    },
+    "status": {
+      "pending": "Pending",
+      "approved": "Approved",
+      "rejected": "Rejected",
+      "cancelled": "Cancelled",
+      "searching": "Searching",
+      "grabbed": "Grabbed",
+      "downloading": "Downloading",
+      "importing": "Importing",
+      "needs_review": "Needs review",
+      "available": "Available",
+      "failed": "Failed"
+    },
+    "search": {
+      "titleLabel": "Title",
+      "titlePlaceholder": "Book title",
+      "authorLabel": "Author",
+      "authorPlaceholder": "Author name",
+      "mediaKindLabel": "Format",
+      "libraryLabel": "Add to library",
+      "libraryAny": "Let the approver decide",
+      "libraryDefault": "Default ({library})",
+      "libraryChoose": "Choose a library",
+      "libraryRequired": "Your requests are approved as soon as you make them, so pick the library the book should land in.",
+      "fulfillmentLabel": "Fulfillment",
+      "fulfillmentAutomatic": "Automatic",
+      "fulfillmentChooseRelease": "Choose a release",
+      "folderLabel": "Folder",
+      "languageLabel": "Request language",
+      "languageAny": "Any language",
+      "languageDefaultToggleLabel": "Use this language for new requests",
+      "languageDefaultSetHint": "Ask for this language on every new request",
+      "languageDefaultClearHint": "Stop asking for this language by default",
+      "languageDefaultSaved": "New requests will ask for {language}",
+      "languageDefaultCleared": "New requests will follow your interface language",
+      "languageDefaultFailed": "Could not save your language preference",
+      "submit": "Search",
+      "searching": "Searching providers...",
+      "noResultsTitle": "No matching books found",
+      "noResultsHint": "Try a different title or author.",
+      "noResultsIndexerHint": "Try a different title or author, or search the indexers for \"{title}\" and pick a release yourself.",
+      "freeTextAction": "Search indexers",
+      "manualSearchAction": "Search indexers manually",
+      "yearUnknown": "Year unknown",
+      "sourceCount": "{count, plural, one {# source} other {# sources}}",
+      "sourcesLabel": "Sources: {sources}",
+      "sourcesUnavailable": "Some sources did not respond, so results may be incomplete: {sources}",
+      "identifiers": {
+        "none": "No ISBN",
+        "one": "1 ISBN",
+        "confirmed": "ISBN confirmed",
+        "count": "{count} ISBNs",
+        "sourcesTitle": "Metadata sources",
+        "provider": "Provider",
+        "providerTitle": "Provider title",
+        "isbn": "ISBN",
+        "year": "Year",
+        "language": "Language",
+        "notProvided": "Not provided",
+        "searchScope": "Choose one of {count, plural, one {# ISBN} other {# ISBNs}} to search, or search by title and author.",
+        "searchScopeLimited": "Choose one ISBN to search.",
+        "titleAuthorOnly": "No ISBN was provided. BookOrbit will search once by title and author.",
+        "chooseSearch": "Choose an edition to search",
+        "searchByEdition": "Find a release for an edition",
+        "findRelease": "Find release",
+        "primaryIsbn": "ISBN {isbn}",
+        "primaryTitleAuthor": "Title and author",
+        "recommended": "Recommended",
+        "recommendationHelpLabel": "How BookOrbit chooses the recommended ISBN",
+        "recommendationTitle": "How the recommended search is chosen",
+        "recommendationLanguage": "Prefer the requested language, then an unknown language, before a known mismatch.",
+        "recommendationAgreement": "Prefer an ISBN confirmed by more independent metadata providers.",
+        "recommendationProvider": "Use BookOrbit's stable metadata-provider priority.",
+        "recommendationRelevance": "Use the edition's position in that provider's results.",
+        "recommendationYear": "Prefer an edition year closest to the work's earliest known year.",
+        "recommendationStable": "Use the ISBN itself as the final stable tie-breaker.",
+        "recommendationFallback": "If no valid ISBN is available, BookOrbit searches once by title and author. Choosing an edition from the menu always overrides this recommendation.",
+        "withoutIsbn": "Search by title and author",
+        "action": "Action"
+      },
+      "request": "Request",
+      "download": "Download",
+      "getAutomatically": "Get automatically",
+      "chooseRelease": "Choose release",
+      "joinRequest": "Add me too",
+      "submitted": "Request submitted",
+      "joinedExisting": "Added you to the existing request",
+      "submitFailed": "Could not submit that request",
+      "alreadyInLibrary": "Already in your library",
+      "alreadyRequested": "Already requested by someone else",
+      "alreadyRequestedByYou": "You already requested this",
+      "preferredFormatsLabel": "Preferred formats",
+      "preferredFormatsHint": "Releases in these formats are ranked higher. Other formats are still offered.",
+      "noteLabel": "Note for the approver",
+      "notePlaceholder": "Anything worth knowing about this request",
+      "moreOptions": "More options",
+      "fewerOptions": "Fewer options",
+      "optionsSummary": "{formats} · note added",
+      "formatToggleAria": "Prefer {format}"
+    },
+    "card": {
+      "details": "Details",
+      "mediaKind": "Format",
+      "library": "Library",
+      "requestedBy": "Requested by",
+      "requestedByAt": "{name} on {time}",
+      "alsoWanted": "Also wanted by",
+      "alsoWantedCount": "{count, plural, one {# other person wants this} other {# others want this}}",
+      "moreActions": "More actions for {title}",
+      "settledIn": "Filed in {library}, {time}",
+      "settledAt": "Closed {time}",
+      "dismissedBadge": "Dismissed"
+    },
+    "detail": {
+      "unknownAuthor": "Author unknown",
+      "requestedBy": "Requested by",
+      "requestedOn": "Requested on",
+      "library": "Library",
+      "series": "Series",
+      "isbn": "ISBN",
+      "decidedBy": "Decided by",
+      "requesterNote": "Note from the requester",
+      "decisionNote": "Decision note",
+      "statusReason": "What stopped it",
+      "alsoWanted": "Also wanted by",
+      "decisionNoteLabel": "Note (optional)",
+      "decisionNotePlaceholder": "Explain the decision",
+      "destinationLibraryLabel": "Destination library",
+      "destinationLibraryPlaceholder": "Choose a library",
+      "destinationFolderLabel": "Destination folder",
+      "languageLabel": "Language asked for",
+      "languageAny": "Any language",
+      "destinationRequired": "Approving files the book into a library, so pick one before you approve.",
+      "fulfilTitle": "Close this request",
+      "fulfilHint": "Point the request at the book you added, or at the Book Dock file waiting to be filed.",
+      "bookIdLabel": "Book ID",
+      "bookIdPlaceholder": "e.g. 128",
+      "dockFileIdLabel": "Book Dock file ID",
+      "dockFileIdPlaceholder": "e.g. 42",
+      "backToList": "All requests",
+      "loading": "Loading request...",
+      "transfer": "Transfer",
+      "requestSection": "Request",
+      "decideTitle": "Approve or reject",
+      "fulfilSourceLabel": "What closes this request",
+      "fulfilFromLibrary": "A book in the library",
+      "fulfilFromDock": "A Book Dock file",
+      "fulfilSearchLabel": "Search for the file that closes this request",
+      "fulfilSearchBooks": "Search your library by title or author",
+      "fulfilSearchDock": "Search the Book Dock by file name",
+      "fulfilSearching": "Searching...",
+      "fulfilNoResults": "Nothing matched. Try a different search.",
+      "errors": {
+        "notFound": "That request no longer exists.",
+        "forbidden": "That request belongs to someone else.",
+        "loadFailed": "Could not load that request"
+      },
+      "entityName": "Request"
+    },
+    "actions": {
+      "approve": "Approve",
+      "approveAndNext": "Approve and next",
+      "reject": "Reject",
+      "cancel": "Cancel request",
+      "cancelDownload": "Cancel download",
+      "dismiss": "Dismiss",
+      "restore": "Restore",
+      "delete": "Delete request",
+      "markFulfilled": "Mark fulfilled",
+      "grab": "Find a release",
+      "goToBook": "Go to book",
+      "retryRelease": "Try another release",
+      "leave": "Leave request"
+    },
+    "filters": {
+      "status": "Status",
+      "anyStatus": "Any status",
+      "mediaKind": "Format",
+      "anyMediaKind": "Any format",
+      "requester": "Requester",
+      "anyRequester": "Any requester",
+      "showDismissed": "Show dismissed",
+      "fulfilment": "Fulfilment",
+      "anyFulfilment": "Any fulfilment",
+      "selfServeOnly": "Self-served",
+      "approvedOnly": "Went through approval"
+    },
+    "list": {
+      "loading": "Loading requests...",
+      "emptyMine": "You have not requested any books yet.",
+      "emptyAll": "No book requests yet.",
+      "pagination": "Request pages",
+      "pageOf": "Page {page} of {total}",
+      "emptyHint": "Search for a book and it will show up here once you ask for it."
+    },
+    "toasts": {
+      "approved": "Request approved",
+      "rejected": "Request rejected",
+      "cancelled": "Request cancelled",
+      "downloadCancelled": "Download cancelled",
+      "dismissed": "Hidden from your list",
+      "restored": "Back on your list",
+      "deleted": "Request deleted",
+      "fulfilled": "Request marked fulfilled",
+      "grabbed": "Download started",
+      "downloadRemoved": "Removed from the download client",
+      "bulkApproved": "{count, plural, one {# request approved} other {# requests approved}}",
+      "bulkApprovedPartial": "{done} approved, {failed} could not be",
+      "bulkDismissed": "{count, plural, one {# request hidden} other {# requests hidden}}",
+      "bulkDismissedPartial": "{done} hidden, {failed} could not be",
+      "unitChosen": "Importing the book you chose",
+      "languageChanged": "Request language updated",
+      "left": "You have left this request",
+      "bulkRejected": "{count, plural, one {# request rejected} other {# requests rejected}}",
+      "bulkRejectedPartial": "{done} rejected, {failed} could not be",
+      "importDiscarded": "The imported file was discarded"
+    },
+    "errors": {
+      "loadFailed": "Could not load requests",
+      "approveFailed": "Could not approve that request",
+      "rejectFailed": "Could not reject that request",
+      "cancelFailed": "Could not cancel that request",
+      "cancelDownloadFailed": "Could not cancel that download",
+      "dismissFailed": "Could not hide that request",
+      "restoreFailed": "Could not bring that request back",
+      "deleteFailed": "Could not delete that request",
+      "fulfilFailed": "Could not close that request",
+      "grabFailed": "Could not start that download",
+      "removeDownloadFailed": "Could not remove that torrent from the download client",
+      "bulkApproveFailed": "Could not approve the selected requests",
+      "bulkDismissFailed": "Could not hide the selected requests",
+      "selectUnitFailed": "That book could not be imported.",
+      "languageChangeFailed": "Could not change the request language",
+      "leaveFailed": "That request could not be left",
+      "bulkRejectFailed": "That selection could not be rejected",
+      "discardImportFailed": "That import could not be discarded"
+    },
+    "grab": {
+      "title": "Send to a download client",
+      "subtitle": "Paste a magnet link or upload a .torrent for \"{title}\".",
+      "singleFileNote": "A release can be one book in several formats, an audiobook in parts, or an archive - all of those import as a single book. A release holding several separate books asks you which one to keep.",
+      "magnet": "Magnet link",
+      "torrentFile": ".torrent file",
+      "client": "Download client",
+      "submit": "Send",
+      "errors": {
+        "pickOne": "Provide either a magnet link or a .torrent file, not both",
+        "fileTooLarge": "That file is larger than {limit}, so it is not a .torrent file",
+        "fileUnreadable": "That file could not be read"
+      },
+      "noClientList": "BookOrbit will use its highest-priority enabled download client."
+    },
+    "attempts": {
+      "title": "Earlier attempts",
+      "loading": "Loading earlier attempts...",
+      "loadFailed": "Could not load the earlier attempts",
+      "refused": "Refused, nothing downloaded",
+      "handPicked": "Sent by hand"
+    },
+    "download": {
+      "source": {
+        "automatic": "Grabbed automatically",
+        "manual": "Picked by an approver",
+        "pasted": "Pasted by hand"
+      },
+      "transferred": "{done} of {total}",
+      "transferredUnknown": "{done} downloaded",
+      "progressLabel": "Download progress for {title}",
+      "status": {
+        "queued": "Queued for download",
+        "downloading": "Downloading",
+        "completed": "Download finished",
+        "importing": "Importing into your library",
+        "needs_review": "Waiting for review in the Book Dock",
+        "imported": "Added to your library",
+        "failed": "Download failed"
+      }
+    },
+    "releases": {
+      "title": "Pick a release",
+      "retryTitle": "Try another release",
+      "subtitle": "Ranked across every enabled indexer.",
+      "summaryCount": "{count, plural, one {# release} other {# releases}}",
+      "allFreeleech": "all freeleech",
+      "allLanguage": "all {language}",
+      "allFormat": "all {format}",
+      "allIndexer": "all from {name}",
+      "criteria": {
+        "label": "Active search",
+        "searched": "Searched",
+        "searchedTitleAuthor": "Searched title and author",
+        "nothingFound": "Nothing found for {key}",
+        "changeSearch": "Change search",
+        "closeSearch": "Close",
+        "sources": "Sources",
+        "sourceSearchedIsbn": "searched the ISBN",
+        "sourceSearchedTitleAuthor": "searched the title and author",
+        "sourceNoAdapter": "no matching adapter",
+        "sourceReleases": "{count, plural, one {# release} other {# releases}}",
+        "sourceNone": "no matches",
+        "sourceFiltered": "{count} filtered out",
+        "sourcesSearched": "{count, plural, one {# source searched} other {# sources searched}}",
+        "showEachSource": "Show each",
+        "uncovered": "{count, plural, one {# enabled source does} other {# enabled sources do}} not carry this kind of book",
+        "fixSource": "Fix in settings",
+        "searchInstead": "Search this instead",
+        "keyTried": "tried, nothing found",
+        "keyTriedCount": "tried, {count, plural, one {# release} other {# releases}}",
+        "searchWithoutIsbn": "Title and author",
+        "customIsbnSource": "Custom ISBN",
+        "filteredLocally": "Filtered locally:",
+        "title": "Title",
+        "author": "Author",
+        "additionalAuthors": "Additional authors",
+        "isbn10": "ISBN-10",
+        "isbn13": "ISBN-13",
+        "isbns": "ISBNs",
+        "mediaKind": "Media",
+        "language": "Language",
+        "formats": "Preferred formats",
+        "editFields": "Edit fields",
+        "closeEditor": "Close editor",
+        "authorsEditor": "Authors, one per line",
+        "authorsPlaceholder": "One author per line",
+        "authorsInvalid": "Use no more than 50 authors, with 255 characters or fewer per author.",
+        "languagePlaceholder": "Any language",
+        "formatsPlaceholder": "epub, azw3",
+        "formatsInvalid": "Use no more than 20 formats, with 20 characters or fewer per format.",
+        "isbnSelection": "Search method",
+        "isbnSelectionHint": "Choose one ISBN, title and author, or add a custom ISBN.",
+        "noIsbnSelected": "Title and author, without an ISBN",
+        "customIsbn": "Custom ISBN",
+        "customIsbnPlaceholder": "ISBN-10 or ISBN-13",
+        "addIsbn": "Add ISBN",
+        "invalidIsbn": "{isbn} is not a valid ISBN-10 or ISBN-13.",
+        "titleRequired": "Enter a title to search.",
+        "fixedMedia": "Media remains {media} because it controls compatible sources and the fulfillment path.",
+        "useRequestFields": "Use request fields",
+        "runSearch": "Search with these fields"
+      },
+      "previousFailure": "The last attempt failed: {reason}",
+      "refused": {
+        "sourceRefused": "This source turned down an earlier release",
+        "sourceUnavailable": "This source did not answer",
+        "vipRequired": "Needs a VIP account on this source",
+        "clientRefused": "Your download client refused an earlier release",
+        "clientUnavailable": "Your download client did not answer an earlier release"
+      },
+      "singleFileNote": "A release can be one book in several formats, an audiobook in parts, or an archive - all of those import as a single book. A release holding several separate books asks you which one to keep.",
+      "searching": "Searching indexers...",
+      "refresh": "Search again",
+      "cached": "Showing the last search. Search again for fresh results.",
+      "sortBy": "Sort by",
+      "sort": {
+        "score": "Best match",
+        "seeders": "Seeders",
+        "size": "Size",
+        "bitrate": "Bitrate",
+        "added": "Date added"
+      },
+      "freeleechOnly": "Freeleech only ({count})",
+      "clearFilters": "Clear filters",
+      "filteredEmpty": "No release matches these filters.",
+      "grab": "Download release",
+      "viewFiles": "View files",
+      "hideFiles": "Hide files",
+      "inspectingFiles": "Reading the release file list...",
+      "inspectingShort": "Checking files...",
+      "inspectionFailed": "This release's file list could not be read.",
+      "manifest": {
+        "ready": "{count, plural, one {This release contains # file. The supported book file can be imported.} other {This release contains # files. The supported book file can be imported.}}",
+        "noSupported": "This release has no directly supported book file, so it cannot be sent.",
+        "contentsUnknown": "This release is packaged as an archive (RAR, ZIP or 7z). BookOrbit will extract it after downloading, so its contents are not known yet.",
+        "multipleBooks": "This release contains {count} separate books. After it downloads you will be asked which one to import.",
+        "multiPartBook": "{count, plural, one {This release is one book made of # file.} other {This release is one book made of # files, imported together as a single book.}}",
+        "metadataUnavailable": "This is a magnet link. Its file list is unavailable until a torrent client fetches the metadata from the swarm.",
+        "bookFile": "Book file",
+        "extraFile": "Extra",
+        "truncated": "Showing {shown} of {total} files.",
+        "untitledUnit": "Untitled",
+        "unitFiles": "{count, plural, one {# file} other {# files}}",
+        "unitsTruncated": "Showing {shown} of {total} books.",
+        "ignored": "{count, plural, one {Ignoring # sample or padding file.} other {Ignoring # sample and padding files.}}",
+        "mediaKind": {
+          "ebook": "E-book",
+          "audiobook": "Audiobook",
+          "comic": "Comic"
+        }
+      },
+      "manual": "Paste a link instead",
+      "indexer": "Indexer",
+      "size": "Size",
+      "seeders": "Seeders",
+      "language": "Language",
+      "seederCountPlural": "{count, plural, one {# seeder} other {# seeders}}",
+      "seederCountUnknown": "Seeders unknown",
+      "format": "Format",
+      "files": "Files",
+      "fileLayout": {
+        "single": "One book file",
+        "multi": "Several files"
+      },
+      "fileCount": "{count, plural, one {# file} other {# files}}",
+      "audio": "Audio",
+      "bitrateAtLeast": "{rate}k+",
+      "channels": {
+        "mono": "Mono",
+        "stereo": "Stereo"
+      },
+      "chapterCountPlural": "{count, plural, one {# chapter} other {# chapters}}",
+      "durationHm": "{hours}h {minutes}m",
+      "durationM": "{minutes}m",
+      "freeleech": "Freeleech",
+      "vipOnly": "VIP only",
+      "hideVipOnly": "Hide VIP only",
+      "noneMatchedProfile": "No release here matches your profile for this medium, so none of them will be downloaded automatically. You can still send one by hand. To widen it, add a tier with fewer conditions below the ones you have.",
+      "alreadyGrabbed": "Already snatched",
+      "freeleechLabel": "Freeleech",
+      "published": "Published",
+      "scoreLabel": "Match score {score} out of 100",
+      "scoreBreakdown": "How this release scored",
+      "whyThisScore": "Why this score",
+      "failures": {
+        "unauthorized": "sign-in expired",
+        "throttled": "rate limited",
+        "timeout": "timed out",
+        "unreachable": "unreachable",
+        "unsupportedMedium": "does not carry this kind of book",
+        "error": "search failed"
+      },
+      "reasons": {
+        "isbnMatch": "ISBN matches",
+        "titleMatch": "Title match",
+        "authorMatch": "Title and author match",
+        "preferredFormat": "Preferred format {detail}",
+        "knownFormat": "Format {detail}",
+        "unknownFormat": "Format not stated",
+        "expectedSize": "Plausible size",
+        "suspiciousSize": "Unlikely size {detail}",
+        "seeders": "{detail} seeders",
+        "freeleech": "Freeleech",
+        "likelySeveralBooks": "{detail} files, may be several books"
+      },
+      "errors": {
+        "loadFailed": "Could not search for releases"
+      },
+      "backToRequest": "Back to the request",
+      "bestMatch": "Best match",
+      "flags": "Flags",
+      "score": "Score",
+      "release": "Release",
+      "send": "Send",
+      "tableCaption": "Every other release, ranked",
+      "onlyBestMatch": "That is the only release that matched.",
+      "tiedWithBest": "{count, plural, one {# other release scored the same} other {# other releases scored the same}}",
+      "inspectionFailedHint": "It was not sent to a download client. Try again, or use Paste a link instead.",
+      "mediumUncovered": "No source carries this kind of book.",
+      "mediumUncoveredHint": "None of your enabled indexers cover it. Add one that does, or paste a link yourself.",
+      "noSourcesConfigured": "No search sources are set up yet.",
+      "noSourcesEnabled": "Every search source is switched off.",
+      "noSourcesConfiguredHint": "Nothing was searched. Add an indexer or install a source plugin, or paste a link to a release yourself.",
+      "noSourcesEnabledHint": "Nothing was searched. Switch one back on, or paste a link to a release yourself.",
+      "noSourcesAskAdmin": "Nothing was searched. Ask an administrator to set up a search source, or paste a link to a release yourself.",
+      "addSource": "Add a source",
+      "reviewSources": "Review sources",
+      "protocol": {
+        "torrent": "Torrent",
+        "direct": "Direct download",
+        "directPill": "Direct"
+      }
+    },
+    "seed": {
+      "title": "Download client",
+      "automated": "BookOrbit picked this release automatically.",
+      "loading": "Reading the download client...",
+      "loadFailed": "Could not reach the download client for this request.",
+      "notInClient": "The download client no longer has this torrent.",
+      "state": "Status",
+      "seeding": "Seeding",
+      "stopped": "Stopped",
+      "client": "Client",
+      "ratio": "Ratio",
+      "time": "Seeding time",
+      "uploaded": "Uploaded",
+      "hours": "{value} h",
+      "ofGoal": "{value} of {goal}",
+      "deleteFiles": "Also delete the downloaded files",
+      "remove": "Remove from client",
+      "removeHint": "BookOrbit never stops a seed on its own. The imported book stays in your library either way.",
+      "confirm": {
+        "title": "Remove this torrent?",
+        "description": "The torrent stops seeding. The downloaded files stay on disk.",
+        "descriptionWithFiles": "The torrent stops seeding and its downloaded files are deleted. The imported book stays in your library."
+      }
+    },
+    "pipeline": {
+      "label": "Progress",
+      "steps": {
+        "asked": "Asked",
+        "approved": "Approved",
+        "release": "Release found",
+        "downloading": "Downloading",
+        "filed": "Filed"
+      },
+      "summary": {
+        "waiting": "Waiting at: {step}",
+        "progress": "In progress at: {step}",
+        "done": "Filed in your library",
+        "failed": "Stopped by a failure at: {step}",
+        "stopped": "Stopped at: {step}"
+      }
+    },
+    "density": {
+      "label": "List density",
+      "comfortable": "Comfortable",
+      "compact": "Compact"
+    },
+    "drawer": {
+      "label": "Request detail",
+      "description": "The request, the stage it has reached and the decisions open on it.",
+      "previous": "Previous request",
+      "next": "Next request",
+      "position": "{position} of {total}",
+      "shortcuts": "J / K to move, A to approve, Esc to close"
+    },
+    "table": {
+      "caption": "Book requests, with the stage each one has reached",
+      "cover": "Cover",
+      "title": "Title",
+      "mediaKind": "Format",
+      "requestedBy": "Requested by",
+      "age": "Age",
+      "state": "State",
+      "outcome": "Outcome",
+      "actions": "Actions",
+      "selectAll": "Select every request waiting for approval",
+      "selectRow": "Select {title}",
+      "toggleDetail": "Show what happened to {title}",
+      "release": "Release",
+      "decidedBy": "Decided by",
+      "decisionNote": "Decision note",
+      "requestNote": "Request note",
+      "openDetail": "Open full detail"
+    },
+    "confirm": {
+      "cancelDownloadTitle": "Cancel this download?",
+      "cancelDownloadDescription": "The active transfer stops and the request stays open so another release can be chosen. Torrent data is kept; partial direct-download staging is deleted.",
+      "cancelTitle": "Stop this request?",
+      "cancelDescription": "It moves to cancelled. Nobody waiting on it will get the book.",
+      "cancelDescriptionWithDownload": "The active transfer is stopped. Data in the download client is kept; partial direct-download staging is deleted.",
+      "deleteTitle": "Delete this request?",
+      "deleteDescription": "The request and the record of who asked for it go for good, for everyone. Any torrent still seeding is removed from the download client with its files kept. Direct-download staging is cleaned automatically. Dismissing the request instead only hides it from your own list.",
+      "discardImportTitle": "Discard this import?",
+      "discardImportDescription": "The downloaded files are removed from the Book Dock and the request is marked failed. The torrent keeps seeding; stop it separately if you want it gone.",
+      "leaveTitle": "Leave this request?",
+      "leaveDescription": "You stop following it and stop being notified about it. Whoever asked for it keeps their request.",
+      "rejectDescription": "Everyone waiting on these requests is told they were turned down. Nothing is downloaded."
+    },
+    "outcome": {
+      "filedIn": "Filed in {library} {time}",
+      "filed": "Filed {time}",
+      "rejected": "Rejected {time}",
+      "cancelled": "Cancelled {time}",
+      "awaitingApproval": "Waiting for approval",
+      "awaitingReview": "Waiting for a manual check",
+      "failedUnknown": "Stopped without a reason from the indexer",
+      "atStage": {
+        "asked": "Just asked for",
+        "approved": "Approved, not searched yet",
+        "release": "Looking for a release",
+        "downloading": "Downloading the release",
+        "filed": "Filing into the library"
+      }
+    },
+    "handback": {
+      "AUTOMATION_DISABLED": "Automatic grabbing is off, so this one needs a release picked by hand",
+      "NO_DESTINATION": "This request has no destination library, so there is nowhere to file the book",
+      "ATTEMPT_LIMIT": "Automatic fulfilment gave up after {attempts} attempts",
+      "SEARCH_FAILED": "Could not search for a release: {detail}",
+      "NO_SOURCES_CONFIGURED": "No search sources are set up, so nothing was searched for this request",
+      "NO_SOURCES_ENABLED": "Every search source is switched off, so nothing was searched for this request",
+      "MEDIUM_UNCOVERED": "No enabled search source carries this kind of book, so nothing was searched for this request",
+      "PROFILE_EXCLUDED_ALL": "No release matched the profile for this medium, so this one needs a release picked by hand",
+      "ALL_TRIED": "Every release good enough to grab has already been tried, so this one needs a release picked by hand",
+      "BELOW_SCORE_FLOOR": "No release scored {floor} or better, so this one needs a release picked by hand",
+      "ALL_BLOCKED": "Every release good enough to grab was ruled out by an earlier failure, so this one needs a release picked by hand",
+      "ABANDONED": "No release was picked, so this download was not started"
+    },
+    "submitError": {
+      "SUBMIT_TITLE_REQUIRED": "Give the book a title before requesting it",
+      "SUBMIT_SELF_FULFIL_FORBIDDEN": "You are not allowed to fulfil your own requests",
+      "SUBMIT_LIBRARY_FORBIDDEN": "You do not have access to that library",
+      "SUBMIT_FOLDER_NEEDS_LIBRARY": "Pick a destination library before picking a folder",
+      "SUBMIT_FOLDER_NOT_IN_LIBRARY": "That folder is not part of the destination library",
+      "SUBMIT_DEFAULT_LIBRARY_UNREACHABLE": "Pick a destination library you can reach: this instance's default is not one of yours",
+      "SUBMIT_DESTINATION_REQUIRED": "Your requests are approved as soon as you make them, so pick the library the book should land in",
+      "SUBMIT_SELF_SERVE_LIMIT": "Finish or cancel some downloads first: you can have {limit} in flight at once",
+      "SUBMIT_ON_BEHALF_FORBIDDEN": "You are not allowed to request books for other people",
+      "SUBMIT_ON_BEHALF_UNKNOWN_USER": "That user cannot have a book request made for them"
+    },
+    "actionError": {
+      "BOOK_REQUEST_NOT_PENDING": "Only a pending request supports this action; this request is currently {status}",
+      "BOOK_REQUEST_NOT_CANCELLABLE": "A request that is {status} can no longer be cancelled",
+      "BOOK_REQUEST_DESTINATION_REQUIRED": "Pick a destination library before approving this request",
+      "BOOK_REQUEST_ACTION_FORBIDDEN": "You are not allowed to {action} this request",
+      "BOOK_REQUEST_STALE_TRANSITION": "This request changed while the action was being applied. It is now {status}."
+    },
+    "bulk": {
+      "selected": "{count, plural, one {# request selected} other {# requests selected}}",
+      "approveSelected": "{count, plural, one {Approve # request} other {Approve all #}}",
+      "clear": "Clear",
+      "dismissSelected": "{count, plural, one {Hide # request} other {Hide all #}}",
+      "rejectSelected": "{count, plural, one {Reject # request} other {Reject all #}}",
+      "rejectNoteLabel": "Reason (optional)",
+      "rejectNotePlaceholder": "Why these are being turned down",
+      "rejectTitle": "Reject {count, plural, one {# request} other {# requests}}?",
+      "rejectConfirm": "Reject"
+    },
+    "chooser": {
+      "title": "Choose which book to import",
+      "hint": "This release turned out to contain {count} separate books. The download is finished; pick the one that was requested and the rest are left behind.",
+      "untitled": "Untitled",
+      "files": "{count, plural, one {# file} other {# files}}",
+      "import": "Import this book",
+      "mediaKind": {
+        "ebook": "E-book",
+        "audiobook": "Audiobook",
+        "comic": "Comic"
+      }
+    },
+    "review": {
+      "title": "Why this is waiting",
+      "scoreShort": "The imported file scored {score} against this request, below the {threshold} needed to file it automatically.",
+      "scoreClears": "The imported file scored {score}, which clears the {threshold} needed to file it automatically.",
+      "verificationOff": "Import checking is off, so this file was never scored against the request.",
+      "reason": {
+        "isbn_match": "Its ISBN is the one that was requested.",
+        "above_threshold": "It looks like the book that was asked for.",
+        "below_threshold": "Check the fields below and decide whether it is the right book.",
+        "author_mismatch": "The title is close, but the author is somebody else.",
+        "no_title": "The file carries no readable title, so there was nothing to compare."
+      },
+      "field": {
+        "title": "Title",
+        "authors": "Author",
+        "isbn13": "ISBN"
+      },
+      "verdict": {
+        "match": "Matches",
+        "mismatch": "Does not match",
+        "unknown": "Not compared"
+      },
+      "requested": "Requested",
+      "imported": "Imported",
+      "absent": "Neither the request nor the file has one.",
+      "notSet": "Not set",
+      "filesTitle": "What landed",
+      "fileCount": "{count, plural, one {# file} other {# files}}",
+      "role": {
+        "cover": "Cover",
+        "metadata": "Metadata",
+        "supplement": "Extra"
+      },
+      "fileAnyway": "File it anyway",
+      "fileAnywayHint": "Files this into the destination library and marks the request available, exactly as a passing score would have.",
+      "noDestination": "This request has no destination library with a folder in it, so there is nowhere to file the book yet.",
+      "openDock": "Open the Book Dock",
+      "missingEntry": "The file this request was held over is no longer in the Book Dock. It was filed or discarded by hand, so there is nothing left here to review.",
+      "missingEntryNext": "If the book is already in your library, close this request against it below. If it is not, cancel the request and search for another release.",
+      "filed": "Filed into your library.",
+      "fileFailed": "Could not file this import",
+      "discard": "Discard this import",
+      "discardHint": "Use this when the release turned out to be the wrong book. The files are removed from the Book Dock and the request is marked failed."
+    },
+    "sources": {
+      "noneConfigured": "No search sources are set up.",
+      "allDisabled": "Every search source is switched off.",
+      "noneConfiguredHint": "Requests can be filed, but nothing will be searched for them until you add an indexer or install a source plugin.",
+      "allDisabledHint": "Requests can be filed, but nothing will be searched for them until you switch one back on.",
+      "askAdmin": "Requests can be filed, but nothing will be searched for them until an administrator sets one up.",
+      "addSource": "Add a source",
+      "reviewSources": "Review sources"
+    },
+    "selfServeBadge": "Self-served",
+    "selfServeBadgeHint": "Downloaded directly by the requester, with no approval step"
+  },
   "collection": {
     "visibleToAll": "Visible to all users",
     "visibleToAllHint": "Every user can see this collection, but only you can change its books",
@@ -5814,6 +7058,10 @@
       "newCollection": "New Collection",
       "noCollections": "No collections yet",
       "newReleaseNotes": "New release notes available",
+      "requestBadge": {
+        "allActive": "{count, plural, one {# active request across all users} other {# active requests across all users}}",
+        "mineActive": "{count, plural, one {# active request of yours} other {# active requests of yours}}"
+      },
       "support": "Support BookOrbit",
       "supportAria": "Support BookOrbit on Ko-fi",
       "sectionHeader": {
@@ -5970,7 +7218,13 @@
       },
       "chipInput": {
         "typeAndEnter": "Type and press Enter to add",
-        "pressEnter": "Press Enter to add"
+        "pressEnter": "Press Enter to add",
+        "remove": "Remove {value}"
+      },
+      "tokenSelect": {
+        "remove": "Remove {value}",
+        "noMatches": "No matches",
+        "showOptions": "Show options"
       }
     },
     "entityIndex": {
@@ -7325,6 +8579,10 @@
         "achievements": {
           "label": "Achievements",
           "description": "When you unlock a new reading achievement."
+        },
+        "bookRequests": {
+          "label": "Book requests",
+          "description": "When a book request is submitted, decided, or the book becomes available."
         }
       }
     }
@@ -8706,6 +9964,7 @@
     "system": {
       "file-naming": "File Naming",
       "book-dock": "Book Dock",
+      "requests": "Requests",
       "maintenance": "Maintenance",
       "audit-log": "Audit Log"
     },
@@ -8717,6 +9976,9 @@
     },
     "smartScopes": "Smart Scopes",
     "collections": "Collections",
-    "missingResources": "Missing Resources"
+    "missingResources": "Missing Resources",
+    "bookRequests": "Requests",
+    "bookRequestDetail": "Request",
+    "bookRequestReleases": "Pick a release"
   }
 }
diff --git a/client/src/router/index.ts b/client/src/router/index.ts
index 49bfc4c35..3c19d1af9 100644
--- a/client/src/router/index.ts
+++ b/client/src/router/index.ts
@@ -95,6 +95,7 @@ const ADMIN_ROUTES: Record<AdminTab, string> = {
 const SYSTEM_ROUTES: Record<SystemTab, string> = {
   'file-naming': 'settings-file-naming',
   'book-dock': 'settings-admin-book-dock',
+  requests: 'settings-admin-requests',
   maintenance: 'settings-maintenance',
   'audit-log': 'settings-admin-audit-log',
 }
@@ -443,6 +444,13 @@ export const routes: RouteRecordRaw[] = [
             props: { embedded: true },
             meta: { maxWidth: 'max-w-3xl', title: () => t('titles.system.book-dock') },
           },
+          {
+            path: 'admin/requests',
+            name: 'settings-admin-requests',
+            component: () => import('@/features/settings/RequestsSettings.vue'),
+            props: { embedded: true },
+            meta: { maxWidth: 'max-w-5xl', title: () => t('titles.system.requests') },
+          },
           {
             path: 'admin/audit-log',
             name: 'settings-admin-audit-log',
@@ -485,6 +493,28 @@ export const routes: RouteRecordRaw[] = [
         component: () => import('@/views/BookDockView.vue'),
         meta: { title: () => t('titles.bookDock') },
       },
+      // A request opens as a drawer over the list rather than as its own page, but it keeps its
+      // own URL: these are children so a hard load of /requests/:id renders the list underneath.
+      {
+        path: '/requests',
+        name: 'book-requests',
+        component: () => import('@/features/book-requests/BookRequestsPage.vue'),
+        meta: { title: () => t('titles.bookRequests') },
+        children: [
+          {
+            path: ':id',
+            name: 'book-request-detail',
+            component: () => import('@/features/book-requests/components/RequestDetailPanel.vue'),
+            meta: { title: () => t('titles.bookRequestDetail') },
+          },
+          {
+            path: ':id/releases',
+            name: 'book-request-releases',
+            component: () => import('@/features/book-requests/components/ReleasePickerPanel.vue'),
+            meta: { title: () => t('titles.bookRequestReleases') },
+          },
+        ],
+      },
       {
         path: '/whats-new',
         name: 'whats-new',
diff --git a/docs/AUDIOBOOKSHELF_MIGRATION.md b/docs/AUDIOBOOKSHELF_MIGRATION.md
deleted file mode 100644
index f4fe61eb5..000000000
--- a/docs/AUDIOBOOKSHELF_MIGRATION.md
+++ /dev/null
@@ -1,218 +0,0 @@
-# Migrating from Audiobookshelf
-
-BookOrbit can perform a one-time import of reading state from Audiobookshelf. The migration matches
-Audiobookshelf books to books that already exist in BookOrbit, maps Audiobookshelf users to existing
-BookOrbit users, and imports the selected users' supported state.
-
-This is an import, not a continuous synchronization. Keep both systems backed up until you have
-reviewed the migration report and verified the imported state.
-
-## Compatibility
-
-Compatibility is declared only for versions covered by the disposable end-to-end suite.
-
-| Mode     | Verified Audiobookshelf version | Verification                                                 |
-| -------- | ------------------------------- | ------------------------------------------------------------ |
-| Live API | 2.36.0                          | Full import, repeat-run idempotency, and database integrity  |
-| Backup   | Backup produced by 2.36.0       | Live/backup normalization parity and dry-run planning parity |
-
-Other Audiobookshelf versions may work, but they are not currently declared compatible. A missing
-optional backup table produces a warning and omits that domain. A missing required table or column
-causes validation to fail instead of importing incomplete or misidentified state.
-
-Maintainers can exercise another image with:
-
-```bash
-ABS_E2E_IMAGE=ghcr.io/advplyr/audiobookshelf:<version> pnpm e2e:run -- migration-audiobookshelf
-```
-
-Do not broaden the compatibility declaration until both live API behavior and a backup produced by
-that version pass the suite.
-
-## Requirements
-
-- The BookOrbit operator must have the `Manage App Settings` permission.
-- Live API mode requires an Audiobookshelf access token for an `admin` or `root` user. Tokens for
-  regular and guest users are rejected.
-- Target books must already exist in a scanned BookOrbit library. Unmatched source books are reported
-  and are not created automatically.
-- Target BookOrbit user accounts must already exist. Audiobookshelf users are mapping candidates only;
-  accounts, passwords, roles, and permissions are not copied.
-- Configure `MIGRATION_ENCRYPTION_KEY` with a persistent 64-character hexadecimal key before saving a
-  live API source. Without a valid key, saved source credentials are not encrypted at rest. Generate a
-  key with `openssl rand -hex 32` and retain it for as long as the saved source is needed.
-
-## Supported data
-
-The first compatibility declaration covers:
-
-- book identity and metadata used by the migration, including title, subtitle, authors, narrators,
-  first series membership, ISBN, ASIN, publisher, year, language, description, genres, and tags;
-- explicit user mapping to existing BookOrbit accounts;
-- read, reading, and unread status from real Audiobookshelf progress records, including available start,
-  finish, and update dates;
-- multi-file audiobook position, resolved to the correct target audio file and file-local second;
-- EPUB percentage and EPUB CFI position;
-- separate audio and EPUB positions for mixed-format books;
-- audio bookmarks with their absolute book position, title, and creation time;
-- valid listening sessions; and
-- matching by ISBN, ASIN, mapped file path, then title and author.
-
-The migration reports unmatched books, ambiguous matches, malformed source records, and state owned by
-unmapped users. It does not assign that state to another user.
-
-Metadata is applied as an overlay per field. A field Audiobookshelf actually carries replaces the value
-on the matched BookOrbit book; a field Audiobookshelf leaves empty is skipped rather than written as
-empty. An Audiobookshelf book with no publisher therefore leaves an existing BookOrbit publisher intact.
-An explicit value is still an overlay: `abridged: false` and a zero duration are written.
-
-Author sort names come from the `Last, First` form Audiobookshelf stores. A backup carries that per
-author. The live API only exposes one joined sort string per book, so it is applied when the book has
-exactly one author, and other books fall back to sorting on the display name.
-
-## Deferred and unavailable data
-
-The following data is not imported:
-
-- Audiobookshelf podcasts and podcast sessions;
-- user account creation, credentials, roles, or permissions;
-- annotations, because Audiobookshelf does not expose an equivalent annotation domain;
-- playlists and Audiobookshelf collections;
-- covers from the live API or artwork from backups;
-- PDF or comic reading locations that cannot be represented as EPUB CFIs;
-- reader preferences, playback devices, server settings, or Audiobookshelf permissions; and
-- continuous or two-way synchronization after the migration.
-
-## Live API mode
-
-Use live mode when BookOrbit can reach the running Audiobookshelf server.
-
-1. Enter a clean `http` or `https` origin such as `https://audiobookshelf.example.com`. Do not include
-   credentials, a path, query parameters, or a fragment.
-2. Enter an access token belonging to an Audiobookshelf `admin` or `root` user.
-3. Enable private-network access only when the Audiobookshelf hostname resolves to a trusted local or
-   private address.
-4. Test the connection, save the source, and validate it before creating the dry run.
-
-BookOrbit resolves and pins the destination address for each request, rejects redirects, applies request
-timeouts and response-size limits, and rejects private or local destinations unless private-network
-access is explicitly enabled. Use HTTPS when traffic crosses an untrusted network. In Docker,
-`127.0.0.1` refers to the BookOrbit container itself; use a hostname or address reachable from that
-container.
-
-The API token is redacted from migration API responses. It must never be placed in logs, screenshots,
-reports, or issue comments.
-
-## Backup mode
-
-Use backup mode when BookOrbit should read an Audiobookshelf `.audiobookshelf` backup from local storage.
-
-1. Create a fresh backup with Audiobookshelf's backup feature.
-2. Create a dedicated host directory for migration inputs and copy the backup into it.
-3. Mount that directory read-only into the BookOrbit container. For example, add this entry to the app
-   service's `volumes` list in `docker-compose.yml`:
-
-   ```yaml
-   - /host/path/to/migration-imports:/imports:ro
-   ```
-
-4. Set `MIGRATION_IMPORT_ROOT=/imports` in BookOrbit's `.env` and restart BookOrbit.
-5. In the migration source form, enter the absolute container path, such as
-   `/imports/audiobookshelf/backup.audiobookshelf` if that path exists under the mounted root.
-
-`MIGRATION_IMPORT_ROOT` is a server-side authorization boundary. It must be an absolute path and cannot
-be supplied through the migration request. BookOrbit resolves the configured root and backup path,
-rejects paths and symlink targets outside the root, detects path swaps, requires a regular file, and
-reads the archive through the already-authorized file handle. Use a dedicated read-only mount rather
-than a broad filesystem root.
-
-A compatible backup must be a ZIP archive containing exactly one `details` entry and one
-`absdatabase.sqlite` entry. Archive entry counts and extracted sizes are bounded. BookOrbit copies only
-the SQLite database to an owner-only temporary file and opens it read-only with SQLite defensive mode.
-
-## Book and user mapping
-
-Audiobookshelf stores paths as seen by the Audiobookshelf process. BookOrbit stores paths as seen by the
-BookOrbit process. Add a prefix mapping when those paths differ. For example:
-
-| Source prefix | Target prefix       |
-| ------------- | ------------------- |
-| `/audiobooks` | `/books/audiobooks` |
-
-Mappings replace only the matching leading prefix. More specific prefixes take priority. Save and
-validate the mappings before starting the live run. Path mapping is one matching strategy; ISBN, ASIN,
-and title/author matching can still match books whose paths differ.
-
-Review every suggested user mapping. Users left unmapped remain visible in the mapping workflow and
-migration report, but their state is not imported. Do not map multiple people to one BookOrbit user
-merely to clear a warning.
-
-## Recommended workflow
-
-1. Back up BookOrbit and Audiobookshelf.
-2. Scan the target BookOrbit libraries and confirm the target book files are present.
-3. Create and test an Audiobookshelf source in live API or backup mode.
-4. Save the source and validate its capabilities.
-5. Map source users to existing BookOrbit users.
-6. Add and validate path mappings where mount paths differ.
-7. Run a dry run and review matches, ambiguities, unmatched books, unmapped users, warnings, and per-user
-   totals.
-8. Resolve ambiguous matches and rerun the dry run until the plan is current.
-9. Start the live migration and export the final report.
-10. Verify several audiobook, EPUB, mixed-format, finished, and bookmarked examples before retiring the
-    Audiobookshelf instance.
-
-Repeating the same completed plan is designed to be idempotent, but it is not a substitute for reviewing
-the first report and keeping backups.
-
-## Troubleshooting
-
-### The live server is unreachable
-
-- Confirm the URL contains only an `http` or `https` origin and does not redirect.
-- Test DNS and network reachability from the BookOrbit server or container, not only from a browser.
-- In Docker, do not use `127.0.0.1` for a service running in another container or on the host.
-- Confirm a reverse proxy permits the Audiobookshelf API endpoints and does not redirect them to a login
-  page.
-- A request times out after the bounded connector timeout. Investigate routing, DNS, firewall, or proxy
-  behavior before retrying.
-
-### Audiobookshelf privileges are insufficient
-
-The access token must authorize as an Audiobookshelf `admin` or `root` user. Create or select an account
-with that type, obtain its token, and retest the source. BookOrbit intentionally rejects tokens that can
-read only the current user's state because a complete migration must enumerate users and their state.
-
-### A private or local address is rejected
-
-Private-network access is off by default. Enable it only when the configured Audiobookshelf destination
-is trusted and intentionally hosted on a private or local network. BookOrbit validates every resolved
-address and pins the selected address for the request to limit DNS rebinding.
-
-### A backup path is missing or rejected
-
-- Confirm `MIGRATION_IMPORT_ROOT` is set in the BookOrbit process and is absolute.
-- Use the path inside the BookOrbit container, not the host path or a browser workstation path.
-- Confirm the backup exists under the canonical import root and is readable by the BookOrbit process.
-- Prefer a direct regular-file path. A symlink target that resolves outside the root is rejected.
-- If the container uses a read-only root filesystem, mount the import directory explicitly as shown
-  above; BookOrbit uses its writable temporary directory for bounded extraction.
-
-### A backup is incompatible
-
-Create a fresh backup with the verified Audiobookshelf version and retry. The backup must include valid
-`details` and `absdatabase.sqlite` entries and the required users, library items, books, and media
-progress schema. Missing optional author, series, listening-session, or library-folder tables are
-reported as warnings. Missing required schema fails validation.
-
-Do not manually modify the archive or SQLite schema to bypass validation. Preserve the original backup
-and report the Audiobookshelf version and sanitized validation message when requesting compatibility
-support.
-
-### Books or users remain unresolved
-
-- Confirm the target library scan completed before the dry run.
-- Add a path-prefix mapping if the two applications see different mount paths.
-- Check ISBN and ASIN metadata on both sides.
-- Resolve ambiguous book matches explicitly in the dry-run workflow.
-- Create the target BookOrbit user before mapping. The migration does not create accounts.
diff --git a/docs/BOOK_REQUESTS.md b/docs/BOOK_REQUESTS.md
new file mode 100644
index 000000000..3f78dab5d
--- /dev/null
+++ b/docs/BOOK_REQUESTS.md
@@ -0,0 +1,169 @@
+# Book Requests
+
+Book requests let readers ask for a book BookOrbit does not have. An approver decides on the
+request, a release is picked from the sources you configured, a download client fetches it, and the
+result is filed into a library.
+
+Everything in this guide is operator configuration. Nothing here is on by default, and a fresh
+install has no sources, no download clients and no automation.
+
+## What BookOrbit ships
+
+**BookOrbit ships no sources.** There is no bundled tracker, no default indexer, and no list of
+sites to pick from. One adapter type is compiled in, `torznab`, and it is a protocol rather than a
+source: it needs an address you supply, usually a Prowlarr or Jackett instance you run. Everything
+else is an indexer plugin you install yourself.
+
+Which sources you point BookOrbit at, and what you search for and download through them, is your
+decision and your responsibility. BookOrbit does not provide or endorse indexer sources. Its URL,
+file, and path safety checks still apply to every configured source.
+
+## Permissions
+
+| Permission                  | What it allows                                              |
+| --------------------------- | ----------------------------------------------------------- |
+| `book_request_access`       | File a request, see your own, join somebody else's          |
+| `manage_book_requests`      | Approve, reject, and drive fulfilment on every request      |
+| `book_request_auto_approve` | Your own requests skip the approval queue                   |
+| `book_request_self_fulfill` | Pick the release and download it yourself, with no approver |
+
+The last three each imply `book_request_access`; granting one on its own would produce an account
+that can approve requests but has no page to see them on.
+
+Configuring sources, download clients and automation is separate again, and needs
+`manage_app_settings`. Installing an indexer plugin needs a superuser: a plugin runs inside the
+server process with the server's reach.
+
+## Before anything can be saved: the encryption key
+
+Set `BOOK_REQUEST_ENCRYPTION_KEY` before configuring a download client or an indexer:
+
+```bash
+openssl rand -hex 32
+```
+
+It must be a 64-character hex string. Unlike `MIGRATION_ENCRYPTION_KEY` and the email key, this one
+is not optional in practice: a tracker API key or seedbox password is **refused rather than stored
+in the clear** when the key is missing, so the settings form will not save.
+
+Rotating or removing the key leaves stored credentials unreadable. They are not silently dropped:
+the affected source refuses to be used and says why, so you can re-enter the credential rather than
+discover the loss during a download.
+
+## Sources
+
+Settings > System > Requests > Sources.
+
+Two kinds of row, added two ways, identical once they exist:
+
+- **Torznab**: an address plus an API key. This is how you attach a Prowlarr or Jackett instance,
+  and one such instance can expose many trackers behind one row per tracker.
+- **Plugins**: a single `.mjs` file installed through the page, loaded at boot from
+  `<APP_DATA_PATH>/plugins/indexers/<name>/index.mjs`. Plugins live in their own repositories and
+  are not distributed with BookOrbit.
+
+Per source you can set the medium it is searched for, its categories, whether it is handed an ISBN
+when the request has one, and a colour that marks its releases in the release picker.
+
+Private network addresses are refused unless you opt the row in with **Allow private address**. A
+self-hosted Prowlarr on the LAN is the common reason to; a public tracker resolving to a private
+address is not.
+
+Two health facts are shown per row, and they answer different questions:
+
+- **Connected / Not reachable** is the last time you pressed **Test**, which makes a capabilities
+  call.
+- **Searches failing** is how the last real searches went. A source can be reachable and still
+  refuse every search, and the badge counts consecutive failures so one blip reads differently
+  from a source that has been broken for a week.
+
+## Download clients
+
+Settings > System > Requests > Download clients. qBittorrent, Transmission and Deluge are
+supported.
+
+Each client needs at least one **path mapping**, including when BookOrbit and the client run on the
+same host. A mapping translates the download directory the client reports into a path BookOrbit can
+open, and it is also the root the import is allowed to read out of. On a single host that mapping
+is an identity, `/downloads -> /downloads`; it still has to be stated, because "the same path" and
+"no path stated" are different things and only one of them is safe to import from.
+
+Hardlinking from the download directory into the library is what keeps a torrent seeding after the
+book is filed. The mapping form can test whether a hardlink actually works between the two paths,
+which is worth doing before the first grab: a mapping across filesystems copies instead, silently
+doubling the space every book takes.
+
+The same mount is necessary but is not sufficient. On Linux, `fs.protected_hardlinks=1` normally
+requires the BookOrbit process user to own the completed source file or be able to write it. The
+download client and BookOrbit commonly run with the same UID, or with a shared group that grants
+BookOrbit write access to completed files. The mapping test creates its own BookOrbit-owned source
+file, so it proves that the paths and mount permit hardlinks but cannot prove that a completed file
+owned by a different user will be linkable. If the real file cannot be linked, BookOrbit falls back
+to copying it and the book uses space twice while the original keeps seeding.
+
+BookOrbit never stops a seed on its own. Removing a torrent from its client is an explicit action
+with its own confirmation, and removing one that is still working also fails the request.
+
+## Automation
+
+Settings > System > Requests > Automation. Everything here is off or unset by default.
+
+- **Auto-grab** picks a release without an approver, but only above a minimum score. Below that the
+  request waits, and the approver still sees the full ranked list.
+- **Auto-retry** falls back to the next-best release when an automatic grab fails, bounded by a
+  maximum number of attempts per request.
+- **Auto-search** re-searches an approved request nothing was found for. Without it a request is
+  searched exactly once, and a book whose first release is posted next month waits forever. The
+  interval doubles for each week a request has been waiting, up to a cap, and stops entirely after
+  a configurable age.
+- **Import checking** scores what landed against what was asked for. Below the threshold the file
+  waits in the Book Dock and the request reads "needs review", where a person either files it
+  anyway or discards it. Switching this off files whatever was downloaded straight into the target
+  library.
+- **Import formats** decides what to keep when one release carries the same book several times
+  over: every format, or only the target library's preferred one. A multipart audiobook is never
+  affected, since its parts are one book rather than competing editions.
+- **Default destinations** are per medium, and are the lowest rung of the ladder: a requester's own
+  pinned destination and an explicit choice at request or approval time both win over them. Without
+  one, a request that names no library can never be approved.
+- **Release profiles** are an ordered tier list per medium describing the edition you want. Empty
+  is the ordinary state and disengages the tier axis entirely, leaving auto-grab decided by score.
+
+## The lifecycle
+
+```
+pending -> approved -> searching -> grabbed -> downloading -> importing -> available
+```
+
+- **pending**: waiting on an approver. Auto-approval and self-serve both skip it.
+- **needs_review**: the import scored below the threshold and is sitting in the Book Dock. Two ways
+  out: file it anyway, or discard it, which removes the dock entry and fails the request.
+- **failed**: nothing could be downloaded, or a person discarded the import. Still grabbable, so a
+  different release can be tried.
+- **rejected** / **cancelled**: settled by a person. A settled work can be requested again.
+
+One live request per work. A second person asking for the same book is attached to the existing
+request as a subscriber rather than opening a second one, and can leave it again from the request's
+own menu.
+
+## Troubleshooting
+
+**"No sources are enabled"** on the requests page: either nothing is configured, or every row is
+switched off. The notice says which.
+
+**Requests sit at `approved` and nothing happens**: auto-grab is off, which is the default. Either
+an approver opens the release picker, or auto-grab is switched on with a minimum score.
+
+**A grab is refused with a path error**: the client has no path mapping, or the download directory
+resolved outside the one it has. Add or widen the mapping under Settings > System > Requests.
+
+**Credentials will not save**: `BOOK_REQUEST_ENCRYPTION_KEY` is unset or is not 64 hex characters.
+
+**A source shows "Searches failing" but tests fine**: the address answers a capabilities call and
+refuses searches. Usually a rate limit, an expired session, or categories that do not exist on that
+tracker.
+
+## Related
+
+- [Development guide](DEVELOPMENT.md)
+- [Testing guide](TESTING.md)
diff --git a/docs/CALIBRE_WEB_AUTOMATED_MIGRATION.md b/docs/CALIBRE_WEB_AUTOMATED_MIGRATION.md
deleted file mode 100644
index 98d6bebfc..000000000
--- a/docs/CALIBRE_WEB_AUTOMATED_MIGRATION.md
+++ /dev/null
@@ -1,290 +0,0 @@
-# Migrating from Calibre-Web Automated
-
-BookOrbit can perform a one-time import from Calibre-Web Automated, abbreviated CWA. The migration
-matches CWA books to books that already exist in BookOrbit, maps CWA users to existing BookOrbit users,
-and imports supported reading state and static shelves.
-
-This is an import, not continuous synchronization. Keep the original CWA installation and both systems'
-backups until you have reviewed the migration report and verified the imported state.
-
-## Compatibility
-
-Compatibility is declared only for snapshots covered by the disposable end-to-end suite.
-
-| Snapshot producer | Verified result                                                                        |
-| ----------------- | -------------------------------------------------------------------------------------- |
-| CWA v4.0.6        | Full stopped-snapshot import, repeat-run idempotency, user isolation, and DB integrity |
-
-CWA's `app.db` and Calibre's `metadata.db` do not contain a trustworthy CWA release number. BookOrbit
-therefore reports the source version as unknown and emits this expected warning:
-
-```text
-Schema compatibility was verified against Calibre-Web Automated v4.0.6
-```
-
-That warning does not mean validation failed. Other CWA versions may work, but they are not currently
-declared compatible. Missing optional tables produce precise warnings and disable only the affected
-domain. Missing core book, file, or user columns cause validation to fail.
-
-Maintainers can exercise another literal published image tag with:
-
-```bash
-CWA_E2E_IMAGE=crocodilestick/calibre-web-automated:<published-tag> \
-  pnpm e2e:run -- migration-calibre-web-automated
-```
-
-CWA's historical Docker tag casing is not consistent. Use the exact published tag rather than building
-one from a version number. Do not broaden the compatibility declaration until the complete suite passes.
-
-## Requirements
-
-- The BookOrbit operator must have the `Manage App Settings` permission.
-- Target books must already exist in a scanned BookOrbit library. Unmatched source books are reported
-  and are not created automatically.
-- Target BookOrbit user accounts must already exist. CWA users are mapping candidates only; accounts,
-  passwords, roles, tokens, sessions, and permissions are never copied.
-- BookOrbit must have a dedicated server-side import directory configured through
-  `MIGRATION_IMPORT_ROOT`.
-- CWA must be fully stopped while `app.db` and its corresponding `metadata.db` are copied.
-
-The two databases are independent SQLite files. Neither CWA nor BookOrbit can make a live copy of them
-represent one shared instant. BookOrbit can detect active journal or WAL files beside the submitted
-snapshots, but it cannot prove that snapshots copied elsewhere were taken consistently. Stopping CWA
-before the copy is therefore required even when validation succeeds.
-
-## Supported data
-
-The first compatibility declaration covers:
-
-- non-Guest CWA users as explicit mapping candidates, including administrators and regular users;
-- Calibre books and individual formats;
-- title, ordered authors and sort names, ISBN, ASIN and supported provider identifiers, publisher,
-  publication year, language, series, rating, description, and tags;
-- unread, reading, and read status with available start, finish, and update dates;
-- web-reader EPUB CFI resume position;
-- web-reader audio position converted from milliseconds to seconds;
-- web-reader comic position converted from CWA's zero-based image index to BookOrbit's one-based page;
-- Kobo EPUB or KEPUB progress, preferring KEPUB when both formats exist;
-- KOReader percentage and compatible EPUB locator when CWA's checksum index maps the document uniquely;
-- static shelves and their relative book order; and
-- matching by ISBN, ASIN, mapped file path, then title and author.
-
-Calibre tags are imported as BookOrbit tags, not genres. Metadata is applied as an overlay: a field CWA
-actually carries can replace that field on the matched BookOrbit book, while unavailable source fields
-are left unchanged.
-
-CWA's table named `bookmark` stores one current web-reader resume position. It does not represent a
-collection of named bookmarks, so those rows become reading progress rather than BookOrbit bookmarks.
-
-## Deferred and unavailable data
-
-The following data is not imported:
-
-- the default Guest account or state owned only by Guest;
-- account credentials, OAuth data, API tokens, mail secrets, sessions, device secrets, or Hardcover
-  tokens;
-- user creation, roles, permissions, or authentication settings;
-- narrators and genres, because CWA does not distinguish them reliably from Calibre tags;
-- reading-session history;
-- named bookmarks and annotations;
-- covers;
-- Magic Shelves, dynamic shelf rules, and public-sharing behavior;
-- arbitrary Calibre custom columns;
-- CWA operational data from `cwa.db`; and
-- continuous or two-way synchronization after the migration.
-
-A public CWA shelf is imported as a private collection owned by the mapped BookOrbit user. It is never
-granted to another user automatically.
-
-## Create a stopped-instance snapshot
-
-The common CWA container paths are:
-
-| Data                 | Typical CWA container path     |
-| -------------------- | ------------------------------ |
-| CWA application data | `/config/app.db`               |
-| Calibre catalog      | `/calibre-library/metadata.db` |
-
-Use the host paths bound to those container locations. If CWA selects a library below another folder,
-copy the `metadata.db` belonging to the library currently configured in CWA, not another Calibre
-catalog found on the host.
-
-1. Back up the CWA config and Calibre library using your normal backup process.
-2. Stop CWA completely. With the standard Compose service name:
-
-   ```bash
-   docker compose stop calibre-web-automated
-   ```
-
-3. Confirm the container is stopped. Replace the name if your deployment uses another container name:
-
-   ```bash
-   docker inspect -f '{{.State.Running}}' calibre-web-automated
-   ```
-
-   The command must print `false`.
-
-4. Inspect both source directories for non-empty SQLite sidecars. Check for `app.db-wal`,
-   `app.db-journal`, `metadata.db-wal`, and `metadata.db-journal`. Do not copy only a main database while
-   one of these contains data. Do not delete a sidecar to make validation pass. Restart CWA, allow its
-   recovery and startup work to finish, stop it cleanly, and check again.
-5. While CWA remains stopped, copy exactly the two main database files into a dedicated BookOrbit import
-   directory. For example:
-
-   ```bash
-   install -d -m 700 /host/path/to/bookorbit-migration-imports/cwa
-   install -m 600 /host/path/to/cwa-config/app.db \
-     /host/path/to/bookorbit-migration-imports/cwa/app.db
-   install -m 600 /host/path/to/calibre-library/metadata.db \
-     /host/path/to/bookorbit-migration-imports/cwa/metadata.db
-   ```
-
-6. Confirm the copied files are different regular files and that no copied `-wal` or `-journal`
-   sidecars exist beside them.
-7. CWA may be restarted after both copies are complete. BookOrbit reads only the copies.
-
-If CWA was never allowed to finish startup migrations, optional KOReader tables may not exist. When
-KOReader progress matters, let the same CWA version start fully and finish its checksum work before
-stopping and recopying the databases.
-
-## Configure the BookOrbit import root
-
-Mount only the dedicated import directory read-only into the BookOrbit app container. For example, add
-this entry to the app service's `volumes` list in `docker-compose.yml`:
-
-```yaml
-- /host/path/to/bookorbit-migration-imports:/imports:ro
-```
-
-Set the corresponding absolute container path in BookOrbit's `.env`:
-
-```dotenv
-MIGRATION_IMPORT_ROOT=/imports
-```
-
-Restart BookOrbit so it receives the environment value and mount. In the migration source form, select
-Calibre-Web Automated and enter:
-
-```text
-Application database: /imports/cwa/app.db
-Calibre metadata database: /imports/cwa/metadata.db
-```
-
-`MIGRATION_IMPORT_ROOT` is a server-side authorization boundary. It cannot be supplied or overridden by
-the migration request. BookOrbit requires absolute paths, resolves the configured root and both files,
-rejects symlinks or path traversal, requires two different regular files, copies them into owner-only
-temporary storage, opens them read-only with SQLite defensive mode, runs integrity checks, and cleans up
-the private copies after each operation.
-
-Use paths as seen by the BookOrbit process or container. A host path that is not mounted at the same
-location is not a valid migration path. Do not use `/`, a home directory, the CWA config directory, or a
-broad storage mount as the import root.
-
-## Book path mapping
-
-The snapshot file location is not the source library root used for book matching. Book paths are based
-on the logical Calibre library root stored in CWA's `app.db`, normally `/calibre-library`. A split-library
-configuration may provide a different logical root. BookOrbit reports the detected prefix after source
-validation.
-
-Map that CWA-visible prefix to the path where the same files exist inside BookOrbit. For example:
-
-| Source prefix      | Target prefix |
-| ------------------ | ------------- |
-| `/calibre-library` | `/books`      |
-
-Mappings replace only the matching leading path prefix. The target prefix is not the host path unless
-BookOrbit sees that exact path. Validate the mapping before creating the final dry run.
-
-CWA does not provide BookOrbit file hashes, so mapped paths are especially important for books with
-multiple files of the same media kind, such as EPUB and KEPUB together. ISBN, ASIN, and title/author
-matching can still match books whose paths differ, but exact mapped paths give file-level progress the
-strongest target-file signal.
-
-## User mapping and recommended workflow
-
-Review every suggested user mapping. Users left unmapped remain visible in source counts and reports,
-but their status, progress, and shelves are not imported. Never map multiple people to one BookOrbit
-account merely to clear a warning.
-
-1. Back up BookOrbit and CWA.
-2. Scan the target BookOrbit libraries and confirm the target files are present.
-3. Stop CWA and create both snapshots as described above.
-4. Configure the read-only import mount and `MIGRATION_IMPORT_ROOT`, then restart BookOrbit.
-5. Create a Calibre-Web Automated source with the two snapshot paths.
-6. Test the source, save it, and validate its capabilities and warnings.
-7. Map selected CWA users to existing BookOrbit users.
-8. Add and validate the logical-library path mapping.
-9. Run a dry run and review match strategies, ambiguities, unmatched books, unmapped users, warnings,
-   unavailable domains, and per-user totals.
-10. Resolve ambiguous matches and create a current dry run.
-11. Start the live migration and export the final report.
-12. Verify representative EPUB, Kobo or KEPUB, KOReader, audio, comic, finished-status, and ordered-shelf
-    examples before retiring the CWA installation or snapshots.
-
-Repeating the same completed plan is designed to be idempotent, but it is not a substitute for reviewing
-the first report and retaining backups.
-
-## Troubleshooting
-
-### A snapshot is reported as active or hot
-
-BookOrbit rejects a submitted database when a non-empty `-wal` or `-journal` file exists beside it. Stop
-CWA, discard the attempted copies, and create a fresh pair from the stopped installation. Do not remove
-sidecars from a running installation or copy only the main database.
-
-If the original stopped directories still contain non-empty sidecars, restart the same CWA installation,
-allow recovery to complete, stop it cleanly, and inspect again. Preserve the original files and request
-support if they remain; do not repair production databases in place merely to satisfy migration.
-
-### The two database paths appear reversed
-
-The application field must point to CWA's `app.db`, which contains the `user` table. The metadata field
-must point to Calibre's `metadata.db`, which contains `books` and `data`. Correct the two fields and
-retest. Renaming the wrong files does not make them compatible.
-
-### A path is missing, outside the import root, or unreadable
-
-- Confirm `MIGRATION_IMPORT_ROOT` is set in the BookOrbit process and is absolute.
-- Use paths inside the BookOrbit container, not host-only or workstation paths.
-- Confirm the read-only mount contains both files and the BookOrbit container user can read them.
-- Keep both snapshots below the canonical import root and avoid symlinks.
-- Confirm the paths identify two different regular files.
-
-### The snapshot schema is incompatible
-
-Confirm the files came from the same stopped CWA installation and that CWA had completed startup. Missing
-required user, book, or file tables or columns fail validation. Do not edit SQLite tables or bypass
-validation. Preserve the original snapshot pair and report the exact CWA image tag plus the sanitized
-validation message when requesting compatibility support.
-
-### Optional progress or shelves are unavailable
-
-Missing `book_read_link`, web bookmark, Kobo, KOReader, checksum, or shelf tables disable only the related
-domain and produce a warning. This can be legitimate when the feature was never used. If the source
-installation should contain that data, start the same CWA version, allow its migrations and checksum work
-to finish, stop it, and create a new snapshot pair.
-
-### No CWA-specific schema signature is found
-
-BookOrbit warns when the snapshot has compatible core Calibre-Web tables but none of the known CWA
-signatures. The files may come from stock Calibre-Web or an unverified CWA schema. Review the warning and
-source provenance carefully. A core-schema match is not proof of CWA compatibility.
-
-### The logical library path is unsafe or missing
-
-BookOrbit rejects traversal, backslashes, NULs, and unsafe absolute or relative path components. The
-logical root comes from CWA configuration, not from the snapshot's host directory. Correct the library
-configuration in CWA, let it start successfully, stop it, and create fresh snapshots rather than editing
-the copies.
-
-### Books or users remain unresolved
-
-- Confirm the target BookOrbit library scan completed before the dry run.
-- Map the CWA logical library prefix to the path visible inside BookOrbit.
-- Check ISBN and ASIN metadata on both sides.
-- Check title and author spelling when relying on the final fallback strategy.
-- Resolve ambiguous book matches explicitly in the dry-run workflow.
-- Create the target BookOrbit account before mapping. The migration does not create users.
-
-Unmatched books remain in the report and do not prevent valid matched books from importing.
diff --git a/packages/plugin-api/package.json b/packages/plugin-api/package.json
new file mode 100644
index 000000000..70d11c95c
--- /dev/null
+++ b/packages/plugin-api/package.json
@@ -0,0 +1,14 @@
+{
+  "name": "@bookorbit/plugin-api",
+  "version": "1.0.0",
+  "private": true,
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "devDependencies": {
+    "typescript": "^6.0.3"
+  },
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch --preserveWatchOutput"
+  }
+}
diff --git a/packages/plugin-api/src/index.ts b/packages/plugin-api/src/index.ts
new file mode 100644
index 000000000..396453f64
--- /dev/null
+++ b/packages/plugin-api/src/index.ts
@@ -0,0 +1,224 @@
+/**
+ * The contract between BookOrbit and an indexer plugin loaded from disk.
+ *
+ * This package exists so that a plugin maintained in another repository can typecheck against a
+ * versioned surface instead of against BookOrbit's internals. Nothing here is tracker-specific,
+ * and BookOrbit ships no plugin of its own: the loader is the extension point, the plugins are
+ * somebody else's.
+ *
+ * Deliberately dependency-free and free of runtime classes. A plugin is imported at runtime and
+ * therefore gets its own copy of anything it imports, so `instanceof` across the boundary cannot
+ * be relied on; every failure travels through `host.fail` instead.
+ */
+
+/** Bumped when a change to this contract would break a plugin written against the old one. */
+export const PLUGIN_API_VERSION = 1;
+
+export type PluginMediaKind = "ebook" | "audiobook" | "comic";
+
+/** Distinct enough to act on: a rejected credential must not look like "nothing found". */
+export type PluginSearchFailure = "unauthorized" | "throttled" | "timeout" | "unreachable" | "unsupportedMedium" | "error";
+
+/** What an indexer's credential field holds, or null where the source needs no account. */
+export type PluginCredentialKind = "apiKey" | "sessionId" | null;
+
+export interface PluginCategoryMap {
+  ebook: number[];
+  audiobook: number[];
+  comic: number[];
+}
+
+/** What a request is looking for, already normalised by BookOrbit. */
+export interface PluginReleaseQuery {
+  title: string;
+  author: string | null;
+  isbn13: string | null;
+  /** Compatibility alias containing either the active ISBN or no values. */
+  isbn13s: string[];
+  mediaKind: PluginMediaKind;
+  /** The language the request asked for. A hard filter, but only where a release states one. */
+  language: string | null;
+  limit: number;
+}
+
+/** One configured indexer row, with its credential already decrypted. Never log this. */
+export interface PluginIndexerConfig {
+  id: number;
+  name: string;
+  baseUrl: string;
+  credential: string | null;
+  allowPrivateAddress: boolean;
+  categories: PluginCategoryMap;
+  /** Whatever the plugin declared in `settingsFields`, already validated against that schema. */
+  settings: Record<string, unknown> | null;
+}
+
+/** Audio characteristics, where a source publishes them. Shown and sorted on, never scored. */
+export interface PluginAudioInfo {
+  bitrateKbps: number | null;
+  bitrateMode: string | null;
+  channels: number | null;
+  samplingRateHz: number | null;
+  durationSeconds: number | null;
+  chapterCount: number | null;
+}
+
+/**
+ * One release as a source describes it. Everything past `title` is optional because sources
+ * differ wildly in what they expose, and scoring degrades rather than rejecting a sparse row.
+ */
+export interface PluginReleaseCandidate {
+  /** Stable within this indexer, and how a grab names the release it wants. */
+  guid: string;
+  title: string;
+  /** The bare work title where the source publishes one; scored against, never displayed. */
+  bookTitle?: string;
+  downloadUrl?: string;
+  magnet?: string;
+  infoHash?: string;
+  sizeBytes: number | null;
+  /**
+   * Null means the source reported no swarm counts, which must not be read as zero: the
+   * zero-seeder hard filter would then drop every release from a source that omits the field.
+   */
+  seeders: number | null;
+  leechers: number | null;
+  format?: string;
+  language?: string;
+  author?: string;
+  /**
+   * An identifier the source states for the edition, where it states one. Never trusted to be an
+   * ISBN: MyAnonaMouse returns `ASIN:B08G9PRS1K` in the same field, which normalisation rejects.
+   */
+  isbn?: string;
+  freeleech?: boolean;
+  /**
+   * The account behind this indexer has already downloaded this release, where the source says so.
+   * Advisory only: sources report it on a delay, so it marks a row and never filters one.
+   */
+  alreadyGrabbed?: boolean;
+  /** The source will refuse the download outright unless the account is privileged. */
+  vipOnly?: boolean;
+  publishedAt?: string;
+  audio?: PluginAudioInfo;
+  /** Primary-format files this release carries, where the source exposes a real file list. */
+  primaryFileCount?: number;
+  /** Total files, where the source reports only a count. A scoring penalty, not a filter. */
+  fileCount?: number;
+  seedRatioGoal?: number;
+  seedTimeMinutes?: number;
+}
+
+/** One file, for a source that serves the file itself rather than a torrent. */
+export interface PluginReleaseFile {
+  url: string;
+  fileName: string;
+  sizeBytes: number | null;
+  format: string;
+}
+
+export interface PluginTestResult {
+  success: boolean;
+  /** What answered, when the source names itself. */
+  indexerName?: string;
+  error?: string;
+}
+
+/** One configurable field a plugin wants on the settings form, beyond the shared ones. */
+export interface PluginSettingsField {
+  key: string;
+  type: "boolean" | "string" | "number";
+  /** Untranslated English: plugin strings cannot go through the translation workflow. */
+  label: string;
+  hint?: string;
+  default?: boolean | string | number;
+  /** Edit a comma-separated string as a collection instead of exposing its punctuation. */
+  format?: "list";
+  /** When present on a list, the UI only permits these canonical values. */
+  options?: readonly string[];
+  /** Smallest permitted list size. Requires `options` so the limit can be enforced safely. */
+  minItems?: number;
+}
+
+/**
+ * Everything BookOrbit lends a plugin. A plugin must reach for these rather than Node's own
+ * globals: `host.fetch` is the only path that enforces the address checks, the size limits and
+ * the per-request deadline that keep a hostile or misconfigured source from reaching the network
+ * it should not.
+ */
+export interface PluginHost {
+  /**
+   * Checked against the indexer's private-address policy, given the caller's deadline, and
+   * bounded. Throws whatever `fail` produces on a refusal.
+   */
+  fetch(url: string, init?: PluginRequestInit): Promise<Response>;
+  /** Values interpolated into a message are sanitized by the host before they reach a log. */
+  logger: {
+    log(message: string): void;
+    warn(message: string): void;
+  };
+  /**
+   * The search text BookOrbit would use itself: parentheticals stripped, author appended. Sources
+   * that AND their terms answer a decorated title with nothing at all.
+   */
+  buildSearchText(query: PluginReleaseQuery): string;
+  /**
+   * Store a credential the source rotated out from under the stored one. Without this a rotated
+   * session lives only in memory and stops working at the next restart.
+   */
+  saveCredential(credential: string): Promise<void>;
+  /**
+   * Build the error a plugin should throw. A function rather than an exported class because a
+   * plugin imported at runtime holds a different copy of any class, so `instanceof` would not
+   * survive the boundary and the failure code would be lost.
+   */
+  fail(failure: PluginSearchFailure, message: string): Error;
+}
+
+export interface PluginRequestInit {
+  method?: string;
+  headers?: Record<string, string>;
+  body?: string;
+  /** Defaults to following redirects, each hop checked. */
+  redirect?: "follow" | "manual";
+}
+
+/**
+ * What a plugin module's default export must look like. Everything the settings form needs is
+ * declared here, so a plugin-supplied source is indistinguishable from a built-in one to the
+ * client.
+ */
+export interface IndexerPlugin {
+  /** Must equal `PLUGIN_API_VERSION`; the loader refuses a mismatch and says so. */
+  apiVersion: number;
+  /** The plugin release, without a leading `v`. Optional for plugins written before versions were exposed. */
+  version?: string;
+  /** A slug. May not collide with a built-in type name, and must match `^[a-z0-9][a-z0-9-]{0,29}$`. */
+  type: string;
+  /** Untranslated English, shown in the indexer type list. */
+  label: string;
+  requiresCredential: boolean;
+  credentialKind: PluginCredentialKind;
+  /** Which media this source can answer for at all. */
+  mediaKinds: readonly PluginMediaKind[];
+  /** Whether this plugin uses `isbn13` when present instead of the title and author text. */
+  supportsIsbnSearch?: boolean;
+  /** Whether the source is searched by numeric category, which decides if the editor shows. */
+  usesCategories: boolean;
+  defaultCategories?: PluginCategoryMap;
+  /** Whether a grab joins a swarm, which decides whether seed goals mean anything. */
+  seedsBack: boolean;
+  /** Prefilled into the form when adding one. */
+  defaultBaseUrl?: string;
+  baseUrlHint?: string;
+  settingsFields?: readonly PluginSettingsField[];
+
+  search(query: PluginReleaseQuery, config: PluginIndexerConfig, host: PluginHost, signal: AbortSignal): Promise<PluginReleaseCandidate[]>;
+  test(config: PluginIndexerConfig, host: PluginHost): Promise<PluginTestResult>;
+  /** A source whose download link is credentialed and must be fetched with its own session. */
+  fetchTorrentFile?(release: PluginReleaseCandidate, config: PluginIndexerConfig, host: PluginHost): Promise<Uint8Array>;
+  /** A source that serves the file itself. Declare this or `fetchTorrentFile`, never both. */
+  resolveFile?(release: PluginReleaseCandidate, config: PluginIndexerConfig, host: PluginHost, signal: AbortSignal): Promise<PluginReleaseFile>;
+  /** Sources whose session expires on its own clock, called on a schedule while enabled. */
+  keepalive?(config: PluginIndexerConfig, host: PluginHost): Promise<void>;
+}
diff --git a/packages/plugin-api/tsconfig.json b/packages/plugin-api/tsconfig.json
new file mode 100644
index 000000000..83700ae68
--- /dev/null
+++ b/packages/plugin-api/tsconfig.json
@@ -0,0 +1,15 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "Node16",
+    "moduleResolution": "Node16",
+    "declaration": true,
+    "declarationMap": true,
+    "rootDir": "./src",
+    "outDir": "./dist",
+    "strict": true,
+    "skipLibCheck": true
+  },
+  "include": ["src/**/*"],
+  "exclude": ["node_modules", "dist"]
+}
diff --git a/packages/types/src/audit.ts b/packages/types/src/audit.ts
index a651805bd..5ce898c35 100644
--- a/packages/types/src/audit.ts
+++ b/packages/types/src/audit.ts
@@ -73,6 +73,27 @@ export enum AuditAction {
 
   BookDockFinalize = "book_dock.finalize",
 
+  BookRequestCreate = "book_request.create",
+  BookRequestApprove = "book_request.approve",
+  BookRequestReject = "book_request.reject",
+  BookRequestCancel = "book_request.cancel",
+  BookRequestFulfill = "book_request.fulfill",
+  BookRequestGrab = "book_request.grab",
+  BookRequestImport = "book_request.import",
+  BookRequestRemoveDownload = "book_request.remove_download",
+  BookRequestDelete = "book_request.delete",
+
+  DownloadClientCreate = "download_client.create",
+  DownloadClientUpdate = "download_client.update",
+  DownloadClientDelete = "download_client.delete",
+
+  RequestIndexerCreate = "request_indexer.create",
+  RequestIndexerUpdate = "request_indexer.update",
+  RequestIndexerDelete = "request_indexer.delete",
+  RequestIndexerPluginInspect = "request_indexer.plugin.inspect",
+  RequestIndexerPluginInstall = "request_indexer.plugin.install",
+  RequestIndexerPluginRemove = "request_indexer.plugin.remove",
+
   AuthorUpdate = "author.update",
   AuthorDelete = "author.delete",
   AuthorMerge = "author.merge",
@@ -128,6 +149,9 @@ export enum AuditResource {
   Collection = "collection",
   SmartScope = "smart_scope",
   BookDockFile = "book_dock_file",
+  BookRequest = "book_request",
+  DownloadClient = "download_client",
+  RequestIndexer = "request_indexer",
   Author = "author",
   AppSettings = "app_settings",
   Genre = "genre",
diff --git a/packages/types/src/book-dock.ts b/packages/types/src/book-dock.ts
index 3cb402a21..3984235a0 100644
--- a/packages/types/src/book-dock.ts
+++ b/packages/types/src/book-dock.ts
@@ -68,6 +68,15 @@ export interface BookDockMetadata {
   comicMetadata?: ComicMetadataFields | null;
 }
 
+/** One file of a multi-file dock unit. Read-only in the UI: a unit is finalized whole. */
+export interface BookDockUnitFile {
+  fileName: string;
+  fileSize: number | null;
+  format: string | null;
+  role: "content" | "cover" | "metadata" | "supplement";
+  sortOrder: number | null;
+}
+
 export interface BookDockFile {
   id: number;
   fileName: string;
@@ -85,6 +94,11 @@ export interface BookDockFile {
   metadataEditedAt: string | null;
   createdAt: string;
   updatedAt: string;
+  /**
+   * The files this entry is made of, in playback or format order. Empty for the ordinary loose
+   * single file, which is what `fileName` and `fileSize` already describe.
+   */
+  unitFiles: BookDockUnitFile[];
 }
 
 export interface BookDockFilesPage {
@@ -146,7 +160,16 @@ export interface BookDockFinalizeResult {
 }
 
 export type BookDockFinalizePreviewStatus =
-  "ready" | "duplicate" | "destination_conflict" | "missing_destination" | "invalid_target" | "access_denied" | "invalid_format" | "error";
+  | "ready"
+  | "duplicate"
+  | "destination_conflict"
+  | "missing_destination"
+  | "invalid_target"
+  | "access_denied"
+  | "invalid_format"
+  /** A multi-file unit the target library's organization mode cannot represent. */
+  | "unsupported_layout"
+  | "error";
 
 export interface BookDockFinalizePreviewItem {
   fileId: number;
diff --git a/packages/types/src/book-request-automation.ts b/packages/types/src/book-request-automation.ts
new file mode 100644
index 000000000..7a940ee42
--- /dev/null
+++ b/packages/types/src/book-request-automation.ts
@@ -0,0 +1,192 @@
+import { BOOK_REQUEST_MEDIA_KINDS, type BookRequestMediaKind } from "./book-request";
+import { emptyRequestDestinationDefaults, type RequestDestinationDefaults } from "./book-request-destination";
+import { emptyReleaseProfiles, type ReleaseProfiles } from "./book-request-profile";
+
+/**
+ * Instance-level automation for book requests: whether BookOrbit may grab a release without an
+ * approver looking at the list, how good that release has to be, how many times it may try again
+ * after a failure, and how close an imported file has to be to the request before it is filed.
+ *
+ * Stored as individual `app_settings` rows rather than one JSON blob, so a single knob can be
+ * changed without a read-modify-write over the others.
+ */
+export const BOOK_REQUEST_AUTOMATION_SETTING_KEYS = {
+  AUTO_GRAB_ENABLED: "book_request_auto_grab_enabled",
+  AUTO_GRAB_MIN_SCORE: "book_request_auto_grab_min_score",
+  AUTO_RETRY_ENABLED: "book_request_auto_retry_enabled",
+  MAX_AUTO_GRAB_ATTEMPTS: "book_request_max_auto_grab_attempts",
+  VERIFICATION_ENABLED: "book_request_verification_enabled",
+  VERIFICATION_THRESHOLD: "book_request_verification_threshold",
+  IMPORT_FORMATS: "book_request_import_formats",
+  AUTO_SEARCH_ENABLED: "book_request_auto_search_enabled",
+  AUTO_SEARCH_INTERVAL_HOURS: "book_request_auto_search_interval_hours",
+  AUTO_SEARCH_MAX_AGE_DAYS: "book_request_auto_search_max_age_days",
+} as const;
+
+/**
+ * The instance default destination for one medium, as two flat rows rather than a JSON blob, so
+ * the destinations follow the same one-row-per-knob rule as the settings above.
+ *
+ * Derived from the medium rather than spelled out three times: `BOOK_REQUEST_MEDIA_KINDS` is what
+ * decides how many there are, and a medium added later should not need six more literals here.
+ */
+export function bookRequestDefaultLibraryKey(mediaKind: BookRequestMediaKind): string {
+  return `book_request_default_library_${mediaKind}`;
+}
+
+export function bookRequestDefaultFolderKey(mediaKind: BookRequestMediaKind): string {
+  return `book_request_default_folder_${mediaKind}`;
+}
+
+export const BOOK_REQUEST_DESTINATION_SETTING_KEYS: string[] = BOOK_REQUEST_MEDIA_KINDS.flatMap((kind) => [
+  bookRequestDefaultLibraryKey(kind),
+  bookRequestDefaultFolderKey(kind),
+]);
+
+/**
+ * The release profile for one medium, as a single JSON row.
+ *
+ * This is the one deliberate exception to the one-row-per-knob rule above. A tier list is one
+ * value: reordering it or editing a condition rewrites the whole list either way, so splitting it
+ * across rows would buy nothing and cost the ordering guarantee that makes a profile mean anything.
+ */
+export function bookRequestReleaseProfileKey(mediaKind: BookRequestMediaKind): string {
+  return `book_request_release_profile_${mediaKind}`;
+}
+
+export const BOOK_REQUEST_PROFILE_SETTING_KEYS: string[] = BOOK_REQUEST_MEDIA_KINDS.map(bookRequestReleaseProfileKey);
+
+export const BOOK_REQUEST_IMPORT_FORMATS = ["all", "preferred"] as const;
+export type BookRequestImportFormats = (typeof BOOK_REQUEST_IMPORT_FORMATS)[number];
+
+export interface BookRequestAutomationSettings {
+  /**
+   * Off by default, and deliberately so: book matching is hard enough that the approver picks the
+   * release until an operator says otherwise.
+   */
+  autoGrabEnabled: boolean;
+  /** A release scoring below this is never grabbed unattended; the approver still sees the list. */
+  autoGrabMinScore: number;
+  /** Whether a failed automatic grab falls back to the next-best release on its own. */
+  autoRetryEnabled: boolean;
+  /** Total automatic grabs allowed per request, first attempt included. */
+  maxAutoGrabAttempts: number;
+  /**
+   * Whether an approved request nothing could be found for is searched for again later.
+   *
+   * Without it a request is looked for exactly once. A book declined for want of a good enough
+   * release, or one whose first release is posted next month, then sits at `approved` forever
+   * unless a person reopens the picker for it - which is the one hole the whole pipeline has no
+   * other answer to.
+   *
+   * A separate flag rather than an interval of zero, so switching it off and on again does not
+   * lose the interval the operator tuned. Does nothing while `autoGrabEnabled` is off: there is
+   * nothing for an unattended search to do with what it finds.
+   */
+  autoSearchEnabled: boolean;
+  /**
+   * How long after its last attempt an unfulfilled request is searched for again.
+   *
+   * The base interval rather than the whole rule: a request that has been waiting weeks is searched
+   * progressively less often, so a long backlog does not turn into daily traffic against every
+   * tracker forever.
+   */
+  autoSearchIntervalHours: number;
+  /** How long a request keeps being searched for before it is left to a person. */
+  autoSearchMaxAgeDays: number;
+  /**
+   * Whether an imported file is checked against the request before it is filed. On, a poor match
+   * waits in the Book Dock for a human. Off, whatever was downloaded goes straight into the target
+   * library: no wait, and no guard against a mislabelled release landing there unnoticed.
+   *
+   * A separate flag rather than a threshold of zero, so turning the check off and on again does
+   * not lose the threshold the operator tuned.
+   */
+  verificationEnabled: boolean;
+  /** Below this, an imported file is held in the Book Dock for review instead of being filed. */
+  verificationThreshold: number;
+  /**
+   * What to keep when a release carries the same book in several formats.
+   *
+   * `all` keeps every format, which in a one-book-per-folder library is one book with several
+   * files and in a one-book-per-file library is one book per format, that mode's normal state
+   * rather than a duplicate. `preferred` keeps only the highest-priority format for the target
+   * library.
+   *
+   * Never applies to a multipart audiobook: its parts are one book, not competing editions.
+   */
+  importFormats: BookRequestImportFormats;
+  /**
+   * Where a request goes when nobody picked anywhere: per medium, so audiobooks need not land in
+   * the library the ebooks do.
+   *
+   * The lowest rung of the ladder, under the requester's own pinned destination and under an
+   * explicit choice at request or approval time. Without it a request that names no library can
+   * never be approved and is never grabbed unattended, which is what made auto-approval unusable
+   * for anyone who left the picker alone.
+   */
+  destinations: RequestDestinationDefaults;
+  /**
+   * The edition an operator wants, per medium, as an ordered tier list. An empty list is the
+   * ordinary state and means no profile: the tier axis disengages entirely and auto-grab is
+   * decided by score alone, exactly as it was before profiles existed.
+   */
+  profiles: ReleaseProfiles;
+}
+
+export const DEFAULT_BOOK_REQUEST_AUTOMATION_SETTINGS: BookRequestAutomationSettings = {
+  autoGrabEnabled: false,
+  autoGrabMinScore: 80,
+  autoRetryEnabled: true,
+  maxAutoGrabAttempts: 3,
+  // Off, like auto-grab itself. This one reaches every configured tracker on a timer rather than
+  // when somebody asked for something, so it is a decision an operator makes rather than inherits.
+  autoSearchEnabled: false,
+  autoSearchIntervalHours: 24,
+  autoSearchMaxAgeDays: 60,
+  verificationEnabled: true,
+  verificationThreshold: 70,
+  // Keeping what the release carried is the less surprising default: dropping formats silently is
+  // the change an operator would have to notice to undo.
+  importFormats: "all",
+  // Unset, because guessing which of an operator's libraries holds audiobooks is how a book ends
+  // up somewhere nobody looks. Until one is set the destination stays a decision a human makes.
+  destinations: emptyRequestDestinationDefaults(),
+  // Empty, so switching to a build that has profiles changes nothing about what gets grabbed.
+  // A profile only starts constraining once an operator has written one.
+  profiles: emptyReleaseProfiles(),
+};
+
+/**
+ * A floor this low would grab almost anything the scorer did not hard-filter, which is not a
+ * setting so much as a way to fill a library with the wrong books.
+ */
+export const MIN_AUTO_GRAB_SCORE_FLOOR = 50;
+export const MAX_AUTO_GRAB_ATTEMPTS_LIMIT = 10;
+
+/**
+ * An hour is already often for a book that did not exist an hour ago, and a week is the point past
+ * which "keep looking" stops meaning anything.
+ */
+export const MIN_AUTO_SEARCH_INTERVAL_HOURS = 1;
+export const MAX_AUTO_SEARCH_INTERVAL_HOURS = 168;
+export const MIN_AUTO_SEARCH_MAX_AGE_DAYS = 1;
+export const MAX_AUTO_SEARCH_MAX_AGE_DAYS = 365;
+
+/**
+ * How far the interval is allowed to stretch as a request ages. It doubles for each week the
+ * request has been waiting, so a daily search becomes weekly after three weeks and stops there:
+ * past that the cap does the work the lifetime limit was going to do anyway.
+ */
+export const AUTO_SEARCH_BACKOFF_WEEK_MS = 7 * 24 * 60 * 60 * 1000;
+export const MAX_AUTO_SEARCH_BACKOFF_FACTOR = 8;
+
+/**
+ * Destinations are partial a second time over: one medium can be changed without resending the
+ * other two, matching how every scalar knob above is sent on its own.
+ */
+export type UpdateBookRequestAutomationSettingsPayload = Partial<Omit<BookRequestAutomationSettings, "destinations" | "profiles">> & {
+  destinations?: Partial<RequestDestinationDefaults>;
+  /** Partial for the same reason destinations are: one medium's list can be saved on its own. */
+  profiles?: Partial<ReleaseProfiles>;
+};
diff --git a/packages/types/src/book-request-destination.ts b/packages/types/src/book-request-destination.ts
new file mode 100644
index 000000000..33e2d5df1
--- /dev/null
+++ b/packages/types/src/book-request-destination.ts
@@ -0,0 +1,47 @@
+import { BOOK_REQUEST_MEDIA_KINDS, type BookRequestMediaKind } from "./book-request";
+
+/**
+ * Where a request's book is filed once it lands: a library, and a folder inside it.
+ *
+ * Both halves are nullable and travel together. A folder without a library is not a destination,
+ * and a library whose folder was deleted still files the book, into that library's first folder.
+ */
+export interface RequestDestination {
+  libraryId: number | null;
+  folderId: number | null;
+}
+
+/**
+ * A destination per medium, which is the finest grain a *default* can be keyed on.
+ *
+ * The medium is chosen before anything is searched, so it is the only thing about the eventual
+ * file that is known at the moment a default has to fill the destination in. The file's format is
+ * not: a request becomes an epub, an m4b or a folder of mp3s only once a release has been picked
+ * and unpacked, long after the approver has already been asked where it goes.
+ */
+export type RequestDestinationDefaults = Record<BookRequestMediaKind, RequestDestination>;
+
+export const NO_REQUEST_DESTINATION: RequestDestination = { libraryId: null, folderId: null };
+
+export function emptyRequestDestinationDefaults(): RequestDestinationDefaults {
+  return Object.fromEntries(BOOK_REQUEST_MEDIA_KINDS.map((kind) => [kind, { ...NO_REQUEST_DESTINATION }])) as RequestDestinationDefaults;
+}
+
+/**
+ * A resolved instance default, as the request form shows it. Carries the library's name because
+ * the form has to say where an unpicked request will land, and the requester may have no access
+ * to that library and so no other way to learn what it is called.
+ */
+export interface ResolvedRequestDestination {
+  libraryId: number | null;
+  libraryName: string | null;
+  folderId: number | null;
+}
+
+export type ResolvedRequestDestinations = Record<BookRequestMediaKind, ResolvedRequestDestination>;
+
+export const NO_RESOLVED_REQUEST_DESTINATION: ResolvedRequestDestination = { libraryId: null, libraryName: null, folderId: null };
+
+export function emptyResolvedRequestDestinations(): ResolvedRequestDestinations {
+  return Object.fromEntries(BOOK_REQUEST_MEDIA_KINDS.map((kind) => [kind, { ...NO_RESOLVED_REQUEST_DESTINATION }])) as ResolvedRequestDestinations;
+}
diff --git a/packages/types/src/book-request-preferences.ts b/packages/types/src/book-request-preferences.ts
new file mode 100644
index 000000000..1094a1882
--- /dev/null
+++ b/packages/types/src/book-request-preferences.ts
@@ -0,0 +1,32 @@
+/**
+ * What a user's requests start with, so it is not re-picked on every request.
+ *
+ * Destinations are deliberately not here. They were, pinned per user and then per medium, but the
+ * instance default under Settings > System > Requests answers the same question for everybody
+ * without each person having to find a pin button, and two mechanisms answering it with an
+ * invisible precedence rule between them was worse than one.
+ */
+export interface BookRequestPreferences {
+  /**
+   * The language a new request asks for, as a two-letter code.
+   *
+   * Null means "whatever the chosen edition happens to be", which is what every request did before
+   * this existed: the edition's language rode along silently and decided the outcome, so a request
+   * for a book could come back as a translation nobody asked for.
+   *
+   * Still per user, unlike the destination, because there is no instance-level answer to it: the
+   * language someone reads in is theirs, not the server's.
+   */
+  defaultLanguage: string | null;
+}
+
+export const DEFAULT_BOOK_REQUEST_PREFERENCES: BookRequestPreferences = {
+  defaultLanguage: null,
+};
+
+/**
+ * Fields this category used to hold: first one destination for every medium, then one per medium.
+ * Read only to be discarded, so a row written by either older build still parses and keeps its
+ * language instead of failing strict validation and reverting to the defaults.
+ */
+export const RETIRED_BOOK_REQUEST_PREFERENCE_FIELDS = ["defaultLibraryId", "defaultFolderId", "destinations"] as const;
diff --git a/packages/types/src/book-request-profile.ts b/packages/types/src/book-request-profile.ts
new file mode 100644
index 000000000..0135eb11b
--- /dev/null
+++ b/packages/types/src/book-request-profile.ts
@@ -0,0 +1,198 @@
+import { BOOK_REQUEST_MEDIA_KINDS, type BookRequestMediaKind } from "./book-request";
+import { languagesAgree } from "./language";
+
+/**
+ * Release profiles: the edition an operator wants, expressed once, so a release can be grabbed
+ * without a person looking at the list.
+ *
+ * A profile is an ORDERED list of tiers, best first. The first tier a release matches is its tier,
+ * and that tier is a **separate axis from the release score**, never folded into it. Auto-grab
+ * takes the highest tier that has any candidate and then the best score within it. Folding tier
+ * points into the score was considered and rejected: enough points to make a format preference
+ * meaningful is also enough to outrank a genuine title-match difference, which is exactly what the
+ * 55-point match weight exists to prevent.
+ *
+ * A release matching no tier keeps `tier: null`. It stays visible in the picker, sorted last, and
+ * a person may still pick it; the automation refuses it and hands the request back.
+ */
+
+/** Whether a release is one book file or several. Named because the picker facets on it too. */
+export type ReleaseFileLayout = "single" | "multi";
+
+/**
+ * How many entries a release may carry and still be **one book file**.
+ *
+ * The count a search returns is every entry in the torrent: the book, its `.cue`, its cover art,
+ * its `.nfo`. So an exact test for one file matches almost nothing real - testing `=== 1` made
+ * "single file" match no MyAnonaMouse release at all, including `Shroud.m4b` shipped beside a cue,
+ * a jpg and an nfo, which is four entries and one book.
+ *
+ * Five is where observed packaging tops out (book, cue, artwork, nfo, and one spare). It is a
+ * threshold, not a fact: this cannot be answered exactly from a search, because the count of
+ * *content* files lives only in the manifest and reading that costs a credentialed fetch per
+ * release, which is why inspection is on demand. A five-part audiobook therefore reads as single
+ * here, and a single book wrapped in six sidecars reads as multi.
+ */
+export const SINGLE_FILE_MAX_ENTRIES = 5;
+
+/**
+ * Which layout a release has, or null where the source stated no count at all. Shared so the
+ * picker's facet and a tier's condition can never disagree about what "single" means.
+ */
+export function classifyFileLayout(fileCount: number | null): ReleaseFileLayout | null {
+  if (fileCount === null) return null;
+  return fileCount <= SINGLE_FILE_MAX_ENTRIES ? "single" : "multi";
+}
+
+/** One axis a tier constrains. Every field is optional; an omitted field constrains nothing. */
+export interface ReleaseTierConditions {
+  /** Matches when the release carries ANY of these. Empty or absent matches every format. */
+  formats?: string[];
+  /** Whether the release is one file or several. Absent matches either. */
+  fileLayout?: ReleaseFileLayout;
+  /** Audio only, and only meaningful where the source published a bitrate. */
+  minBitrateKbps?: number;
+  /** Audio only. 1 for mono, 2 for stereo. */
+  channels?: number;
+  /** Matches when the release states ANY of these languages. */
+  languages?: string[];
+  /** Matches when the release came from ANY of these configured indexers. */
+  indexerIds?: number[];
+  minSeeders?: number;
+  maxSizeBytes?: number;
+  /** Only releases that cost no ratio. */
+  freeleechOnly?: boolean;
+  /** Excludes releases the source will refuse without a privileged account. */
+  excludeVipOnly?: boolean;
+}
+
+export interface ReleaseTier {
+  /** Stable across reorders, so a stored tier survives being dragged up the list. */
+  id: string;
+  /** The operator's own words, shown on the release row. Never translated. */
+  name: string;
+  conditions: ReleaseTierConditions;
+}
+
+/** One ordered tier list per medium. Empty means no profile, which disables the tier axis. */
+export type ReleaseProfiles = Record<BookRequestMediaKind, ReleaseTier[]>;
+
+export function emptyReleaseProfiles(): ReleaseProfiles {
+  return Object.fromEntries(BOOK_REQUEST_MEDIA_KINDS.map((kind) => [kind, []])) as ReleaseProfiles;
+}
+
+/**
+ * The release facts a tier is matched against. Structurally satisfied by `ReleaseCandidateItem`,
+ * so the picker can show a tier without a second round trip and the server can evaluate the same
+ * rules against its own candidate shape.
+ */
+export interface ReleaseTierInput {
+  formats: string[];
+  /** Null where the source reported no count, which must not be read as one file. */
+  fileCount: number | null;
+  audio: { bitrateKbps: number | null; channels: number | null } | null;
+  language: string | null;
+  indexerId: number;
+  freeleech: boolean;
+  vipOnly: boolean;
+  seeders: number | null;
+  sizeBytes: number | null;
+}
+
+/**
+ * Whether one release satisfies every condition a tier states.
+ *
+ * Where the line falls on **unstated** facts depends on whether the source could reasonably have
+ * published one, and the two cases are genuinely different:
+ *
+ * - **Bitrate and channels come from MediaInfo, which is optional per torrent and usually absent.**
+ *   MyAnonaMouse returned `{}` for every release of three separate books, so a bitrate floor that
+ *   excluded unmeasured releases excluded everything and made a profile unusable on that tracker.
+ *   These conditions therefore reject only a value that was stated and fell short. A floor reads as
+ *   "nothing measured below this", not "nothing unmeasured".
+ * - **File count and size are properties of the torrent itself**, published wherever the source
+ *   publishes anything, so silence there is a genuinely unknown release rather than an unmeasured
+ *   one, and it does not satisfy a condition about it.
+ *
+ * Seeders sit with the first group for a different reason: a source with no swarm at all reports
+ * null, and holding that against it would bar every direct download from every tier wanting seeds.
+ */
+export function releaseMatchesTier(release: ReleaseTierInput, conditions: ReleaseTierConditions): boolean {
+  const { formats, fileLayout, minBitrateKbps, channels, languages, indexerIds, minSeeders, maxSizeBytes } = conditions;
+
+  if (formats && formats.length > 0) {
+    const wanted = formats.map((format) => format.toLowerCase());
+    if (!release.formats.some((format) => wanted.includes(format.toLowerCase()))) return false;
+  }
+
+  if (fileLayout && classifyFileLayout(release.fileCount) !== fileLayout) return false;
+
+  // Stated and short fails; unstated passes. See the note above: MediaInfo is optional per torrent.
+  if (minBitrateKbps !== undefined && release.audio?.bitrateKbps != null && release.audio.bitrateKbps < minBitrateKbps) {
+    return false;
+  }
+
+  if (channels !== undefined && release.audio?.channels != null && release.audio.channels !== channels) return false;
+
+  if (languages && languages.length > 0) {
+    if (!release.language) return false;
+    // Compared by subtag rather than as strings: a tier stores the two-letter code the form
+    // offers, while a source states whatever it states. MyAnonaMouse reports "ENG", which no
+    // amount of lowercasing makes equal to "en", so a raw comparison put every one of its
+    // releases outside every tier that named a language.
+    const stated = release.language;
+    if (!languages.some((language) => languagesAgree(language, stated))) return false;
+  }
+
+  if (indexerIds && indexerIds.length > 0 && !indexerIds.includes(release.indexerId)) return false;
+
+  // Seeders are the one exception to "unstated never matches": a source with no swarm at all
+  // reports null, and holding that against a direct download would exclude every such source from
+  // every tier that asks for a healthy swarm.
+  if (minSeeders !== undefined && release.seeders !== null && release.seeders < minSeeders) return false;
+
+  if (maxSizeBytes !== undefined) {
+    if (release.sizeBytes === null) return false;
+    if (release.sizeBytes > maxSizeBytes) return false;
+  }
+
+  if (conditions.freeleechOnly === true && !release.freeleech) return false;
+  if (conditions.excludeVipOnly === true && release.vipOnly) return false;
+
+  return true;
+}
+
+/**
+ * The index of the first tier this release matches, or null for none.
+ *
+ * An empty tier list returns null for everything, which is what makes adopting this feature safe:
+ * `releaseProfileIsActive` is false, the tier axis disengages, and auto-grab keeps behaving exactly
+ * as it did before any profile existed.
+ */
+export function matchReleaseTier(release: ReleaseTierInput, tiers: readonly ReleaseTier[]): number | null {
+  const index = tiers.findIndex((tier) => releaseMatchesTier(release, tier.conditions));
+  return index === -1 ? null : index;
+}
+
+/** Whether a medium has a profile at all. False means score alone decides, as it always did. */
+export function releaseProfileIsActive(tiers: readonly ReleaseTier[] | undefined): boolean {
+  return (tiers?.length ?? 0) > 0;
+}
+
+/**
+ * Orders two releases the way the picker and the automation both must: by tier first, then by
+ * whatever the caller was already comparing. Untiered sorts after every tier.
+ *
+ * Shared so the list an approver reads and the list the automation walks cannot disagree about
+ * which release is best, which is the same reason `findGrabRefusal` is shared.
+ */
+export function compareByTier(a: number | null, b: number | null): number {
+  if (a === b) return 0;
+  if (a === null) return 1;
+  if (b === null) return -1;
+  return a - b;
+}
+
+/** Bounds on a stored profile, enforced at the DTO and echoed in the settings form. */
+export const MAX_RELEASE_TIERS = 12;
+export const MAX_RELEASE_TIER_NAME_LENGTH = 60;
diff --git a/packages/types/src/book-request-review.ts b/packages/types/src/book-request-review.ts
new file mode 100644
index 000000000..36a5d2b54
--- /dev/null
+++ b/packages/types/src/book-request-review.ts
@@ -0,0 +1,61 @@
+import type { BookDockUnitFile } from "./book-dock";
+
+/** The fields the import is compared on. Order is the order the drawer lists them in. */
+export const BOOK_REQUEST_VERIFICATION_FIELDS = ["title", "authors", "isbn13"] as const;
+export type BookRequestVerificationField = (typeof BOOK_REQUEST_VERIFICATION_FIELDS)[number];
+
+/**
+ * `unknown` is not a soft mismatch: it means one side never carried the field, so it neither
+ * earned nor cost anything. Showing it as a mismatch would blame a missing ISBN for a shortfall
+ * the title actually caused.
+ */
+export type BookRequestVerificationVerdict = "match" | "mismatch" | "unknown";
+
+export interface BookRequestVerificationRow {
+  field: BookRequestVerificationField;
+  requested: string | null;
+  imported: string | null;
+  verdict: BookRequestVerificationVerdict;
+}
+
+/**
+ * Why the check landed where it did, as a code rather than a sentence. The server's prose is
+ * still stored on the request for logs and for older clients, but the drawer localizes from this.
+ */
+export const BOOK_REQUEST_VERIFICATION_REASONS = ["isbn_match", "above_threshold", "below_threshold", "author_mismatch", "no_title"] as const;
+export type BookRequestVerificationReason = (typeof BOOK_REQUEST_VERIFICATION_REASONS)[number];
+
+export interface BookRequestVerification {
+  score: number;
+  threshold: number;
+  passed: boolean;
+  reason: BookRequestVerificationReason;
+  rows: BookRequestVerificationRow[];
+}
+
+/** One file of the imported entry. Names only: a dock path is a server path and never leaves. */
+export type BookRequestReviewFile = Pick<BookDockUnitFile, "fileName" | "fileSize" | "format" | "role">;
+
+/**
+ * Everything an approver needs to answer "what actually landed, and why is it waiting on me".
+ *
+ * The verification is recomputed against the dock entry as it stands rather than replayed from
+ * what was stored at hold time, so correcting the metadata in the Book Dock and reopening the
+ * request shows the corrected score.
+ */
+export interface BookRequestReview {
+  requestId: number;
+  /**
+   * Null when the entry this request was held over is no longer in the Book Dock. Both pointers
+   * to it are `on delete set null`, so filing or discarding it by hand empties them and leaves the
+   * request held over a file that does not exist. The drawer has to say so rather than go blank.
+   */
+  bookDockFileId: number | null;
+  /** Null when the hold was not a scoring decision: no destination folder, or the dock refused it. */
+  verification: BookRequestVerification | null;
+  /** Every file the entry is made of, in unit order. A loose single file is one row. Empty once the dock entry is gone. */
+  files: BookRequestReviewFile[];
+  totalSizeBytes: number | null;
+  /** False when the request has no library to be filed into, which force-filing cannot invent. */
+  canFile: boolean;
+}
diff --git a/packages/types/src/book-request.ts b/packages/types/src/book-request.ts
new file mode 100644
index 000000000..354b96973
--- /dev/null
+++ b/packages/types/src/book-request.ts
@@ -0,0 +1,573 @@
+import { CONCRETE_BOOK_MEDIA_KINDS, type ConcreteBookMediaKind } from "./book";
+import type { BookRequestDownloadItem } from "./download-client";
+
+export const BOOK_REQUEST_MEDIA_KINDS = CONCRETE_BOOK_MEDIA_KINDS;
+export type BookRequestMediaKind = ConcreteBookMediaKind;
+
+/** Bounds exact indexer passes before the title-and-author fallback. */
+export const MAX_BOOK_REQUEST_SEARCH_ISBNS = 8;
+
+/**
+ * A .torrent is a few kilobytes of metadata; anything larger is not one. Shared so the grab dialog
+ * refuses a file before uploading it rather than learning the ceiling from a 400.
+ */
+export const MAX_TORRENT_FILE_BYTES = 2 * 1024 * 1024;
+
+export const BOOK_REQUEST_STATUSES = [
+  "pending",
+  "approved",
+  "rejected",
+  "cancelled",
+  "searching",
+  "grabbed",
+  "downloading",
+  "importing",
+  "needs_review",
+  "available",
+  "failed",
+] as const;
+export type BookRequestStatus = (typeof BOOK_REQUEST_STATUSES)[number];
+
+/**
+ * Statuses that hold a claim on the requested work. A second request for the same work is
+ * folded into the existing one while it is in one of these; once it leaves, the work can be
+ * requested again (a rejected request may be re-argued, an available book may be removed).
+ * Kept in sync with the partial unique index on `book_requests.dedupe_key`.
+ */
+export const ACTIVE_BOOK_REQUEST_STATUSES: readonly BookRequestStatus[] = [
+  "pending",
+  "approved",
+  "searching",
+  "grabbed",
+  "downloading",
+  "importing",
+  "needs_review",
+];
+
+/**
+ * Grouping token for a title or an author name. Shared so the search list collapses exactly the
+ * candidates the server would fold into one request, rather than approximating that rule twice.
+ *
+ * The allowlist is every Unicode letter and number rather than `a-z0-9`. An ASCII title tokenizes
+ * identically either way; a Cyrillic, CJK, Greek or Arabic one used to lose every character and
+ * come back empty, which on a multilingual app meant every non-Latin title of a medium shared one
+ * key. Diacritics are still folded first, so "Les Misérables" and "les miserables" agree.
+ */
+export function normalizeWorkToken(value: string): string {
+  return value
+    .toLowerCase()
+    .normalize("NFKD")
+    .replace(/[\u0300-\u036f]/g, "")
+    .replace(/[^\p{L}\p{N}]+/gu, "");
+}
+
+function fnv1a(value: string): string {
+  let hash = 0x811c9dc5;
+  for (const char of value) {
+    hash = Math.imul(hash ^ char.codePointAt(0)!, 0x01000193) >>> 0;
+  }
+  return hash.toString(16);
+}
+
+/**
+ * A title no allowlist can tokenize - punctuation, symbols or emoji alone - hashed so it still
+ * identifies itself.
+ *
+ * Rare, and the alternative is what makes it worth handling: a token that comes back empty either
+ * collapses every such title onto one shared key, or leaves the work with no key at all. Both are
+ * wrong in the same direction, and the second requester of the day pays for it.
+ */
+function rawTitleToken(title: string): string {
+  return `x${fnv1a(title.trim().toLowerCase())}`;
+}
+
+/**
+ * The width of `book_requests.dedupe_key`. The submission DTO allows a 500-character title beside a
+ * 255-character author, so an unbounded work key overflowed the column and reached the requester as
+ * a Postgres 22001 dressed up as a 500.
+ */
+const MAX_DEDUPE_KEY = 500;
+
+/** How much of one token a shortened work key spends, chosen so two of them plus the frame fit. */
+const MAX_WORK_KEY_TOKEN = 160;
+
+/**
+ * Truncated with the full token's hash appended rather than simply cut. Two long titles sharing
+ * their first hundred and sixty characters - a series with a common prefix, a subtitle-heavy
+ * edition - would otherwise collapse onto one key, and dedupe would fold two different books into
+ * one request. `~` cannot appear in a token, so a shortened key can never collide with a whole one.
+ */
+function boundToken(token: string): string {
+  return token.length <= MAX_WORK_KEY_TOKEN ? token : `${token.slice(0, MAX_WORK_KEY_TOKEN)}~${fnv1a(token)}`;
+}
+
+/**
+ * The key two records share when they describe the same work in the same medium.
+ *
+ * Shortened only when the whole key would not fit the column, rather than at a fixed token width.
+ * A stored key is only useful while the probe still computes it: shortening one that already fits
+ * would change what every existing request of a long-titled work is filed under, and the next
+ * person to ask for that book would open a second request instead of joining theirs.
+ */
+export function bookRequestWorkKey(title: string, author: string | null | undefined, mediaKind: BookRequestMediaKind): string {
+  const titleToken = normalizeWorkToken(title) || rawTitleToken(title);
+  const authorToken = normalizeWorkToken(author ?? "");
+
+  const key = `work:${titleToken}:${authorToken}:${mediaKind}`;
+  if (key.length <= MAX_DEDUPE_KEY) return key;
+  return `work:${boundToken(titleToken)}:${boundToken(authorToken)}:${mediaKind}`;
+}
+
+/**
+ * Statuses a release may be grabbed from. `failed` is included so a bad release can be replaced
+ * without re-approving. Shared so a card cannot offer a button the grab endpoint would refuse.
+ */
+export const GRABBABLE_BOOK_REQUEST_STATUSES: readonly BookRequestStatus[] = ["approved", "searching", "failed"];
+
+export function isGrabbableBookRequestStatus(status: BookRequestStatus): boolean {
+  return GRABBABLE_BOOK_REQUEST_STATUSES.includes(status);
+}
+
+/**
+ * Whether one person is the one a request is theirs to fulfil.
+ *
+ * Usually the requester, because a self-serve row is created by the person about to fulfil it.
+ * Not always: one live request per work, so a self-fulfiller whose submission collides with
+ * somebody else's undriven request takes that row on rather than opening a second one, and
+ * `fulfillerUserId` records that it is now theirs. Null means nobody took it on, and the
+ * requester is the fulfiller by construction - which is also every row created before the
+ * column existed.
+ *
+ * Shared so the UI cannot offer an action `assertCanFulfil` would refuse, and holds no permission
+ * check: the caller still needs `book_request_self_fulfill`, or to be moderating the queue.
+ */
+export function isBookRequestFulfiller(request: Pick<BookRequestItem, "userId" | "fulfillerUserId">, userId: number | null | undefined): boolean {
+  if (userId === null || userId === undefined) return false;
+  return (request.fulfillerUserId ?? request.userId) === userId;
+}
+
+/** Statuses an approver may close by pointing at a book or Book Dock file. */
+export const FULFILLABLE_BOOK_REQUEST_STATUSES: readonly BookRequestStatus[] = [
+  "pending",
+  "approved",
+  "searching",
+  "grabbed",
+  "downloading",
+  "importing",
+  "needs_review",
+  "failed",
+];
+
+export function isFulfillableBookRequestStatus(status: BookRequestStatus): boolean {
+  return FULFILLABLE_BOOK_REQUEST_STATUSES.includes(status);
+}
+
+/**
+ * Statuses a request can still be walked back from: everything that has not settled. Stopping a
+ * grab mid-flight is the only exit a request that stalled in `downloading` or `needs_review` ever
+ * gets, so the list is deliberately wider than the pending-or-approved pair it started as.
+ */
+export const CANCELLABLE_BOOK_REQUEST_STATUSES: readonly BookRequestStatus[] = [
+  "pending",
+  "approved",
+  "searching",
+  "grabbed",
+  "downloading",
+  "importing",
+  "needs_review",
+  "failed",
+];
+
+export function isCancellableBookRequestStatus(status: BookRequestStatus): boolean {
+  return CANCELLABLE_BOOK_REQUEST_STATUSES.includes(status);
+}
+
+/**
+ * Statuses background fulfilment work may still write to. The three that are missing are the
+ * decisions a person made and expects to stand: a poll that was already in flight, an import that
+ * was already extracting or a watchdog sweep must not drag a cancelled, rejected or already-filed
+ * request back into the pipeline.
+ */
+export const WORKER_WRITABLE_BOOK_REQUEST_STATUSES: readonly BookRequestStatus[] = [
+  "pending",
+  "approved",
+  "searching",
+  "grabbed",
+  "downloading",
+  "importing",
+  "needs_review",
+  "failed",
+];
+
+/**
+ * Statuses nothing is still working on, which is what makes hiding or deleting one safe. `failed`
+ * is both settled and cancellable on purpose: it can be retried, given up on, or tidied away.
+ */
+export const SETTLED_BOOK_REQUEST_STATUSES: readonly BookRequestStatus[] = ["rejected", "cancelled", "available", "failed"];
+
+export function isSettledBookRequestStatus(status: BookRequestStatus): boolean {
+  return SETTLED_BOOK_REQUEST_STATUSES.includes(status);
+}
+
+/**
+ * Why automation handed a request back to a person, as a stable value rather than as the prose
+ * that accompanies it. The prose is written in English at the point of failure and stays as the
+ * fallback for the reasons nothing has classified; the code is what the UI translates.
+ *
+ * Parameters live in `failureMeta` rather than being interpolated into the code, so a translator
+ * can put the number wherever their language wants it.
+ */
+export const BOOK_REQUEST_HANDBACK_CODES = [
+  /** Automatic grabbing is switched off, so nothing was ever going to look for a release. */
+  "AUTOMATION_DISABLED",
+  /** The request has nowhere to file a book, which grab refuses before downloading anything. */
+  "NO_DESTINATION",
+  /** The per-request budget of automated attempts is spent. Carries `attempts`. */
+  "ATTEMPT_LIMIT",
+  /** The indexer search itself failed rather than coming back empty. Carries `detail`. */
+  "SEARCH_FAILED",
+  /**
+   * Nothing was searched, because no indexer is configured at all. Kept apart from the two states
+   * below it: the score floor and the profile are both answers about releases, and reporting one
+   * of those for a search that never ran sends the operator to tune a number that had no bearing
+   * on anything.
+   */
+  "NO_SOURCES_CONFIGURED",
+  /** Nothing was searched, because every configured indexer is switched off. A toggle away. */
+  "NO_SOURCES_ENABLED",
+  /** Indexers are enabled, but not one of them carries the requested medium. */
+  "MEDIUM_UNCOVERED",
+  /** A release profile is active for this medium and nothing the search returned fell in a tier. */
+  "PROFILE_EXCLUDED_ALL",
+  /** Everything good enough has already been tried for this request. */
+  "ALL_TRIED",
+  /** Nothing cleared the operator's score floor. Carries `floor`. */
+  "BELOW_SCORE_FLOOR",
+  /** Everything good enough was ruled out by an earlier refusal in the same pass. */
+  "ALL_BLOCKED",
+  /**
+   * Not automation at all: a self-serve request whose picker was opened and never acted on. Swept
+   * so it stops holding the dedupe claim on a work nobody is actually fetching.
+   */
+  "ABANDONED",
+] as const;
+
+export type BookRequestHandbackCode = (typeof BOOK_REQUEST_HANDBACK_CODES)[number];
+
+/** Values a handback message interpolates. Deliberately flat: these are message parameters. */
+export type BookRequestFailureMeta = Record<string, string | number>;
+
+/**
+ * Why a submission was turned down, as a stable value rather than as the sentence beside it.
+ *
+ * Every refusal the submit endpoint raises is copy this application wrote about a rule this
+ * instance applies, so a client that can only repeat the English is a client that cannot
+ * translate any of them. A refusal that originates outside - a tracker saying no - deliberately
+ * carries no code, because there is nothing to translate there either.
+ *
+ * Parameters live in `errorMeta` for the same reason handback parameters live in `failureMeta`:
+ * a translator has to be able to put the number where their language wants it.
+ */
+export const BOOK_REQUEST_SUBMIT_ERROR_CODES = [
+  /** The title was blank once trimmed, so there is no work to ask for. */
+  "SUBMIT_TITLE_REQUIRED",
+  /** Self-fulfilment was asked for by somebody who does not hold the permission. */
+  "SUBMIT_SELF_FULFIL_FORBIDDEN",
+  /** The requester named a destination library they cannot reach. */
+  "SUBMIT_LIBRARY_FORBIDDEN",
+  /** A folder was named with no library for it to sit in. */
+  "SUBMIT_FOLDER_NEEDS_LIBRARY",
+  /** The named folder belongs to some other library than the named destination. */
+  "SUBMIT_FOLDER_NOT_IN_LIBRARY",
+  /** A self-server fell through to an instance default they cannot reach. */
+  "SUBMIT_DEFAULT_LIBRARY_UNREACHABLE",
+  /** Nobody decides on this request later, so it needs a destination now. */
+  "SUBMIT_DESTINATION_REQUIRED",
+  /** The cap on self-serve downloads in flight is full. Carries `limit`. */
+  "SUBMIT_SELF_SERVE_LIMIT",
+  /** Somebody else was named as the requester by a caller who may not file on their behalf. */
+  "SUBMIT_ON_BEHALF_FORBIDDEN",
+  /** The named requester does not exist, or is not an account that could file this itself. */
+  "SUBMIT_ON_BEHALF_UNKNOWN_USER",
+] as const;
+
+export type BookRequestSubmitErrorCode = (typeof BOOK_REQUEST_SUBMIT_ERROR_CODES)[number];
+
+/** The code a submission was refused with, where it carried one. Null is "we do not know". */
+export function bookRequestSubmitErrorCode(value: unknown): BookRequestSubmitErrorCode | null {
+  return typeof value === "string" && (BOOK_REQUEST_SUBMIT_ERROR_CODES as readonly string[]).includes(value)
+    ? (value as BookRequestSubmitErrorCode)
+    : null;
+}
+
+/** Stable reasons an action against an existing request was refused. */
+export const BOOK_REQUEST_ACTION_ERROR_CODES = [
+  /** Approve and reject only apply while a request is pending. Carries `action` and `status`. */
+  "BOOK_REQUEST_NOT_PENDING",
+  /** The request has already reached a state that cannot be cancelled. Carries `status`. */
+  "BOOK_REQUEST_NOT_CANCELLABLE",
+  /** Approval cannot continue until a destination library is selected. */
+  "BOOK_REQUEST_DESTINATION_REQUIRED",
+  /** The caller is not allowed to perform the named lifecycle action. Carries `action`. */
+  "BOOK_REQUEST_ACTION_FORBIDDEN",
+  /** Another transition committed after the action read the row. Carries `action` and `status`. */
+  "BOOK_REQUEST_STALE_TRANSITION",
+] as const;
+
+export type BookRequestActionErrorCode = (typeof BOOK_REQUEST_ACTION_ERROR_CODES)[number];
+
+export function bookRequestActionErrorCode(value: unknown): BookRequestActionErrorCode | null {
+  return typeof value === "string" && (BOOK_REQUEST_ACTION_ERROR_CODES as readonly string[]).includes(value)
+    ? (value as BookRequestActionErrorCode)
+    : null;
+}
+
+/** One metadata record that contributed to a grouped work result. */
+export interface BookRequestMetadataSource {
+  providerKey: string;
+  providerId: string;
+  providerLabel: string;
+  isbn10: string | null;
+  isbn13: string | null;
+}
+
+export function normalizeBookRequestIsbn(value: string | null | undefined): string | null {
+  const normalized = (value ?? "").replace(/[^0-9Xx]/g, "").toUpperCase();
+  return normalized || null;
+}
+
+export function isValidBookRequestIsbn10(value: string): boolean {
+  if (!/^\d{9}[\dX]$/.test(value)) return false;
+  let sum = 0;
+  for (let index = 0; index < 10; index += 1) {
+    const digit = index === 9 && value[index] === "X" ? 10 : Number(value[index]);
+    sum += digit * (10 - index);
+  }
+  return sum % 11 === 0;
+}
+
+export function isValidBookRequestIsbn13(value: string): boolean {
+  if (!/^\d{13}$/.test(value) || (!value.startsWith("978") && !value.startsWith("979"))) return false;
+  let sum = 0;
+  for (let index = 0; index < 13; index += 1) {
+    sum += Number(value[index]) * (index % 2 === 0 ? 1 : 3);
+  }
+  return sum % 10 === 0;
+}
+
+export function bookRequestIsbn10To13(value: string): string {
+  const body = `978${value.slice(0, 9)}`;
+  let sum = 0;
+  for (let index = 0; index < body.length; index += 1) {
+    sum += Number(body[index]) * (index % 2 === 0 ? 1 : 3);
+  }
+  return `${body}${(10 - (sum % 10)) % 10}`;
+}
+
+/** Canonical ISBN-13, including a converted ISBN-10 where that is the only valid identifier. */
+export function canonicalizeBookRequestIsbn(isbn10: string | null | undefined, isbn13: string | null | undefined): string | null {
+  const normalized13 = normalizeBookRequestIsbn(isbn13);
+  if (normalized13 && isValidBookRequestIsbn13(normalized13)) return normalized13;
+
+  const normalized10 = normalizeBookRequestIsbn(isbn10);
+  if (normalized10 && isValidBookRequestIsbn10(normalized10)) return bookRequestIsbn10To13(normalized10);
+  return null;
+}
+
+/** The work as it looked at request time, so the request stays readable if the provider moves on. */
+export interface BookRequestWorkSnapshot {
+  title: string;
+  subtitle: string | null;
+  authors: string[];
+  seriesName: string | null;
+  seriesIndex: number | null;
+  isbn10: string | null;
+  isbn13: string | null;
+  publishedYear: number | null;
+  language: string | null;
+  coverUrl: string | null;
+  providerKey: string | null;
+  providerId: string | null;
+  metadataSources: BookRequestMetadataSource[];
+}
+
+export interface BookRequestSubscriber {
+  userId: number;
+  username: string;
+  name: string;
+}
+
+export interface BookRequestItem extends BookRequestWorkSnapshot {
+  id: number;
+  userId: number;
+  requesterUsername: string;
+  requesterName: string;
+  mediaKind: BookRequestMediaKind;
+  status: BookRequestStatus;
+  preferredFormats: string[];
+  note: string | null;
+  targetLibraryId: number | null;
+  targetLibraryName: string | null;
+  targetFolderId: number | null;
+  decidedByUserId: number | null;
+  decidedByUsername: string | null;
+  decidedAt: string | null;
+  decisionNote: string | null;
+  matchedBookId: number | null;
+  bookDockFileId: number | null;
+  /**
+   * Created by somebody fulfilling it themselves rather than asking for it. Badged in the
+   * moderation queue, and never waiting on a decision.
+   */
+  selfServe: boolean;
+  /**
+   * Who may drive fulfilment when that is not the requester, which happens when a self-fulfiller's
+   * own submission collides with somebody else's undriven request and they take it on. Null
+   * everywhere else, including on a self-serve row whose requester is its own fulfiller.
+   */
+  fulfillerUserId: number | null;
+  statusReason: string | null;
+  /**
+   * Set only where a failure has been classified, which today means automation handing a request
+   * back. Null elsewhere, and the UI falls back to `statusReason` when it is.
+   */
+  failureCode: BookRequestHandbackCode | null;
+  failureMeta: BookRequestFailureMeta | null;
+  subscribers: BookRequestSubscriber[];
+  /** The most recent grab attempt, so a card can show live progress. Null before the first grab. */
+  download: BookRequestDownloadItem | null;
+  /** Whether the signed-in user has hidden this from their own list. Never shared between users. */
+  dismissed: boolean;
+  createdAt: string;
+  updatedAt: string;
+}
+
+export interface BookRequestPage {
+  items: BookRequestItem[];
+  total: number;
+}
+
+export interface BookRequestRequesterOption {
+  userId: number;
+  username: string;
+  name: string;
+}
+
+export interface CreateBookRequestPayload extends Partial<BookRequestWorkSnapshot> {
+  title: string;
+  mediaKind: BookRequestMediaKind;
+  targetLibraryId?: number | null;
+  targetFolderId?: number | null;
+  preferredFormats?: string[];
+  note?: string | null;
+  /**
+   * Fulfil this one yourself instead of queueing it. Refused server-side without
+   * `book_request_self_fulfill`, and never inferred from the permission.
+   */
+  selfServe?: boolean;
+  /**
+   * File this on somebody else's behalf. Refused without `manage_book_requests`, and every rule
+   * the submission applies then reads from the subject rather than the caller. Omitted is the
+   * ordinary case: the caller is the requester.
+   */
+  userId?: number;
+}
+
+/**
+ * What submitting answers with. `subscribed` is the whole reason this is not just the request:
+ * one live request per work, so a submission for a work somebody already asked for attaches the
+ * caller to that row rather than opening a second, and the form says something different for each.
+ */
+export interface BookRequestSubmitResult {
+  request: BookRequestItem;
+  /** True when the work was already requested and the caller was attached to it instead. */
+  subscribed: boolean;
+}
+
+export interface DecideBookRequestPayload {
+  decisionNote?: string | null;
+  /** Approver may reroute the request to a different library than the requester picked. */
+  targetLibraryId?: number | null;
+  targetFolderId?: number | null;
+}
+
+export interface FulfillBookRequestPayload {
+  bookDockFileId?: number | null;
+  matchedBookId?: number | null;
+  note?: string | null;
+}
+
+/**
+ * What the request UI needs to annotate a metadata search result before anything is submitted:
+ * whether the library already has it, and whether someone already asked for it.
+ */
+export interface BookRequestAvailabilityQuery {
+  isbn13?: string | null;
+  title: string;
+  author?: string | null;
+  mediaKind: BookRequestMediaKind;
+  providerKey?: string | null;
+  providerId?: string | null;
+}
+
+export interface BookRequestAvailability {
+  ownedBookId: number | null;
+  existingRequestId: number | null;
+  existingRequestStatus: BookRequestStatus | null;
+  /** True when the signed-in user is the requester or already a subscriber on that request. */
+  alreadySubscribed: boolean;
+}
+
+export interface BookRequestSummary {
+  pending: number;
+  active: number;
+  mine: number;
+  /** Unfiltered, non-dismissed totals for the request-page tabs. */
+  mineTotal: number;
+  allTotal: number;
+}
+
+/**
+ * Columns the request list can be ordered by. Shared so the table cannot offer a sort the query
+ * does not know how to build, and so a rename breaks the client at compile time.
+ */
+export const BOOK_REQUEST_SORT_FIELDS = ["createdAt", "title", "mediaKind", "requester", "status"] as const;
+export type BookRequestSortField = (typeof BOOK_REQUEST_SORT_FIELDS)[number];
+
+export const BOOK_REQUEST_SORT_DIRECTIONS = ["asc", "desc"] as const;
+export type BookRequestSortDirection = (typeof BOOK_REQUEST_SORT_DIRECTIONS)[number];
+
+/** One page of the queue is the most a selection can hold, so the batch stays bounded. */
+export const BOOK_REQUEST_BULK_LIMIT = 100;
+
+export interface BulkBookRequestsPayload {
+  ids: number[];
+}
+
+/**
+ * The one bulk action that carries more than ids. A rejection is a sentence to the people who
+ * asked, and refusing forty requests for the same reason is exactly when writing it forty times
+ * is the wrong shape.
+ */
+export interface BulkRejectBookRequestsPayload extends BulkBookRequestsPayload {
+  decisionNote?: string | null;
+}
+
+export interface BookRequestBulkFailure {
+  id: number;
+  /** Named rather than numbered, because the message that carries this is read by a person. */
+  title: string;
+  reason: string;
+  errorCode: BookRequestActionErrorCode | BookRequestSubmitErrorCode | null;
+  errorMeta: BookRequestFailureMeta | null;
+}
+
+/**
+ * A bulk action is not atomic. One request may have no destination library while the rest are
+ * fine, and failing the whole batch over it would be worse than reporting it, so every id comes
+ * back in exactly one of the two lists.
+ */
+export interface BookRequestBulkResult {
+  updated: BookRequestItem[];
+  failed: BookRequestBulkFailure[];
+}
diff --git a/packages/types/src/book.ts b/packages/types/src/book.ts
index 9fe7bfe87..bf9212bea 100644
--- a/packages/types/src/book.ts
+++ b/packages/types/src/book.ts
@@ -13,16 +13,22 @@ import type { SeriesIndex } from "./series-index";
 export const BOOK_FORMATS = DEFAULT_FORMAT_PRIORITY;
 export type BookFormat = (typeof BOOK_FORMATS)[number];
 
-const AUDIO_FORMATS = new Set<string>(["m4b", "mp3", "m4a", "opus", "ogg", "flac"]);
+/** Exported as an ordered list too, so a form offering these cannot drift from what matches them. */
+export const AUDIO_FORMAT_LIST = ["m4b", "mp3", "m4a", "opus", "ogg", "flac"] as const;
+const AUDIO_FORMATS = new Set<string>(AUDIO_FORMAT_LIST);
 export function isAudioFormat(format: string): boolean {
   return AUDIO_FORMATS.has(format.toLowerCase());
 }
 
-const COMIC_FORMATS = new Set<string>(["cbz", "cbr", "cb7", "cbx"]);
+export const COMIC_FORMAT_LIST = ["cbz", "cbr", "cb7", "cbx"] as const;
+const COMIC_FORMATS = new Set<string>(COMIC_FORMAT_LIST);
 export function isComicFormat(format: string): boolean {
   return COMIC_FORMATS.has(format.toLowerCase());
 }
 
+/** What BookOrbit accepts as an ebook, and what an ebook tier may therefore ask for. */
+export const EBOOK_FORMAT_LIST = ["epub", "kepub", "mobi", "azw3", "azw", "fb2", "pdf", "djvu"] as const;
+
 export const READ_STATUSES = ["unread", "want_to_read", "reading", "on_hold", "rereading", "read", "skimmed", "abandoned"] as const;
 export type ReadStatus = (typeof READ_STATUSES)[number];
 export type ReadStatusSource = "auto" | "manual";
@@ -80,7 +86,11 @@ export type BookFileRef = {
   sizeBytes: number | null;
 };
 
-export type BookMediaKind = "ebook" | "audiobook" | "comic" | "unknown";
+/** The kinds a real file can be. `BookMediaKind` adds the case where no format identifies one. */
+export const CONCRETE_BOOK_MEDIA_KINDS = ["ebook", "audiobook", "comic"] as const;
+export type ConcreteBookMediaKind = (typeof CONCRETE_BOOK_MEDIA_KINDS)[number];
+
+export type BookMediaKind = ConcreteBookMediaKind | "unknown";
 
 export type BookMediaProfile = {
   primaryMediaKind: BookMediaKind;
diff --git a/packages/types/src/content-filter.ts b/packages/types/src/content-filter.ts
index 0a5835dbc..93f935623 100644
--- a/packages/types/src/content-filter.ts
+++ b/packages/types/src/content-filter.ts
@@ -3,6 +3,13 @@ export interface ContentFilterRules {
   excludeTagIds: number[];
   includeGenreIds: number[];
   excludeGenreIds: number[];
+  /**
+   * When set, a book that fulfilled a request this user made or joined is exempt from every rule
+   * above.
+   * Carried on the rules rather than passed alongside them so the ~30 call sites that already
+   * thread a `ContentFilterRules` through need no change; absent means today's behaviour.
+   */
+  exemptRequestsFromUserId?: number;
 }
 
 export interface ContentFilterNamedItem {
@@ -15,6 +22,7 @@ export interface ContentFilterRulesWithNames {
   excludeTags: ContentFilterNamedItem[];
   includeGenres: ContentFilterNamedItem[];
   excludeGenres: ContentFilterNamedItem[];
+  seeOwnRequestedBooks: boolean;
 }
 
 export const EMPTY_CONTENT_FILTER_RULES: ContentFilterRules = {
diff --git a/packages/types/src/download-client.ts b/packages/types/src/download-client.ts
new file mode 100644
index 000000000..2c4120283
--- /dev/null
+++ b/packages/types/src/download-client.ts
@@ -0,0 +1,370 @@
+import { REQUEST_CREDENTIAL_ERROR_CODES } from "./request-credential";
+import type { IndexerColor, ReleaseUnitChoice } from "./indexer";
+
+/**
+ * External clients an operator configures. A direct file is fetched by BookOrbit itself and is
+ * deliberately absent: it has no address, no credentials and nothing to choose, so making it a
+ * configurable client type would only ask an operator to create a record of nothing.
+ */
+export const DOWNLOAD_CLIENT_TYPES = ["qbittorrent", "transmission", "deluge"] as const;
+export type DownloadClientType = (typeof DOWNLOAD_CLIENT_TYPES)[number];
+
+/**
+ * What a client can be handed. A torrent client cannot fetch a URL and a plain downloader cannot
+ * join a swarm, so this is what decides which configured client a given grab goes to rather than
+ * simply taking the highest-priority enabled row.
+ */
+export type DownloadDelivery = "torrent" | "file";
+
+export const DOWNLOAD_CLIENT_DELIVERY: Record<DownloadClientType, DownloadDelivery> = {
+  qbittorrent: "torrent",
+  transmission: "torrent",
+  deluge: "torrent",
+};
+
+export interface DownloadClientPathMapping {
+  id: number;
+  /** The prefix the download client reports, in its own filesystem namespace. */
+  remotePath: string;
+  /** What BookOrbit has to open instead. Also the containment root for anything under it. */
+  localPath: string;
+}
+
+export interface DownloadClientPathMappingInput {
+  remotePath: string;
+  localPath: string;
+}
+
+/**
+ * Stable codes for the failures the settings form has to explain in the operator's own language.
+ * The English `message` alongside them stays useful in logs and for anything unmapped.
+ */
+export const DOWNLOAD_CLIENT_ERROR_CODES = [
+  "DOWNLOAD_CLIENT_NAME_TAKEN",
+  "DOWNLOAD_CLIENT_URL_UNSAFE",
+  "DOWNLOAD_CLIENT_URL_PRIVATE",
+  "DOWNLOAD_CLIENT_PATH_NOT_ABSOLUTE",
+  "DOWNLOAD_CLIENT_MAPPING_REQUIRED",
+  /** The test ran and the client refused or could not be reached. Carries the adapter's reason. */
+  "DOWNLOAD_CLIENT_TEST_FAILED",
+  "DOWNLOAD_CLIENT_RECONCILIATION_UNSUPPORTED",
+  "DOWNLOAD_CLIENT_RECONCILIATION_NOT_ORPHAN",
+  "DOWNLOAD_CLIENT_RECONCILIATION_NOT_ADOPTABLE",
+  ...REQUEST_CREDENTIAL_ERROR_CODES,
+] as const;
+export type DownloadClientErrorCode = (typeof DOWNLOAD_CLIENT_ERROR_CODES)[number];
+
+export interface DownloadClientItem {
+  id: number;
+  name: string;
+  color: IndexerColor | null;
+  adapterType: DownloadClientType;
+  enabled: boolean;
+  priority: number;
+  baseUrl: string;
+  username: string | null;
+  /** The password itself never leaves the server; this only says whether one is stored. */
+  hasPassword: boolean;
+  category: string;
+  useHardlinks: boolean;
+  /** Download clients usually sit on the LAN, so reaching a private address is opt-in per row. */
+  allowPrivateAddress: boolean;
+  lastTestedAt: string | null;
+  lastTestOk: boolean | null;
+  lastErrorMessage: string | null;
+  pathMappings: DownloadClientPathMapping[];
+  createdAt: string;
+  updatedAt: string;
+}
+
+/**
+ * What an approver is allowed to see: enough to pick a client, and nothing about how to reach it.
+ * Managing the rows themselves needs `ManageAppSettings`; picking one needs only
+ * `ManageBookRequests`, and a name is not a credential.
+ */
+export interface DownloadClientSummary {
+  id: number;
+  name: string;
+  color: IndexerColor | null;
+}
+
+/**
+ * The list plus the one piece of instance state the form needs up front: without an encryption
+ * key a password cannot be stored, and saying so beats a 400 after the operator has typed one.
+ */
+export interface DownloadClientListResult {
+  clients: DownloadClientItem[];
+  encryptionConfigured: boolean;
+}
+
+export interface DownloadClientReconciliationAttempt {
+  downloadId: number;
+  requestId: number;
+  requestTitle: string;
+  status: BookRequestDownloadStatus;
+}
+
+export interface DownloadClientReconciliationItem {
+  infoHash: string;
+  name: string;
+  state: "queued" | "downloading" | "completed" | "failed" | "unknown";
+  progressPercent: number;
+  trackedAttempt: DownloadClientReconciliationAttempt | null;
+  adoptableAttempts: DownloadClientReconciliationAttempt[];
+}
+
+export interface DownloadClientReconciliationResult {
+  clientId: number;
+  supported: boolean;
+  ownershipMarker: string;
+  truncated: boolean;
+  items: DownloadClientReconciliationItem[];
+  missingAttempts: DownloadClientReconciliationAttempt[];
+}
+
+export interface AdoptDownloadClientItemPayload {
+  downloadId: number;
+}
+
+export interface RemoveOrphanedDownloadClientItemPayload {
+  deleteFiles?: boolean;
+}
+
+export interface CreateDownloadClientPayload {
+  name: string;
+  color?: IndexerColor | null;
+  adapterType: DownloadClientType;
+  baseUrl: string;
+  username?: string | null;
+  password?: string | null;
+  enabled?: boolean;
+  priority?: number;
+  category?: string;
+  useHardlinks?: boolean;
+  allowPrivateAddress?: boolean;
+  pathMappings?: DownloadClientPathMappingInput[];
+}
+
+export type UpdateDownloadClientPayload = Partial<CreateDownloadClientPayload>;
+
+export interface DownloadClientTestResult {
+  success: boolean;
+  /** Client-reported version on success, so the operator can see what answered. */
+  version?: string;
+  error?: string;
+}
+
+/**
+ * Whether a hardlink from this mapping into the Book Dock actually works, established by making
+ * one rather than by comparing device ids: two bind mounts of one filesystem share a device and
+ * still refuse the link. A refusal means every import copies instead, which is supported but
+ * doubles the space.
+ */
+export const PATH_MAPPING_HARDLINK_FAILURES = ["download_dir_unwritable", "link_refused"] as const;
+
+/** Why a link could not be made, as a stable code so the settings form can translate it. */
+export type PathMappingHardlinkFailure = (typeof PATH_MAPPING_HARDLINK_FAILURES)[number];
+
+export interface PathMappingHardlinkTestResult {
+  localPathExists: boolean;
+  bookDockPathExists: boolean;
+  hardlinkWorks: boolean;
+  failure?: PathMappingHardlinkFailure;
+  /** The OS error behind `failure`, EXDEV or EPERM say. Shown verbatim; not translated. */
+  errorCode?: string;
+  /** Set only when the request itself failed, so the form can say something rather than nothing. */
+  error?: string;
+}
+
+export const BOOK_REQUEST_DOWNLOAD_STATUSES = [
+  "queued",
+  "downloading",
+  "completed",
+  "importing",
+  /** Imported, but the verification score held it in the Book Dock for a human to look at. */
+  "needs_review",
+  "imported",
+  "failed",
+] as const;
+export type BookRequestDownloadStatus = (typeof BOOK_REQUEST_DOWNLOAD_STATUSES)[number];
+
+/** Statuses the poll loop still has to ask the download client about. */
+export const ACTIVE_BOOK_REQUEST_DOWNLOAD_STATUSES: readonly BookRequestDownloadStatus[] = ["queued", "downloading"];
+
+/**
+ * Statuses that still have work behind them: a transfer running, or finished bytes waiting on an
+ * import. Removing one of these from its client takes the attempt with it, because nothing is
+ * going to finish it.
+ */
+export const IN_FLIGHT_BOOK_REQUEST_DOWNLOAD_STATUSES: readonly BookRequestDownloadStatus[] = ["queued", "downloading", "completed", "importing"];
+
+/**
+ * Statuses an attempt has not settled in. `imported` is finished with, and a `failed` one keeps
+ * the reason it first failed for, which is the one that explains what happened; every write that
+ * moves an attempt between states is conditional on it still being in one of these.
+ */
+export const UNSETTLED_BOOK_REQUEST_DOWNLOAD_STATUSES: readonly BookRequestDownloadStatus[] = [
+  ...IN_FLIGHT_BOOK_REQUEST_DOWNLOAD_STATUSES,
+  "needs_review",
+];
+
+export const BOOK_REQUEST_DOWNLOAD_SOURCES = ["magnet", "torrent_file", "direct_url"] as const;
+export type BookRequestDownloadSource = (typeof BOOK_REQUEST_DOWNLOAD_SOURCES)[number];
+
+/** Which kind of client can carry out a grab of each source. */
+export const DELIVERY_BY_DOWNLOAD_SOURCE: Record<BookRequestDownloadSource, DownloadDelivery> = {
+  magnet: "torrent",
+  torrent_file: "torrent",
+  direct_url: "file",
+};
+
+export interface BookRequestDownloadItem {
+  id: number;
+  requestId: number;
+  downloadClientId: number | null;
+  downloadClientName: string | null;
+  downloadClientColor: IndexerColor | null;
+  source: BookRequestDownloadSource;
+  /** Where the release came from, and null once that indexer row has been deleted. */
+  indexerId: number | null;
+  indexerName: string | null;
+  indexerColor: IndexerColor | null;
+  /** True when the automation picked this release, which is also what makes it eligible to retry. */
+  automated: boolean;
+  releaseTitle: string;
+  releaseSizeBytes: number | null;
+  /** Null for an attempt a source refused before there was anything to download. */
+  clientHash: string | null;
+  status: BookRequestDownloadStatus;
+  progressPercent: number;
+  downloadedBytes: number;
+  totalBytes: number | null;
+  errorMessage: string | null;
+  grabbedAt: string | null;
+  completedAt: string | null;
+  importedAt: string | null;
+  createdAt: string;
+  /**
+   * Set only while the attempt is held because the release resolved to several distinct books.
+   * Null everywhere else, including once one of them has been chosen.
+   */
+  releaseUnits: ReleaseUnitChoice[] | null;
+}
+
+export interface SelectReleaseUnitPayload {
+  unitIndex: number;
+}
+
+/**
+ * What the download client says about a torrent it is still seeding. Read live when an approver
+ * opens a request rather than polled: a seed outlives the import by weeks, and a background poll
+ * for every finished download would grow without bound.
+ */
+export interface BookRequestSeedStatus {
+  downloadId: number;
+  downloadClientId: number;
+  downloadClientName: string | null;
+  clientHash: string;
+  /** False once the client has stopped the torrent, whether by goal, by pause or by error. */
+  seeding: boolean;
+  ratio: number | null;
+  /** What the client was told to aim for at add time, when it reports one back. */
+  ratioGoal: number | null;
+  seedingTimeSeconds: number | null;
+  seedingTimeGoalMinutes: number | null;
+  uploadedBytes: number | null;
+}
+
+/**
+ * Deleting the files is opt-in and separate: the seeded copy is the one BookOrbit hardlinked
+ * from, so removing it is a real choice rather than tidying up.
+ */
+export interface RemoveBookRequestDownloadPayload {
+  deleteFiles?: boolean;
+}
+
+export interface GrabBookRequestPayload {
+  /**
+   * Exactly one of: a picked release (`indexerId` plus `releaseGuid`), a magnet, or a .torrent.
+   *
+   * A picked release is named, never linked: the server resolves the download URL from its own
+   * search results, so a client cannot point the download client at an address it chose.
+   */
+  indexerId?: number;
+  releaseGuid?: string;
+  magnet?: string;
+  torrentFileBase64?: string;
+  torrentFileName?: string;
+  downloadClientId?: number;
+}
+
+/**
+ * Why a grab could not be started, in terms of how far the refusal reaches. The English `message`
+ * says what happened; this says what a second attempt should do about it, which is the part a
+ * failover and the picker both have to act on without reading tracker prose.
+ */
+export const GRAB_FAILURE_CODES = [
+  /** The source refused this account outright, so every other release it holds is refused too. */
+  "GRAB_SOURCE_REFUSED",
+  /** The source refused a VIP-only release. Its ordinary releases are still grabbable. */
+  "GRAB_VIP_REQUIRED",
+  /** The source did not answer. Nothing else from it is worth trying in the same breath. */
+  "GRAB_SOURCE_UNAVAILABLE",
+  /** The download client would not take it, so nothing needing that client will start either. */
+  "GRAB_CLIENT_REFUSED",
+  /** The download client was temporarily unreachable or answered with a server failure. */
+  "GRAB_CLIENT_UNAVAILABLE",
+  /** This release alone: gone from the results, unimportable, or already downloading. */
+  "GRAB_RELEASE_REFUSED",
+] as const;
+export type GrabFailureCode = (typeof GRAB_FAILURE_CODES)[number];
+
+export function grabFailureCode(value: unknown): GrabFailureCode | null {
+  return typeof value === "string" && (GRAB_FAILURE_CODES as readonly string[]).includes(value) ? (value as GrabFailureCode) : null;
+}
+
+/**
+ * Whether the refusal is a property of the source rather than of the one release. Both the
+ * failover and the picker skip the rest of a source's releases on these, and only these.
+ */
+export const SOURCE_WIDE_GRAB_FAILURE_CODES: readonly GrabFailureCode[] = ["GRAB_SOURCE_REFUSED", "GRAB_SOURCE_UNAVAILABLE"];
+
+/** One release that was handed over and refused, kept for what it rules out about the others. */
+export interface GrabRefusal {
+  /** Null for a hand-pasted magnet or .torrent, which came from no source in the list. */
+  indexerId: number | null;
+  code: GrabFailureCode;
+}
+
+/**
+ * The earlier refusal that already answers for this release, if one does, so nothing is handed
+ * over to be told the same thing twice.
+ *
+ * Shared because the failover and the picker have to agree about the same list on the same
+ * screen: the automation stops trying what this rules out, and the picker stops offering it.
+ * `seedsBack` is what makes a release depend on a download client, which is why a client refusing
+ * one torrent says nothing about a source BookOrbit downloads from itself.
+ */
+export function findGrabRefusal(
+  release: { indexerId: number; vipOnly: boolean; seedsBack: boolean },
+  refusals: readonly GrabRefusal[],
+): GrabRefusal | null {
+  return (
+    refusals.find((refusal) => {
+      if (refusal.code === "GRAB_CLIENT_REFUSED" || refusal.code === "GRAB_CLIENT_UNAVAILABLE") return release.seedsBack;
+      if (refusal.indexerId !== release.indexerId) return false;
+      if (refusal.code === "GRAB_VIP_REQUIRED") return release.vipOnly;
+      return SOURCE_WIDE_GRAB_FAILURE_CODES.includes(refusal.code);
+    }) ?? null
+  );
+}
+
+/** Pushed over the request gateway so a card can move without polling. */
+export interface BookRequestProgressEvent {
+  requestId: number;
+  downloadId: number;
+  status: BookRequestDownloadStatus;
+  progressPercent: number;
+  downloadedBytes: number;
+  totalBytes: number | null;
+}
diff --git a/packages/types/src/index.ts b/packages/types/src/index.ts
index 6d072f534..24f60c51a 100644
--- a/packages/types/src/index.ts
+++ b/packages/types/src/index.ts
@@ -1,8 +1,10 @@
 export * from "./audit";
+export * from "./network-profile";
 export * from "./account-activity";
 export * from "./auth";
 export * from "./theme";
 export * from "./display-preferences";
+export * from "./language";
 export * from "./locale";
 export * from "./permissions";
 export * from "./content-filter";
@@ -31,6 +33,15 @@ export * from "./opds";
 export * from "./kobo";
 export * from "./koreader";
 export * from "./book-dock";
+export * from "./book-request";
+export * from "./book-request-automation";
+export * from "./book-request-destination";
+export * from "./book-request-preferences";
+export * from "./book-request-profile";
+export * from "./book-request-review";
+export * from "./download-client";
+export * from "./indexer";
+export * from "./request-credential";
 export * from "./file-write";
 export * from "./epub";
 export * from "./author";
diff --git a/packages/types/src/indexer.ts b/packages/types/src/indexer.ts
new file mode 100644
index 000000000..abb659238
--- /dev/null
+++ b/packages/types/src/indexer.ts
@@ -0,0 +1,599 @@
+import type { BookRequestMediaKind } from "./book-request";
+import type { BookRequestDownloadSource } from "./download-client";
+import type { NetworkProfile } from "./network-profile";
+import { REQUEST_CREDENTIAL_ERROR_CODES } from "./request-credential";
+
+/**
+ * Adapter *types* live in code; configured *instances* are database rows. Nothing here is
+ * tracker-specific beyond the type name: BookOrbit ships adapter code, never a tracker, never a
+ * credential, and no indexer is preconfigured or enabled by default.
+ *
+ * Only the generic protocol is built in. Every named source, open library or otherwise, is a
+ * plugin loaded from disk and maintained outside this repository.
+ */
+export const INDEXER_ADAPTER_TYPES = ["torznab"] as const;
+export type IndexerAdapterType = (typeof INDEXER_ADAPTER_TYPES)[number];
+
+/** Maximum size of an opaque release identifier accepted from an indexer feed and grab request. */
+export const MAX_INDEXER_RELEASE_GUID_LENGTH = 4_096;
+
+/**
+ * A built-in type name, or the slug an externally loaded adapter chose for itself. Anywhere a
+ * value arrives from the database or the wire it is this, not the closed union: a row can name an
+ * adapter this build has never heard of, and pretending otherwise is how that row goes missing.
+ */
+export type IndexerAdapterTypeName = IndexerAdapterType | (string & {});
+
+/**
+ * Hues an operator can assign to a source, so a release row says where it came from before the
+ * name is read. Stored as a slug rather than a colour: each one resolves to a token tuned per
+ * theme, which a hex value chosen by eye in one theme cannot be.
+ *
+ * Each slug resolves independently from the protocol colors, so the source remains identifiable
+ * even when a release also carries a torrent or direct-download badge.
+ */
+export const INDEXER_COLORS = ["blue", "indigo", "purple", "pink", "red", "orange", "yellow", "lime", "green", "teal"] as const;
+export type IndexerColor = (typeof INDEXER_COLORS)[number];
+
+/** Picks an unused source color until every palette entry has been assigned at least once. */
+export function pickUnusedIndexerColor(usedColors: Iterable<IndexerColor | null | undefined>): IndexerColor {
+  const used = new Set(usedColors);
+  const unused = INDEXER_COLORS.filter((color) => !used.has(color));
+  const choices = unused.length > 0 ? unused : INDEXER_COLORS;
+  return choices[Math.floor(Math.random() * choices.length)] ?? INDEXER_COLORS[0];
+}
+
+/** Which of the indexer's own categories to search for each medium a request can ask for. */
+export type IndexerCategoryMap = Record<BookRequestMediaKind, number[]>;
+
+/**
+ * Starting points, not constraints. Torznab follows the Newznab category numbering (7020 ebooks,
+ * 7030 comics, 3030 audiobooks). A source with no categories at all declares an empty map, and
+ * `INDEXER_USES_CATEGORIES` hides the editor rather than showing boxes that do nothing.
+ */
+export const DEFAULT_INDEXER_CATEGORIES: Record<IndexerAdapterType, IndexerCategoryMap> = {
+  torznab: { ebook: [7020], audiobook: [3030], comic: [7030] },
+};
+
+/** What the credential field holds. Null where the source needs none, as an open library does. */
+export const INDEXER_CREDENTIAL_KINDS: Record<IndexerAdapterType, "apiKey" | "sessionId" | null> = {
+  torznab: "apiKey",
+};
+
+/** Whether the adapter searches by numeric category at all, which decides if the editor shows. */
+export const INDEXER_USES_CATEGORIES: Record<IndexerAdapterType, boolean> = {
+  torznab: true,
+};
+
+/**
+ * Whether a grab from this source joins a swarm. Seed goals are handed to the download client at
+ * add time, so for a source that serves the file itself they are not a default to fall back on,
+ * they are meaningless, and the form must not offer them.
+ */
+export const INDEXER_SEEDS_BACK: Record<IndexerAdapterType, boolean> = {
+  torznab: true,
+};
+
+/**
+ * Which media a source can actually answer for. A source that does not serve a medium is reported
+ * as such in the picker rather than contributing an empty result that reads as "not available".
+ */
+export const INDEXER_MEDIA_KINDS: Record<IndexerAdapterType, readonly BookRequestMediaKind[]> = {
+  torznab: ["ebook", "audiobook", "comic"],
+};
+
+/**
+ * Prefilled into the form where a source has one canonical address. Still editable, for mirrors.
+ * Empty while torznab is the only built-in: its address is the operator's own proxy, and a plugin
+ * carries its own `defaultBaseUrl` rather than being listed here.
+ */
+export const INDEXER_DEFAULT_BASE_URLS: Partial<Record<IndexerAdapterType, string>> = {};
+
+/**
+ * Adapter-specific knobs. An open record rather than a fixed shape, because an adapter loaded at
+ * runtime declares its own fields and no compile-time type could know them. What may be stored is
+ * decided per adapter by its `settingsFields`, validated in the service rather than by the pipe.
+ */
+export type IndexerSettings = Record<string, unknown>;
+
+/**
+ * One configurable field an adapter wants on the settings form beyond the shared ones. Built-in
+ * adapters declare these too, so the form has a single way to render both.
+ */
+export interface IndexerSettingsField {
+  key: string;
+  type: "boolean" | "string" | "number";
+  /** For a plugin this is untranslated English; a built-in prefers its own message key. */
+  label: string;
+  hint?: string;
+  default?: boolean | string | number;
+  /**
+   * A `string` field that holds a comma-separated list, so the form can edit it as chips rather
+   * than as one long line the operator has to punctuate by hand. Opt-in: it cannot be inferred
+   * from the value, because plenty of single values legitimately contain a comma.
+   */
+  format?: "list";
+  /** When present on a list, the settings form offers choices instead of accepting arbitrary text. */
+  options?: readonly string[];
+  /** Smallest permitted list size. Constrained lists can use this to prevent an unusable empty value. */
+  minItems?: number;
+}
+
+/**
+ * Everything the settings form needs to render one adapter, served at runtime rather than
+ * compiled into the client, so an adapter that arrived from a plugin looks like any other.
+ */
+export interface IndexerAdapterDescriptor {
+  type: IndexerAdapterTypeName;
+  label: string;
+  /** False for an adapter loaded from the plugin directory, which the settings page says plainly. */
+  builtIn: boolean;
+  /** The plugin release. Omitted by built-ins and legacy plugins that do not declare one. */
+  version?: string;
+  requiresCredential: boolean;
+  credentialKind: "apiKey" | "sessionId" | null;
+  mediaKinds: BookRequestMediaKind[];
+  usesCategories: boolean;
+  seedsBack: boolean;
+  /**
+   * Whether this adapter can search an ISBN at all. The operator decides per source whether it
+   * should, because a catalogue that answers an ISBN badly is worse than one that cannot.
+   */
+  supportsIsbnSearch: boolean;
+  defaultCategories: IndexerCategoryMap;
+  defaultBaseUrl?: string;
+  /** Only a plugin sends one; a built-in has a translated message keyed on its type. */
+  baseUrlHint?: string;
+  settingsFields: IndexerSettingsField[];
+}
+
+/**
+ * What an uploaded plugin says it is, read in a child process before the file is kept anywhere.
+ *
+ * Carries the source back with it on purpose: installing a plugin runs its code in the BookOrbit
+ * process, and one dependency-free file is exactly what makes reading it first realistic.
+ */
+export interface PluginInspection {
+  type: string;
+  label: string;
+  /** The plugin release. Omitted by plugins written before versions were exposed. */
+  version?: string;
+  requiresCredential: boolean;
+  credentialKind: "apiKey" | "sessionId" | null;
+  mediaKinds: BookRequestMediaKind[];
+  usesCategories: boolean;
+  seedsBack: boolean;
+  defaultBaseUrl?: string;
+  baseUrlHint?: string;
+  settingsFields: IndexerSettingsField[];
+  /** The file as uploaded, for the operator to read before confirming. */
+  source: string;
+  /** Whether a plugin of this type is already installed, so the confirmation can say "replace". */
+  replaces: boolean;
+}
+
+/**
+ * The outcome of an install. A plugin is put to work in the running process as soon as it is
+ * written, so `active` is normally true and the page needs to say nothing about restarting; it is
+ * false only when the file is on disk but would not load here, which a restart will retry.
+ */
+export interface PluginInstallResult extends PluginInspection {
+  active: boolean;
+}
+
+/** A plugin that would not load, so the settings page can say which file failed and why. */
+export interface IndexerPluginFailure {
+  directory: string;
+  reason: string;
+}
+
+export const INDEXER_ERROR_CODES = [
+  "INDEXER_NAME_TAKEN",
+  "INDEXER_URL_UNSAFE",
+  "INDEXER_URL_PRIVATE",
+  "INDEXER_CREDENTIAL_REQUIRED",
+  "INDEXER_SETTINGS_INVALID",
+  /** The test ran and the source refused or could not be reached. Carries the adapter's reason. */
+  "INDEXER_TEST_FAILED",
+  ...REQUEST_CREDENTIAL_ERROR_CODES,
+] as const;
+export type IndexerErrorCode = (typeof INDEXER_ERROR_CODES)[number];
+
+export interface IndexerItem {
+  id: number;
+  name: string;
+  /** The operator's own colour for this source, or null while it has not been given one. */
+  color: IndexerColor | null;
+  adapterType: IndexerAdapterTypeName;
+  enabled: boolean;
+  baseUrl: string;
+  /** The key itself never leaves the server; this only says whether one is stored. */
+  hasCredential: boolean;
+  /**
+   * Off by default, unlike a download client: a public tracker has no business resolving to a
+   * private address. A self-hosted torznab proxy such as Jackett or Prowlarr is the one common
+   * exception, so it is an explicit per-row opt-in rather than a blanket relaxation.
+   */
+  allowPrivateAddress: boolean;
+  categories: IndexerCategoryMap;
+  /**
+   * Media this source is not to be searched for, on the operator's say-so rather than the
+   * adapter's. An audiobook-only tracker behind a general torznab proxy is still declared as
+   * carrying all three, and searching it for ebooks costs a request and a slot in the merge.
+   *
+   * Stated as an opt-out so a row written before a new medium existed is not silently excluded
+   * from it, and because "search everything" is the state an operator who has never opened this
+   * expects. An empty category list cannot express it: torznab reads that as "send no `cat`",
+   * which most trackers answer with their whole catalogue.
+   */
+  disabledMediaKinds: BookRequestMediaKind[];
+  /**
+   * Whether to stop handing this source an ISBN when the request states one, leaving it the title
+   * and author every other source gets.
+   *
+   * An opt-out for the same reason media kinds are: searching the identifier is the better default
+   * where a catalogue indexes it well. It is worth turning off where one does not, because an ISBN
+   * a catalogue holds against the wrong row returns a confidently wrong book, and no adapter can
+   * tell that from a right one. Ignored by a source whose adapter never searches an ISBN.
+   */
+  isbnSearchDisabled: boolean;
+  /** Adapter-specific knobs. Always an object, so the form never guards on null before reading. */
+  settings: IndexerSettings;
+  /** How the server reaches this source, where the default path does not work. */
+  networkProfile: NetworkProfile | null;
+  lastTestedAt: string | null;
+  lastTestOk: boolean | null;
+  lastErrorMessage: string | null;
+  /**
+   * How the last real search against this source went, which is a different question from the
+   * last time somebody pressed Test: a caps call can succeed against a tracker that has refused
+   * every search for a week. Null until this source has been searched at least once.
+   */
+  lastSearchAt: string | null;
+  lastSearchOk: boolean | null;
+  lastSearchError: string | null;
+  /** Consecutive failed searches, reset by any success. One failure is noise; a run of them is not. */
+  searchFailureStreak: number;
+  createdAt: string;
+  updatedAt: string;
+}
+
+/** The list plus the one instance fact the form needs up front: can a credential be stored at all. */
+export interface IndexerListResult {
+  indexers: IndexerItem[];
+  encryptionConfigured: boolean;
+}
+
+/** What this install can offer, and what it tried and failed to offer. */
+export interface IndexerAdapterListResult {
+  adapters: IndexerAdapterDescriptor[];
+  pluginFailures: IndexerPluginFailure[];
+}
+
+export interface CreateIndexerPayload {
+  name: string;
+  adapterType: IndexerAdapterTypeName;
+  baseUrl: string;
+  /** Null clears the colour, returning the source to the neutral chip. */
+  color?: IndexerColor | null;
+  credential?: string | null;
+  enabled?: boolean;
+  allowPrivateAddress?: boolean;
+  categories?: Partial<IndexerCategoryMap>;
+  disabledMediaKinds?: BookRequestMediaKind[];
+  isbnSearchDisabled?: boolean;
+  settings?: IndexerSettings;
+  networkProfile?: NetworkProfile | null;
+}
+
+export type UpdateIndexerPayload = Partial<CreateIndexerPayload>;
+
+export interface IndexerTestResult {
+  success: boolean;
+  /** What answered, when the indexer names itself. */
+  indexerName?: string;
+  error?: string;
+}
+
+/**
+ * Why a release scored the way it did, as a code plus its signed contribution, so the picker can
+ * show the reasoning in the reader's own language rather than an English sentence from the server.
+ */
+export const RELEASE_SCORE_REASONS = [
+  "isbnMatch",
+  "titleMatch",
+  "authorMatch",
+  "preferredFormat",
+  "knownFormat",
+  "unknownFormat",
+  "expectedSize",
+  "suspiciousSize",
+  "seeders",
+  "freeleech",
+  "likelySeveralBooks",
+] as const;
+export type ReleaseScoreReasonCode = (typeof RELEASE_SCORE_REASONS)[number];
+
+export interface ReleaseScoreReason {
+  code: ReleaseScoreReasonCode;
+  /** Signed contribution to the final score, already rounded. */
+  points: number;
+  /** A value the copy interpolates, such as a format or a seeder count. Never translated. */
+  detail?: string;
+}
+
+/**
+ * What an indexer publishes about a release's audio, where it publishes anything at all. Every
+ * field is independently optional: coverage is partial even on a tracker that reports it, and a
+ * missing figure must read as "not stated" rather than as a bad one.
+ */
+export interface ReleaseAudioInfo {
+  bitrateKbps: number | null;
+  /** "CBR" or "VBR", as the indexer words it. Never translated. */
+  bitrateMode: string | null;
+  channels: number | null;
+  samplingRateHz: number | null;
+  /**
+   * Only where it describes the whole release. A tracker scans one file of a multi-file set and
+   * reports seventeen seconds for a sixteen-hour book, so an implausible figure is dropped.
+   */
+  durationSeconds: number | null;
+  chapterCount: number | null;
+}
+
+/**
+ * A scored release as the picker sees it. Deliberately carries no download URL: a grab names the
+ * indexer and the release, and the server resolves the URL from its own search results, so a
+ * client can never point the download client at an address it chose.
+ */
+export interface ReleaseCandidateItem {
+  indexerId: number;
+  indexerName: string;
+  guid: string;
+  title: string;
+  sizeBytes: number | null;
+  /** Null where the indexer did not report a swarm count at all, which is not the same as zero. */
+  seeders: number | null;
+  leechers: number | null;
+  /** The primary format, preferred-first, for anywhere a single value is all that fits. */
+  format: string | null;
+  /**
+   * Every format the release claims. A tracker that lists "azw3 epub mobi" is describing one book
+   * in three formats, and carrying only the first hid such a release from a filter on a format it
+   * actually contains, while labelling it with whichever one the tracker happened to list first.
+   */
+  formats: string[];
+  language: string | null;
+  /**
+   * How many files the release carries, where the indexer states a count. Null is "not stated",
+   * which is not one file: a tier asking for a single file must not match a release whose source
+   * publishes no count at all.
+   *
+   * Counts everything the release holds, cover art and sidecars included, so it is a signal rather
+   * than a promise. The exact primary-file count needs the manifest, which costs a credentialed
+   * fetch per release and so belongs to inspection, not to search.
+   */
+  fileCount: number | null;
+  freeleech: boolean;
+  /** The tracker will refuse the download outright unless the account is VIP. */
+  vipOnly: boolean;
+  /**
+   * The account behind this indexer has already snatched this release, where the source says so.
+   * Marked on the row and never filtered on: sources report it on a delay of minutes.
+   */
+  alreadyGrabbed: boolean;
+  publishedAt: string | null;
+  /** Null where the indexer said nothing about the audio, which includes every ebook release. */
+  audio: ReleaseAudioInfo | null;
+  score: number;
+  /**
+   * Which profile tier this release fell into, best being 0, or null for none. Null where the
+   * medium has no profile at all, in which case the picker shows no tier and score alone orders
+   * the list, exactly as before profiles existed.
+   */
+  tier: number | null;
+  /** The operator's own name for that tier, carried so the row need not resolve it. */
+  tierName: string | null;
+  reasons: ReleaseScoreReason[];
+}
+
+/** Distinct enough to act on: an expired tracker session must not look like "nothing found". */
+export const INDEXER_SEARCH_FAILURES = ["unauthorized", "throttled", "timeout", "unreachable", "unsupportedMedium", "error"] as const;
+export type IndexerSearchFailure = (typeof INDEXER_SEARCH_FAILURES)[number];
+
+export interface IndexerSearchQuery {
+  kind: "isbn" | "titleAuthor";
+  /** The exact ISBN or text sent to this indexer. */
+  value: string;
+}
+
+export interface IndexerSearchStatus {
+  indexerId: number;
+  indexerName: string;
+  /**
+   * The source's assigned colour, carried alongside the name for the same reason `seedsBack` is:
+   * it belongs to the source, not to the release, and repeating it on all hundred merged releases
+   * would send the same slug a hundred times. Null where the operator has assigned none.
+   */
+  color: IndexerColor | null;
+  ok: boolean;
+  /** Releases this indexer contributed after the hard filters. */
+  count: number;
+  /** Releases it returned that the hard filters dropped, so an empty list stays explainable. */
+  filtered: number;
+  /** The one query this indexer executed. Omitted only when no matching adapter was installed. */
+  query?: IndexerSearchQuery;
+  failure?: IndexerSearchFailure;
+  error?: string;
+  /**
+   * Whether a grab from this source joins a swarm, read off the adapter rather than the row. It
+   * lives here rather than on every release because it is a property of the source: it lets the
+   * picker tell "this release omitted its seeder count" from "this source publishes none", which
+   * are the same silence and completely different facts.
+   */
+  seedsBack: boolean;
+}
+
+/** Request metadata used across indexer retrieval, hard filters, and release scoring. */
+export interface ReleaseSearchCriteria {
+  title: string;
+  authors: string[];
+  isbn10: string | null;
+  isbn13: string | null;
+  /** The one canonical ISBN-13 used for this search, or null for a title and author search. */
+  activeIsbn: string | null;
+  /** Other canonical ISBN-13 values retained as explicit searches the user can try next. */
+  isbns: string[];
+  mediaKind: BookRequestMediaKind;
+  language: string | null;
+  preferredFormats: string[];
+}
+
+/** Explicit search inputs supplied from the release picker instead of the request snapshot. */
+export interface ReleaseSearchOverrides {
+  title?: string;
+  authors?: string[];
+  /** One canonical ISBN-13. Null explicitly selects a title and author search. */
+  isbn?: string | null;
+  /** Null explicitly removes the request language filter. */
+  language?: string | null;
+  preferredFormats?: string[];
+}
+
+export interface ReleaseSearchResult {
+  releases: ReleaseCandidateItem[];
+  criteria: ReleaseSearchCriteria;
+  /** One entry per indexer that was actually searched, including the ones that failed. */
+  indexers: IndexerSearchStatus[];
+  /**
+   * Enabled indexers that do not carry the requested medium, and so were never searched. Neither a
+   * status nor a failure: nothing went wrong, and the mismatch is a permanent property of the
+   * source known before any request. Counted only, so an empty list can distinguish "nothing you
+   * have configured carries this" from "this book was not found".
+   */
+  uncoveredIndexerCount: number;
+  /**
+   * Enabled indexers at the time of the search, counted before the medium filter. Zero means
+   * nothing was searched at all, which is a different sentence from "this book was not found" and
+   * the only way the picker can tell them apart: the indexer list itself is admin-only.
+   */
+  enabledIndexerCount: number;
+  /**
+   * Indexer rows that exist, enabled or not. Separates "none configured" from "all switched off",
+   * because the second is a toggle away and telling that operator to add a source is telling them
+   * to duplicate one they already have.
+   */
+  configuredIndexerCount: number;
+  /**
+   * Whether the requested medium has a release profile at all.
+   *
+   * The picker cannot work this out from the rows. A profile that nothing matched returns every
+   * release untiered, which is byte-for-byte what no profile returns - and those two states need
+   * opposite explanations, because one of them means the automation will grab nothing.
+   */
+  profileActive: boolean;
+  searchedAt: string;
+  /** True when this came from the short-lived cache rather than a fresh hit on every tracker. */
+  cached: boolean;
+}
+
+/**
+ * How many search sources this instance has, readable by anybody who may file a request.
+ *
+ * Counts only, deliberately: names, addresses and credentials stay behind `ManageAppSettings`,
+ * and a requester needs no more than this to be told whether their request has anywhere to be
+ * fulfilled from.
+ */
+export interface BookRequestSourceStatus {
+  /** Indexer rows that exist, enabled or not. */
+  configured: number;
+  /** Of those, the ones switched on. Zero means nothing will ever be searched. */
+  enabled: number;
+}
+
+export interface InspectBookRequestReleasePayload {
+  indexerId: number;
+  releaseGuid: string;
+}
+
+export const RELEASE_FILE_INSPECTION_STATUSES = [
+  "ready",
+  "no_supported_file",
+  "multiple_supported_files",
+  "metadata_unavailable",
+  /** Packaged as RAR, ZIP or 7z: the layout is unknowable until it has been extracted. */
+  "contents_unknown",
+] as const;
+export type ReleaseFileInspectionStatus = (typeof RELEASE_FILE_INSPECTION_STATUSES)[number];
+
+/**
+ * Whether a release in this state must not be sent to a download client. Only one is: a release
+ * with no book file in it can never become an import, so sending it only wastes a download.
+ *
+ * Everything else is sent. A magnet's layout is unknowable until the swarm answers and an
+ * archive's until it is opened, and a release holding several books is a question an approver
+ * answers once it has landed rather than a reason to throw the download away.
+ *
+ * Shared so the button that hides a grab and the guard that refuses one cannot drift apart.
+ */
+export function releaseInspectionBlocksGrab(status: ReleaseFileInspectionStatus | undefined): boolean {
+  return status === "no_supported_file";
+}
+
+export interface ReleaseManifestFile {
+  /** A path from untrusted torrent metadata, sanitized and bounded before it reaches the client. */
+  path: string;
+  sizeBytes: number | null;
+  bookFile: boolean;
+}
+
+export type ReleaseUnitMediaKind = "ebook" | "audiobook" | "comic";
+
+/**
+ * One book the release resolves to. This is what lets the picker say "one audiobook of 31 tracks"
+ * rather than "31 supported book files", and it is what a later chooser selects between.
+ */
+export interface ReleaseUnitSummary {
+  mediaKind: ReleaseUnitMediaKind;
+  /** Best guess from the folder or file name, for display only. Never used for matching. */
+  title: string | null;
+  /** Content files only. Exact, and not derived from the bounded `files` display list. */
+  contentFileCount: number;
+  /** Content files plus the artwork and sidecars that travel with them. */
+  totalFileCount: number;
+  sizeBytes: number | null;
+}
+
+/**
+ * One candidate a release resolved to when it holds several distinct books. Carried on the
+ * download attempt so an approver can choose between them after the bytes have landed: failing
+ * instead would throw away a finished download over a question a human answers in seconds.
+ */
+export interface ReleaseUnitChoice extends ReleaseUnitSummary {
+  /** Position in the stored list. What the chooser route selects by. */
+  index: number;
+  /**
+   * The unit's primary file, relative to the release root. This is what a re-read of the release
+   * is matched against, so a choice survives the list being rebuilt. A path within the release, not
+   * a path on the server.
+   */
+  primaryPath: string;
+}
+
+/** The safe, credential-free result of inspecting one selected release server-side. */
+export interface ReleaseFileInspection {
+  source: BookRequestDownloadSource;
+  status: ReleaseFileInspectionStatus;
+  files: ReleaseManifestFile[];
+  /** Exact when non-null, including entries omitted from the bounded display list. */
+  totalFiles: number | null;
+  primaryFileCount: number | null;
+  truncated: boolean;
+  /** Bounded for display; `unitCount` is the exact figure. Empty when the layout is unknown. */
+  units: ReleaseUnitSummary[];
+  unitCount: number;
+  /** Files the interpreter discarded: samples, padding, junk directories. */
+  ignoredFileCount: number;
+  /** Archives found in the release. Non-zero with no units is what `contents_unknown` means. */
+  containerCount: number;
+}
diff --git a/packages/types/src/language.ts b/packages/types/src/language.ts
new file mode 100644
index 000000000..b6d95fccd
--- /dev/null
+++ b/packages/types/src/language.ts
@@ -0,0 +1,123 @@
+/**
+ * Language codes shared by the release matcher and by anything that has to offer a language to
+ * choose from.
+ *
+ * Here rather than in the server, because the two have to agree exactly. A request states a
+ * language, the matcher compares every release against it as a hard filter, and a picker offers
+ * the choice: if the offered list and the comparable set ever drift apart, a user picks a language
+ * that silently matches nothing and the request comes back empty for a book that is right there.
+ */
+
+/**
+ * Three-letter codes that do not simply truncate to their two-letter form.
+ *
+ * Sources state either. A metadata provider writes "spa" where a request states "es", and
+ * truncating "spa" to "sp" would hard-filter out every Spanish release. Both the bibliographic and
+ * terminological variants are listed, since sources use either.
+ */
+export const ISO_639_2_TO_1: Record<string, string> = {
+  alb: "sq",
+  sqi: "sq",
+  ara: "ar",
+  arm: "hy",
+  hye: "hy",
+  baq: "eu",
+  eus: "eu",
+  ben: "bn",
+  bul: "bg",
+  bur: "my",
+  mya: "my",
+  cat: "ca",
+  chi: "zh",
+  zho: "zh",
+  cze: "cs",
+  ces: "cs",
+  dan: "da",
+  dut: "nl",
+  nld: "nl",
+  est: "et",
+  fin: "fi",
+  geo: "ka",
+  kat: "ka",
+  ger: "de",
+  deu: "de",
+  gre: "el",
+  ell: "el",
+  heb: "he",
+  hin: "hi",
+  hrv: "hr",
+  hun: "hu",
+  ice: "is",
+  isl: "is",
+  ind: "id",
+  ita: "it",
+  jpn: "ja",
+  kor: "ko",
+  lav: "lv",
+  lit: "lt",
+  mac: "mk",
+  mkd: "mk",
+  mao: "mi",
+  mri: "mi",
+  may: "ms",
+  msa: "ms",
+  nor: "no",
+  per: "fa",
+  fas: "fa",
+  pol: "pl",
+  por: "pt",
+  rum: "ro",
+  ron: "ro",
+  rus: "ru",
+  slo: "sk",
+  slk: "sk",
+  slv: "sl",
+  spa: "es",
+  srp: "sr",
+  swe: "sv",
+  tha: "th",
+  tib: "bo",
+  bod: "bo",
+  tur: "tr",
+  ukr: "uk",
+  vie: "vi",
+  wel: "cy",
+  cym: "cy",
+};
+
+/**
+ * Languages that never needed a mapping, because their three-letter form truncates to the right
+ * two letters on its own. Listed because the map is not a catalogue of supported languages, only of
+ * the awkward ones, so deriving the offered list from it alone would omit these.
+ */
+const SELF_TRUNCATING_CODES = ["en", "fr", "af", "ga", "gl", "la", "nn", "sw", "ta", "te", "ur", "bs", "eo", "lb", "mt", "nb"];
+
+/** The two-letter codes offered when choosing a language. */
+export const REQUEST_LANGUAGE_CODES: readonly string[] = [...new Set([...Object.values(ISO_639_2_TO_1), ...SELF_TRUNCATING_CODES])].sort();
+
+/** Compares only the language subtag, so "en" and "eng" and "en-GB" all agree. */
+export function normalizeLanguage(value: string): string {
+  const subtag = value.toLowerCase().split(/[-_]/)[0];
+  return ISO_639_2_TO_1[subtag] ?? subtag.slice(0, 2);
+}
+
+/** Whether a release's stated language is one the request can accept. */
+export function languagesAgree(requested: string, released: string): boolean {
+  return normalizeLanguage(requested) === normalizeLanguage(released);
+}
+
+/**
+ * A language as a code the request can carry, or null.
+ *
+ * Deliberately not restricted to `REQUEST_LANGUAGE_CODES`. That list is what a person is *offered*,
+ * and it is curated; this is what a *provider* may already have stated. Narrowing here to the
+ * offered list would silently drop the language from any request for a book in something the
+ * dropdown happens not to list, turning a filter the matcher handled perfectly well into no filter
+ * at all. Anything that normalises to a plausible subtag is kept, and the matcher compares it the
+ * same way it always did.
+ */
+export function toRequestLanguage(value: string | null | undefined): string | null {
+  if (!value) return null;
+  const code = normalizeLanguage(value.trim());
+  return /^[a-z]{2}$/.test(code) ? code : null;
+}
diff --git a/packages/types/src/metadata-fetch.ts b/packages/types/src/metadata-fetch.ts
index 6b10dc1cf..d7651a219 100644
--- a/packages/types/src/metadata-fetch.ts
+++ b/packages/types/src/metadata-fetch.ts
@@ -99,6 +99,8 @@ export interface MetadataProviderInfo {
   label: string;
   identifiable: boolean;
   selectedByFieldRules?: boolean;
+  /** Zero-based priority for the effective Cover field rule. Absent when the provider is not used for covers. */
+  coverPriority?: number;
 }
 
 /**
diff --git a/packages/types/src/network-profile.ts b/packages/types/src/network-profile.ts
new file mode 100644
index 000000000..3a9b85856
--- /dev/null
+++ b/packages/types/src/network-profile.ts
@@ -0,0 +1,26 @@
+/**
+ * How the server should reach one configured source, where the default path does not work.
+ *
+ * Operator configuration, never something a plugin or an adapter chooses for itself: an adapter
+ * asks for a URL and the host decides how to get there. That split is what keeps the containment
+ * check meaningful, because the address actually connected to is still checked against the same
+ * private-address policy whichever resolver or proxy produced it.
+ */
+export interface NetworkProfile {
+  /**
+   * DNS servers to use instead of the system resolver, as plain addresses. For a source whose
+   * domain the host's own resolver refuses, or filters.
+   */
+  resolvers?: string[];
+  /**
+   * Egress through an HTTP proxy, as `http://host:port` with optional credentials. SOCKS is not
+   * supported: it needs a different dispatcher, and a proxy container that speaks HTTP is the
+   * common self-hosted shape.
+   */
+  proxyUrl?: string;
+}
+
+/** Nothing configured is the normal case, and must cost nothing at all. */
+export function hasNetworkProfile(profile: NetworkProfile | null | undefined): boolean {
+  return Boolean(profile && ((profile.resolvers && profile.resolvers.length > 0) || profile.proxyUrl));
+}
diff --git a/packages/types/src/notification.ts b/packages/types/src/notification.ts
index c58286389..0050b9f7d 100644
--- a/packages/types/src/notification.ts
+++ b/packages/types/src/notification.ts
@@ -7,6 +7,13 @@ export const NotificationType = {
   MetadataFetchFailed: "metadata_fetch_failed",
   BookDockFinalized: "book_dock_finalized",
   BookDockFinalizedWithErrors: "book_dock_finalized_with_errors",
+  BookRequestSubmitted: "book_request_submitted",
+  BookRequestApproved: "book_request_approved",
+  BookRequestRejected: "book_request_rejected",
+  BookRequestAvailable: "book_request_available",
+  BookRequestNeedsReview: "book_request_needs_review",
+  BookRequestNeedsRelease: "book_request_needs_release",
+  BookRequestFailed: "book_request_failed",
   AuthorEnrichmentCompleted: "author_enrichment_completed",
   AuthorEnrichmentFailed: "author_enrichment_failed",
   EmailSent: "email_sent",
@@ -41,6 +48,7 @@ export const NOTIFICATION_CATEGORY_IDS = [
   "scanning",
   "metadata",
   "bookDock",
+  "bookRequests",
   "authorEnrichment",
   "email",
   "migration",
@@ -71,6 +79,13 @@ export const NOTIFICATION_TYPE_META: Record<NotificationType, NotificationTypeMe
   [NotificationType.MetadataFetchFailed]: { category: "metadata", severity: "warning" },
   [NotificationType.BookDockFinalized]: { category: "bookDock", severity: "success" },
   [NotificationType.BookDockFinalizedWithErrors]: { category: "bookDock", severity: "warning" },
+  [NotificationType.BookRequestSubmitted]: { category: "bookRequests", severity: "success" },
+  [NotificationType.BookRequestApproved]: { category: "bookRequests", severity: "success" },
+  [NotificationType.BookRequestRejected]: { category: "bookRequests", severity: "warning" },
+  [NotificationType.BookRequestAvailable]: { category: "bookRequests", severity: "success" },
+  [NotificationType.BookRequestNeedsReview]: { category: "bookRequests", severity: "warning" },
+  [NotificationType.BookRequestNeedsRelease]: { category: "bookRequests", severity: "warning" },
+  [NotificationType.BookRequestFailed]: { category: "bookRequests", severity: "error" },
   [NotificationType.AuthorEnrichmentCompleted]: { category: "authorEnrichment", severity: "success" },
   [NotificationType.AuthorEnrichmentFailed]: { category: "authorEnrichment", severity: "warning" },
   [NotificationType.EmailSent]: { category: "email", severity: "success" },
diff --git a/packages/types/src/permissions.ts b/packages/types/src/permissions.ts
index 2909fb536..62f1a335a 100644
--- a/packages/types/src/permissions.ts
+++ b/packages/types/src/permissions.ts
@@ -5,6 +5,7 @@ export enum Permission {
   LibraryEditMetadata = "library_edit_metadata",
   LibraryDeleteBooks = "library_delete_books",
   BookDockAccess = "book_dock_access",
+  BookRequestAccess = "book_request_access",
   DemoRestricted = "demo_restricted",
 
   // Devices & Access
@@ -25,6 +26,9 @@ export enum Permission {
   ManageIcons = "manage_icons",
   ManageAppSettings = "manage_app_settings",
   ManageBookDock = "manage_book_dock",
+  ManageBookRequests = "manage_book_requests",
+  BookRequestAutoApprove = "book_request_auto_approve",
+  BookRequestSelfFulfill = "book_request_self_fulfill",
   ManageUsers = "manage_users",
   ViewUserActivity = "view_user_activity",
   ViewAuditLog = "view_audit_log",
@@ -39,6 +43,7 @@ export const PERMISSION_LABELS: Record<Permission, string> = {
   [Permission.LibraryEditMetadata]: "Edit metadata",
   [Permission.LibraryDeleteBooks]: "Delete books",
   [Permission.BookDockAccess]: "Book Dock",
+  [Permission.BookRequestAccess]: "Request books",
   [Permission.DemoRestricted]: "Demo restricted",
   [Permission.KoboSync]: "Kobo sync",
   [Permission.KoreaderSync]: "KOReader sync",
@@ -53,8 +58,42 @@ export const PERMISSION_LABELS: Record<Permission, string> = {
   [Permission.ManageIcons]: "Manage icons",
   [Permission.ManageAppSettings]: "App settings",
   [Permission.ManageBookDock]: "Manage Book Dock",
+  [Permission.ManageBookRequests]: "Manage book requests",
+  [Permission.BookRequestAutoApprove]: "Auto-approve requests",
+  [Permission.BookRequestSelfFulfill]: "Download books directly",
   [Permission.ManageUsers]: "Manage users",
   [Permission.ViewUserActivity]: "View user activity",
   [Permission.ViewAuditLog]: "View audit log",
   [Permission.NotificationAccess]: "Notifications",
 };
+
+/**
+ * Permissions that are inert without another one, and the dependency is enforced when permissions
+ * are assigned rather than implied when they are checked.
+ *
+ * Implying at check time would be the shorter fix and the wrong one: a token holding only
+ * `BookRequestSelfFulfill` would start passing every `BookRequestAccess` route, which is exactly
+ * the claim the authorization matrix exists to make and would no longer be true.
+ */
+export const PERMISSION_REQUIRES: Partial<Record<Permission, readonly Permission[]>> = {
+  // Self-fulfilment adds a way to fulfil a request. Listing, viewing and the live queue all
+  // answer to `BookRequestAccess`, so granting one without the other buys nothing at all.
+  [Permission.BookRequestSelfFulfill]: [Permission.BookRequestAccess],
+  // Moderating the queue is a superset of using it, not a separate thing: the summary, the detail
+  // route, the websocket, and the moderator branches of cancel and language all sit behind
+  // `BookRequestAccess`. Granted alone this produced an approver with no sidebar entry who was
+  // refused by every route except the queue list.
+  [Permission.ManageBookRequests]: [Permission.BookRequestAccess],
+  // Auto-approve only decides what happens to a request the holder submits, so it says nothing
+  // at all without the permission that lets them submit one.
+  [Permission.BookRequestAutoApprove]: [Permission.BookRequestAccess],
+};
+
+/** Every permission the given selection implies must also be held, itself included. */
+export function withRequiredPermissions(permissions: readonly Permission[]): Permission[] {
+  const resolved = new Set<Permission>(permissions);
+  for (const permission of permissions) {
+    for (const required of PERMISSION_REQUIRES[permission] ?? []) resolved.add(required);
+  }
+  return [...resolved];
+}
diff --git a/packages/types/src/request-credential.ts b/packages/types/src/request-credential.ts
new file mode 100644
index 000000000..64e59c81a
--- /dev/null
+++ b/packages/types/src/request-credential.ts
@@ -0,0 +1,8 @@
+/**
+ * Failures raised by the shared credential encryption used for every third-party secret this
+ * feature holds - tracker API keys and download client passwords alike. They live on their own
+ * rather than inside either area's list because one service raises them for both, and a settings
+ * form that only knew the download-client spelling would show an indexer save failing in English.
+ */
+export const REQUEST_CREDENTIAL_ERROR_CODES = ["REQUEST_ENCRYPTION_KEY_MISSING", "REQUEST_ENCRYPTION_KEY_CHANGED"] as const;
+export type RequestCredentialErrorCode = (typeof REQUEST_CREDENTIAL_ERROR_CODES)[number];
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 4763531ed..bea507097 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -320,6 +320,12 @@ importers:
         specifier: ^3.3.11
         version: 3.3.11(typescript@6.0.3)
 
+  packages/plugin-api:
+    devDependencies:
+      typescript:
+        specifier: ^6.0.3
+        version: 6.0.3
+
   packages/types:
     devDependencies:
       typescript:
@@ -331,6 +337,9 @@ importers:
       7z-wasm:
         specifier: ^1.2.0
         version: 1.2.0
+      '@bookorbit/plugin-api':
+        specifier: workspace:*
+        version: link:../packages/plugin-api
       '@bookorbit/types':
         specifier: workspace:*
         version: link:../packages/types
@@ -478,6 +487,9 @@ importers:
       socket.io:
         specifier: ^4.8.3
         version: 4.8.3(supports-color@10.2.2)
+      undici:
+        specifier: ^8.10.0
+        version: 8.10.0
       unzipper:
         specifier: ^0.12.5
         version: 0.12.5
diff --git a/scripts/e2e/suite-registry.mjs b/scripts/e2e/suite-registry.mjs
index cec22f35c..3885b1982 100644
--- a/scripts/e2e/suite-registry.mjs
+++ b/scripts/e2e/suite-registry.mjs
@@ -285,6 +285,31 @@ export const E2E_SUITES = Object.freeze({
       ...SHARED_DB_AND_HELPER_PATHS,
     ],
   },
+  "book-requests": {
+    id: "book-requests",
+    name: "Book Requests",
+    timeout: 90,
+    lane: "full",
+    description: "Book request lifecycle, dedupe, ownership, and plugin-route authorization suite",
+    vitestTarget: "test/book-requests.e2e-spec.ts",
+    junitOutput: `${TEST_RESULTS_DIR}/book-requests-e2e-junit.xml`,
+    prepareDedicatedDatabase: true,
+    useDedicatedDatabase: true,
+    changedPaths: [
+      "server/src/modules/book-request/**",
+      "server/src/modules/book-dock/**",
+      "server/src/modules/library/**",
+      "server/test/book-requests.e2e-spec.ts",
+      "server/test/e2e/authorization-matrix/**",
+      ".github/workflows/e2e-runner.yml",
+      "packages/types/src/book-request.ts",
+      "packages/types/src/book-request-automation.ts",
+      "packages/types/src/book-request-destination.ts",
+      "packages/types/src/indexer.ts",
+      "packages/types/src/download-client.ts",
+      ...SHARED_DB_AND_HELPER_PATHS,
+    ],
+  },
   "series-next-book": {
     id: "series-next-book",
     name: "Series Next Book",
diff --git a/server/.env.example b/server/.env.example
index 237bc49c3..a9398e989 100644
--- a/server/.env.example
+++ b/server/.env.example
@@ -26,6 +26,19 @@ APP_DATA_PATH=../local/data
 # Set this to the server-visible folder where users should create libraries.
 # LIBRARY_BROWSE_ROOT=../local/books
 
+# Staging area a fulfilled book request is filed through. Defaults to <APP_DATA_PATH>/book-dock.
+#
+# Put this inside the same mount as your download client's completed directory. A finished
+# download is hardlinked into the dock so the torrent keeps seeding from the same bytes, and two
+# separate bind mounts of one filesystem still refuse the link even though they report the same
+# device: under Docker or Kubernetes that means every fulfilment silently copies and uses the
+# space twice. Linux fs.protected_hardlinks=1 also requires the BookOrbit process user to own the
+# completed source file or be able to write it. Run BookOrbit and the download client with the same
+# UID, or use a shared group that grants BookOrbit write access to completed files. The per-mapping
+# test under Settings > System > Requests creates a BookOrbit-owned file, so it validates the mount
+# and paths but cannot prove that a differently-owned completed file is linkable.
+# BOOK_DOCK_PATH=../local/data/book-dock
+
 # File write scheduler and concurrency tuning (optional)
 # FILE_WRITE_DEBOUNCE_MS=3000
 # FILE_WRITE_MAX_CONCURRENT_WRITES=2
@@ -63,6 +76,12 @@ APP_URL=http://localhost:5173
 # Generate with: openssl rand -hex 32
 # MIGRATION_ENCRYPTION_KEY=
 
+# Book request encryption key (required before a download client or indexer can be saved).
+# Unlike the two keys above, credentials are refused rather than stored in the clear when this
+# is unset. 64-char hex string for AES-256.
+# Generate with: openssl rand -hex 32
+# BOOK_REQUEST_ENCRYPTION_KEY=
+
 # Server-side root containing migration backup files (optional).
 # Use a dedicated read-only mount. Backup paths submitted through the migration API
 # must be absolute and resolve inside this root.
diff --git a/server/package.json b/server/package.json
index 1f974106a..6a8debb14 100644
--- a/server/package.json
+++ b/server/package.json
@@ -15,10 +15,10 @@
   },
   "scripts": {
     "setup:kobo-cloudscraper": "tsx src/scripts/setup-kobo-cloudscraper.ts",
-    "prestart": "pnpm --filter @bookorbit/types build",
-    "prestart:dev": "pnpm --filter @bookorbit/types build",
-    "prestart:debug": "pnpm --filter @bookorbit/types build",
-    "prebuild": "pnpm --filter @bookorbit/types build && pnpm clean:swagger-metadata",
+    "prestart": "pnpm --filter @bookorbit/types build && pnpm --filter @bookorbit/plugin-api build",
+    "prestart:dev": "pnpm --filter @bookorbit/types build && pnpm --filter @bookorbit/plugin-api build",
+    "prestart:debug": "pnpm --filter @bookorbit/types build && pnpm --filter @bookorbit/plugin-api build",
+    "prebuild": "pnpm --filter @bookorbit/types build && pnpm --filter @bookorbit/plugin-api build && pnpm clean:swagger-metadata",
     "clean:swagger-metadata": "node -e \"require('node:fs').rmSync('src/metadata.ts', { force: true })\"",
     "build": "nest build",
     "format": "prettier --write \"src/**/*.ts\" \"test/**/*.ts\"",
@@ -39,7 +39,7 @@
     "whats-new:lint": "tsx src/scripts/whats-new-lint.ts",
     "whats-new:check": "tsx src/scripts/whats-new-check.ts",
     "whats-new:images": "tsx src/scripts/whats-new-images.ts",
-    "pretype-check": "pnpm --filter @bookorbit/types build",
+    "pretype-check": "pnpm --filter @bookorbit/types build && pnpm --filter @bookorbit/plugin-api build",
     "type-check": "tsc --noEmit -p tsconfig.build.json",
     "lint": "pnpm run lint:check",
     "prelint:check": "pnpm --filter @bookorbit/types build",
@@ -53,6 +53,7 @@
   },
   "dependencies": {
     "7z-wasm": "^1.2.0",
+    "@bookorbit/plugin-api": "workspace:*",
     "@bookorbit/types": "workspace:*",
     "@fastify/compress": "^9.2.0",
     "@fastify/cookie": "^11.1.2",
@@ -102,6 +103,7 @@
     "rxjs": "^7.8.2",
     "sharp": "^0.35.4",
     "socket.io": "^4.8.3",
+    "undici": "^8.10.0",
     "unzipper": "^0.12.5",
     "zod": "^4.4.3"
   },
diff --git a/server/src/app.module.ts b/server/src/app.module.ts
index bc46bf496..a6a06a0e9 100644
--- a/server/src/app.module.ts
+++ b/server/src/app.module.ts
@@ -5,7 +5,17 @@ import { ScheduleModule } from '@nestjs/schedule';
 import { ThrottlerModule } from '@nestjs/throttler';
 import { LoggerModule } from 'nestjs-pino';
 
-import { appConfig, authConfig, dbConfig, emailConfig, fileWriteConfig, migrationConfig, oidcRuntimeConfig, storageConfig } from './config/config';
+import {
+  appConfig,
+  authConfig,
+  bookRequestConfig,
+  dbConfig,
+  emailConfig,
+  fileWriteConfig,
+  migrationConfig,
+  oidcRuntimeConfig,
+  storageConfig,
+} from './config/config';
 import { validateEnv } from './config/env.validation';
 import { loggerConfig } from './common/logger.config';
 import { CommonModule } from './common/common.module';
@@ -44,6 +54,7 @@ import { SeedModule } from './modules/seed/seed.module';
 import { EmailModule } from './modules/email/email.module';
 import { EpubModule } from './modules/reader/epub/epub.module';
 import { BookDockModule } from './modules/book-dock/book-dock.module';
+import { BookRequestModule } from './modules/book-request/book-request.module';
 import { BrowseCountsModule } from './modules/browse-counts/browse-counts.module';
 import { UploadModule } from './modules/upload/upload.module';
 import { UserModule } from './modules/user/user.module';
@@ -83,7 +94,7 @@ import { BookMoveModule } from './modules/book-move/book-move.module';
     ConfigModule.forRoot({
       isGlobal: true,
       validate: validateEnv,
-      load: [appConfig, dbConfig, authConfig, storageConfig, fileWriteConfig, emailConfig, migrationConfig, oidcRuntimeConfig],
+      load: [appConfig, dbConfig, authConfig, storageConfig, fileWriteConfig, emailConfig, migrationConfig, bookRequestConfig, oidcRuntimeConfig],
     }),
     ScheduleModule.forRoot(),
     ThrottlerModule.forRoot({
@@ -132,6 +143,7 @@ import { BookMoveModule } from './modules/book-move/book-move.module';
     UserPreferencesModule,
     EpubModule,
     BookDockModule,
+    BookRequestModule,
     EmailModule,
     MetadataScoreModule,
     StatisticsModule,
diff --git a/server/src/common/archive/release-archive-sevenzip.test.ts b/server/src/common/archive/release-archive-sevenzip.test.ts
new file mode 100644
index 000000000..3049f277e
--- /dev/null
+++ b/server/src/common/archive/release-archive-sevenzip.test.ts
@@ -0,0 +1,59 @@
+import { mkdtemp, readFile, rm, writeFile } from 'fs/promises';
+import { join } from 'path';
+import { tmpdir } from 'os';
+
+import { createSevenZipTempId, getSevenZip } from '../sevenzip';
+import { extractReleaseArchive } from './release-archive';
+
+/**
+ * The 7z path plans against sizes read from the expanded tree rather than against its contents,
+ * which is a claim about a real WASM filesystem. The rest of the 7z coverage stands on a fake one,
+ * so this is the test that would catch the fake and the real module disagreeing.
+ */
+describe('extractReleaseArchive against the real 7z module', () => {
+  let workspace: string;
+
+  beforeEach(async () => {
+    workspace = await mkdtemp(join(tmpdir(), 'bookorbit-7z-real-'));
+  });
+
+  afterEach(async () => {
+    await rm(workspace, { recursive: true, force: true });
+  });
+
+  /** Built by the same module that reads it, because nothing else here can produce a 7z. */
+  async function buildSevenZip(files: Record<string, string>): Promise<string> {
+    const sevenZip = await getSevenZip();
+    const root = `/${createSevenZipTempId('build')}`;
+    sevenZip.FS.mkdir(root);
+    for (const [name, contents] of Object.entries(files)) {
+      const segments = name.split('/');
+      for (let depth = 1; depth < segments.length; depth++) {
+        try {
+          sevenZip.FS.mkdir(`${root}/${segments.slice(0, depth).join('/')}`);
+        } catch {
+          // already there
+        }
+      }
+      const fd = sevenZip.FS.open(`${root}/${name}`, 'w+');
+      const bytes = new TextEncoder().encode(contents);
+      sevenZip.FS.write(fd, bytes, 0, bytes.length);
+      sevenZip.FS.close(fd);
+    }
+
+    sevenZip.callMain(['a', `${root}/release.7z`, `${root}/*`, '-y']);
+    const archive = join(workspace, 'release.7z');
+    await writeFile(archive, sevenZip.FS.readFile(`${root}/release.7z`));
+    return archive;
+  }
+
+  it('expands a real archive, folders and all', async () => {
+    const archive = await buildSevenZip({ 'Dune.epub': 'book bytes', 'art/cover.jpg': 'image bytes' });
+    const target = join(workspace, 'out');
+
+    await extractReleaseArchive(archive, '7z', target);
+
+    expect(await readFile(join(target, 'Dune.epub'), 'utf8')).toBe('book bytes');
+    expect(await readFile(join(target, 'art', 'cover.jpg'), 'utf8')).toBe('image bytes');
+  });
+});
diff --git a/server/src/common/archive/release-archive.test.ts b/server/src/common/archive/release-archive.test.ts
new file mode 100644
index 000000000..c0b80a72d
--- /dev/null
+++ b/server/src/common/archive/release-archive.test.ts
@@ -0,0 +1,433 @@
+import { mkdtemp, readdir, readFile, lstat, rm, writeFile } from 'fs/promises';
+import { join } from 'path';
+import { tmpdir } from 'os';
+import { deflateRawSync } from 'zlib';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+
+import { getSevenZip } from '../sevenzip';
+import { ARCHIVE_BOUNDS, createArchiveBudget, extractReleaseArchive, ReleaseArchiveError } from './release-archive';
+
+/** The real module loads a WASM binary; only the filesystem it hands back matters here. */
+vi.mock('../sevenzip', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('../sevenzip')>()),
+  getSevenZip: vi.fn(),
+}));
+
+/**
+ * Zips are built by hand rather than shelled out to, because every test here is about an archive
+ * a normal tool would refuse to produce: a lying size field, a traversal path, an encryption flag.
+ */
+interface ZipEntry {
+  name: string;
+  contents: Buffer;
+  /** Overrides the real uncompressed size in both headers, to fake a decompression bomb. */
+  declaredSize?: number;
+  encrypted?: boolean;
+  deflate?: boolean;
+}
+
+function crc32(buffer: Buffer): number {
+  let crc = ~0;
+  for (const byte of buffer) {
+    crc ^= byte;
+    for (let bit = 0; bit < 8; bit++) crc = (crc >>> 1) ^ (0xedb88320 & -(crc & 1));
+  }
+  return ~crc >>> 0;
+}
+
+function buildZip(entries: ZipEntry[]): Buffer {
+  const locals: Buffer[] = [];
+  const centrals: Buffer[] = [];
+  let offset = 0;
+
+  for (const entry of entries) {
+    const name = Buffer.from(entry.name, 'utf8');
+    const stored = entry.deflate ? deflateRawSync(entry.contents) : entry.contents;
+    const declaredSize = entry.declaredSize ?? entry.contents.length;
+    const flags = entry.encrypted ? 0x1 : 0x0;
+    const method = entry.deflate ? 8 : 0;
+
+    const local = Buffer.alloc(30);
+    local.writeUInt32LE(0x04034b50, 0);
+    local.writeUInt16LE(20, 4);
+    local.writeUInt16LE(flags, 6);
+    local.writeUInt16LE(method, 8);
+    local.writeUInt32LE(crc32(entry.contents), 14);
+    local.writeUInt32LE(stored.length, 18);
+    local.writeUInt32LE(declaredSize, 22);
+    local.writeUInt16LE(name.length, 26);
+    locals.push(local, name, stored);
+
+    const central = Buffer.alloc(46);
+    central.writeUInt32LE(0x02014b50, 0);
+    central.writeUInt16LE(20, 4);
+    central.writeUInt16LE(20, 6);
+    central.writeUInt16LE(flags, 8);
+    central.writeUInt16LE(method, 10);
+    central.writeUInt32LE(crc32(entry.contents), 16);
+    central.writeUInt32LE(stored.length, 20);
+    central.writeUInt32LE(declaredSize, 24);
+    central.writeUInt16LE(name.length, 28);
+    central.writeUInt32LE(offset, 42);
+    centrals.push(central, name);
+
+    offset += local.length + name.length + stored.length;
+  }
+
+  const centralBytes = Buffer.concat(centrals);
+  const end = Buffer.alloc(22);
+  end.writeUInt32LE(0x06054b50, 0);
+  end.writeUInt16LE(entries.length, 8);
+  end.writeUInt16LE(entries.length, 10);
+  end.writeUInt32LE(centralBytes.length, 12);
+  end.writeUInt32LE(offset, 16);
+
+  return Buffer.concat([...locals, centralBytes, end]);
+}
+
+/**
+ * Every runtime bound is measured in gigabytes, which is not a thing a test can stream. The
+ * constant is lowered for the case under test and restored afterwards, so what is proven is that
+ * the metering happens rather than how large the number it compares against is.
+ */
+const mutableBounds = ARCHIVE_BOUNDS as unknown as Record<keyof typeof ARCHIVE_BOUNDS, number>;
+
+async function withBounds(overrides: Partial<Record<keyof typeof ARCHIVE_BOUNDS, number>>, body: () => Promise<void>): Promise<void> {
+  const original = { ...mutableBounds };
+  Object.assign(mutableBounds, overrides);
+  try {
+    await body();
+  } finally {
+    Object.assign(mutableBounds, original);
+  }
+}
+
+describe('extractReleaseArchive with a ZIP', () => {
+  let workspace: string;
+  let target: string;
+
+  beforeEach(async () => {
+    workspace = await mkdtemp(join(tmpdir(), 'bookorbit-archive-'));
+    target = join(workspace, 'out');
+  });
+
+  afterEach(async () => {
+    await rm(workspace, { recursive: true, force: true });
+  });
+
+  async function extract(entries: ZipEntry[]): Promise<void> {
+    const archive = join(workspace, 'release.zip');
+    await writeFile(archive, buildZip(entries));
+    await extractReleaseArchive(archive, 'zip', target);
+  }
+
+  it('extracts an ordinary release into the target folder', async () => {
+    await extract([
+      { name: 'Dune.epub', contents: Buffer.from('book bytes') },
+      { name: 'cover.jpg', contents: Buffer.from('image bytes') },
+    ]);
+
+    expect((await readdir(target)).sort()).toEqual(['Dune.epub', 'cover.jpg']);
+    expect(await readFile(join(target, 'Dune.epub'), 'utf8')).toBe('book bytes');
+  });
+
+  it('keeps the folder structure inside the archive', async () => {
+    await extract([{ name: 'Dune/CD 1/track-01.mp3', contents: Buffer.from('audio') }]);
+
+    expect(await readFile(join(target, 'Dune', 'CD 1', 'track-01.mp3'), 'utf8')).toBe('audio');
+  });
+
+  it('refuses an entry that escapes the extraction folder', async () => {
+    await expect(extract([{ name: '../escaped.epub', contents: Buffer.from('nope') }])).rejects.toThrow(/escapes the extraction folder/);
+    await expect(readdir(join(workspace))).resolves.not.toContain('escaped.epub');
+  });
+
+  it('refuses a deeply disguised traversal', async () => {
+    await expect(extract([{ name: 'a/b/../../../escaped.epub', contents: Buffer.from('nope') }])).rejects.toThrow(ReleaseArchiveError);
+  });
+
+  it('refuses an absolute path', async () => {
+    await expect(extract([{ name: '/path/to/escaped.epub', contents: Buffer.from('nope') }])).rejects.toThrow(/absolute path/);
+  });
+
+  it('refuses a password protected archive rather than writing unreadable bytes', async () => {
+    await expect(extract([{ name: 'Dune.epub', contents: Buffer.from('encrypted'), encrypted: true }])).rejects.toThrow(/password protected/);
+  });
+
+  /** A bomb declares its true expanded size; the ratio check catches it before anything is written. */
+  it('refuses a decompression bomb before writing a byte', async () => {
+    const contents = Buffer.alloc(2 * 1024 * 1024, 0);
+    await expect(extract([{ name: 'bomb.epub', contents, deflate: true }])).rejects.toThrow(/compressed far beyond/);
+    await expect(readdir(target)).resolves.toEqual([]);
+  });
+
+  /**
+   * Each entry is individually unremarkable - exactly a megabyte, so the ratio rule does not even
+   * apply to it - and it is only the sum that is refused.
+   */
+  it('refuses an archive whose entries add up past the total bound', async () => {
+    const declaredSize = 1024 * 1024;
+    const count = Math.floor(ARCHIVE_BOUNDS.maxTotalBytes / declaredSize) + 8;
+    const entries = Array.from({ length: count }, (_, index) => ({ name: `part-${index}.epub`, contents: Buffer.from('x'), declaredSize }));
+
+    await expect(extract(entries)).rejects.toThrow(/more than BookOrbit will extract/);
+    await expect(readdir(target)).resolves.toEqual([]);
+  });
+
+  it('refuses an entry larger on its own than the per-entry bound', async () => {
+    const declaredSize = ARCHIVE_BOUNDS.maxEntryBytes + 1;
+    await expect(extract([{ name: 'huge.epub', contents: Buffer.from('x'), declaredSize }])).rejects.toThrow(/larger than BookOrbit will extract/);
+  });
+
+  it('refuses an archive with more entries than the bound', async () => {
+    const entries = Array.from({ length: ARCHIVE_BOUNDS.maxEntries + 1 }, (_, index) => ({
+      name: `book-${index}.epub`,
+      contents: Buffer.from('x'),
+    }));
+    await expect(extract(entries)).rejects.toThrow(/more than 5000 files/);
+  });
+
+  it('refuses an empty archive', async () => {
+    await expect(extract([])).rejects.toThrow(/empty/);
+  });
+
+  it('refuses a file that is not a readable archive', async () => {
+    const archive = join(workspace, 'broken.zip');
+    await writeFile(archive, Buffer.from('this is not a zip'));
+    await expect(extractReleaseArchive(archive, 'zip', target)).rejects.toThrow(/could not be read/);
+  });
+
+  /** Nothing here ever calls symlink(), so a link entry lands as an ordinary file of its target. */
+  it('writes a symlink entry as a plain file rather than creating a link', async () => {
+    await extract([{ name: 'link', contents: Buffer.from('/etc/passwd') }]);
+
+    const info = await lstat(join(target, 'link'));
+    expect(info.isSymbolicLink()).toBe(false);
+    expect(info.isFile()).toBe(true);
+  });
+
+  /**
+   * Scene ebook packaging is a zip holding a rar holding the book, so the budget has to span the
+   * passes: charging each archive its own ceiling would let a two-level release spend twice.
+   */
+  describe('across nested extraction passes', () => {
+    it('spends one budget between passes rather than one each', async () => {
+      // Against the real ceiling this needed two thousand entries per pass to reach four
+      // gigabytes of declarations, which is four thousand files written for an assertion about
+      // arithmetic - slow enough to cross the default test deadline under load. The ceiling is
+      // lowered instead: what is proven is that the budget spans the passes, not its size.
+      await withBounds({ maxTotalBytes: 8 * 1024 * 1024 }, async () => {
+        const declaredSize = 1024 * 1024;
+        // Six megabytes of declarations fits under the ceiling; twelve, across both passes, does not.
+        const entries = Array.from({ length: 6 }, (_, index) => ({
+          name: `part-${index}.epub`,
+          contents: Buffer.from('x'),
+          declaredSize,
+        }));
+
+        const budget = createArchiveBudget();
+        const first = join(workspace, 'first.zip');
+        const second = join(workspace, 'second.zip');
+        await writeFile(first, buildZip(entries));
+        await writeFile(second, buildZip(entries));
+
+        // Each half fits on its own; together they do not.
+        await extractReleaseArchive(first, 'zip', join(target, 'a'), budget);
+        await expect(extractReleaseArchive(second, 'zip', join(target, 'b'), budget)).rejects.toThrow(/more than BookOrbit will extract/);
+      });
+    });
+
+    /**
+     * The counter that meters bytes as they land used to be declared inside the extraction, so a
+     * nested archive got a fresh one per pass and could spend the runtime ceiling once per level.
+     * Only the declared sizes were shared, and those are exactly what a hostile archive lies about.
+     */
+    it('spends one runtime budget between passes even when every size is understated', async () => {
+      await withBounds({ maxTotalBytes: 8 * 1024 }, async () => {
+        const contents = Buffer.alloc(6 * 1024, 'x');
+        const budget = createArchiveBudget();
+        const first = join(workspace, 'first.zip');
+        const second = join(workspace, 'second.zip');
+        // Each declares a kilobyte and streams six, so nothing is refused while planning.
+        await writeFile(first, buildZip([{ name: 'a.epub', contents, declaredSize: 1024 }]));
+        await writeFile(second, buildZip([{ name: 'b.epub', contents, declaredSize: 1024 }]));
+
+        await extractReleaseArchive(first, 'zip', join(target, 'a'), budget);
+        await expect(extractReleaseArchive(second, 'zip', join(target, 'b'), budget)).rejects.toThrow(/more than BookOrbit will extract/);
+      });
+    });
+
+    /** The per-entry ceiling was only ever applied to the claim, never to what actually arrived. */
+    it('aborts an entry that declares a kilobyte and then streams past the per-file ceiling', async () => {
+      await withBounds({ maxEntryBytes: 4 * 1024 }, async () => {
+        const archive = join(workspace, 'liar.zip');
+        await writeFile(archive, buildZip([{ name: 'Dune.epub', contents: Buffer.alloc(16 * 1024, 'x'), declaredSize: 1024 }]));
+
+        await expect(extractReleaseArchive(archive, 'zip', target)).rejects.toThrow(/larger than BookOrbit will extract/);
+      });
+    });
+
+    it('starts a fresh budget for an unrelated release', async () => {
+      const archive = join(workspace, 'release.zip');
+      await writeFile(archive, buildZip([{ name: 'Dune.epub', contents: Buffer.from('book') }]));
+
+      await extractReleaseArchive(archive, 'zip', join(target, 'a'));
+      await expect(extractReleaseArchive(archive, 'zip', join(target, 'b'))).resolves.toBeUndefined();
+    });
+  });
+});
+
+const DIR_MODE = 0o040755;
+const FILE_MODE = 0o100644;
+
+/**
+ * The 7z path expands into a filesystem that belongs to a single shared WASM instance, which is
+ * what makes two extractions at once interesting: they are neighbours in one tree rather than
+ * strangers in two.
+ */
+class FakeVfs {
+  readonly files = new Map<string, Uint8Array>();
+  readonly dirs = new Set<string>();
+  readonly reads: string[] = [];
+  readonly made: string[] = [];
+
+  mkdir(path: string): void {
+    if (this.dirs.has(path)) throw new Error(`EEXIST: ${path}`);
+    this.dirs.add(path);
+    this.made.push(path);
+  }
+
+  open(): number {
+    return 1;
+  }
+
+  write(): number {
+    return 0;
+  }
+
+  close(): void {}
+
+  writeAt(path: string, contents: string): void {
+    for (const parent of parentsOf(path)) this.dirs.add(parent);
+    this.files.set(path, new TextEncoder().encode(contents));
+  }
+
+  readdir(path: string): string[] {
+    if (!this.dirs.has(path)) throw new Error(`ENOENT: ${path}`);
+    const names = new Set<string>();
+    for (const candidate of [...this.files.keys(), ...this.dirs]) {
+      if (!candidate.startsWith(`${path}/`)) continue;
+      names.add(candidate.slice(path.length + 1).split('/')[0]!);
+    }
+    return ['.', '..', ...names];
+  }
+
+  stat(path: string): { mode: number; size: number } {
+    const file = this.files.get(path);
+    if (file) return { mode: FILE_MODE, size: file.length };
+    if (this.dirs.has(path)) return { mode: DIR_MODE, size: 0 };
+    throw new Error(`ENOENT: ${path}`);
+  }
+
+  isDir(mode: number): boolean {
+    return mode === DIR_MODE;
+  }
+
+  readFile(path: string): Uint8Array {
+    const file = this.files.get(path);
+    if (!file) throw new Error(`ENOENT: ${path}`);
+    this.reads.push(path);
+    return file;
+  }
+
+  unlink(path: string): void {
+    if (!this.files.delete(path)) throw new Error(`EISDIR: ${path}`);
+  }
+
+  rmdir(path: string): void {
+    this.dirs.delete(path);
+  }
+}
+
+function parentsOf(path: string): string[] {
+  const segments = path.split('/').slice(1, -1);
+  return segments.map((_, index) => `/${segments.slice(0, index + 1).join('/')}`);
+}
+
+describe('extractReleaseArchive with a 7z', () => {
+  let workspace: string;
+  let vfs: FakeVfs;
+
+  beforeEach(async () => {
+    workspace = await mkdtemp(join(tmpdir(), 'bookorbit-7z-'));
+    vfs = new FakeVfs();
+  });
+
+  afterEach(async () => {
+    await rm(workspace, { recursive: true, force: true });
+    vi.mocked(getSevenZip).mockReset();
+  });
+
+  /** `x` writes the payload wherever the caller asked for it, which is what the real one does. */
+  function mountSevenZip(payload: Record<string, string>): void {
+    const callMain = vi.fn((args: string[]) => {
+      const outDir = args.find((arg) => arg.startsWith('-o'))!.slice(2);
+      for (const [name, contents] of Object.entries(payload)) vfs.writeAt(`${outDir}/${name}`, contents);
+    });
+    vi.mocked(getSevenZip).mockResolvedValue({ FS: vfs, callMain } as never);
+  }
+
+  async function archiveAt(name: string): Promise<string> {
+    const path = join(workspace, name);
+    await writeFile(path, Buffer.from('7z\xbc\xaf\x27\x1c'));
+    return path;
+  }
+
+  it('writes what the archive held into the target folder', async () => {
+    mountSevenZip({ 'Dune.epub': 'book bytes', 'art/cover.jpg': 'image bytes' });
+
+    await extractReleaseArchive(await archiveAt('release.7z'), '7z', join(workspace, 'out'));
+
+    expect(await readFile(join(workspace, 'out', 'Dune.epub'), 'utf8')).toBe('book bytes');
+    expect(await readFile(join(workspace, 'out', 'art', 'cover.jpg'), 'utf8')).toBe('image bytes');
+  });
+
+  /**
+   * The working directory used to be named from the clock, so two extractions starting in the same
+   * millisecond took the same path: one failed to create it and the other's `finally` deleted the
+   * tree the survivor was still reading.
+   */
+  it('gives two concurrent extractions separate trees', async () => {
+    mountSevenZip({});
+    const callMain = vi.fn((args: string[]) => {
+      const outDir = args.find((arg) => arg.startsWith('-o'))!.slice(2);
+      vfs.writeAt(`${outDir}/book.epub`, outDir);
+    });
+    vi.mocked(getSevenZip).mockResolvedValue({ FS: vfs, callMain } as never);
+
+    const [first, second] = [join(workspace, 'a'), join(workspace, 'b')];
+    await Promise.all([
+      extractReleaseArchive(await archiveAt('first.7z'), '7z', first),
+      extractReleaseArchive(await archiveAt('second.7z'), '7z', second),
+    ]);
+
+    const landed = await Promise.all([readFile(join(first, 'book.epub'), 'utf8'), readFile(join(second, 'book.epub'), 'utf8')]);
+    expect(landed[0]).not.toBe(landed[1]);
+    expect(new Set(vfs.made).size).toBe(vfs.made.length);
+  });
+
+  /**
+   * Sizes come from the expanded tree's own metadata, so a release past a bound is refused while
+   * its bytes are still only in the WASM heap rather than also copied into ours.
+   */
+  it('refuses an oversized expansion before reading a single entry', async () => {
+    await withBounds({ maxTotalBytes: 8 }, async () => {
+      mountSevenZip({ 'Dune.epub': 'far more than eight bytes' });
+
+      await expect(extractReleaseArchive(await archiveAt('release.7z'), '7z', join(workspace, 'out'))).rejects.toThrow(
+        /more than BookOrbit will extract/,
+      );
+      expect(vfs.reads).toHaveLength(0);
+    });
+  });
+});
diff --git a/server/src/common/archive/release-archive.ts b/server/src/common/archive/release-archive.ts
new file mode 100644
index 000000000..40873c26d
--- /dev/null
+++ b/server/src/common/archive/release-archive.ts
@@ -0,0 +1,393 @@
+import { createWriteStream } from 'fs';
+import { mkdir, rm, stat } from 'fs/promises';
+import { dirname, isAbsolute, join, normalize, resolve, sep } from 'path';
+import { Transform } from 'stream';
+import { pipeline } from 'stream/promises';
+
+import { createSevenZipTempId, getSevenZip } from '../sevenzip';
+
+/**
+ * Expanding a release that arrived as RAR, ZIP or 7z, into a staging directory and never into the
+ * download's own directory: writing there would corrupt what the torrent is still seeding.
+ *
+ * Every bound here is a hard-coded constant rather than a setting. A tripped bound means the
+ * release is not the shape a book release is, and the useful answer is a clear failure rather than
+ * a prompt asking an operator to raise a number they have no way to reason about.
+ */
+
+export type ReleaseArchiveKind = 'zip' | 'rar' | '7z';
+
+export const ARCHIVE_BOUNDS = {
+  /**
+   * An audiobook set can be genuinely large - a long unabridged reading runs to a couple of
+   * gigabytes - but a release past this is not a book, it is a library or a bomb.
+   */
+  maxTotalBytes: 4 * 1024 ** 3,
+  maxEntries: 5_000,
+  /** A single book file larger than this is not a book file. A long m4b is around a gigabyte. */
+  maxEntryBytes: 2 * 1024 ** 3,
+  /** Above this an entry is a decompression bomb rather than a well-compressed book. */
+  maxCompressionRatio: 200,
+  /**
+   * 7z is expanded through a WASM module that holds the archive and its output in memory, so it
+   * carries a much lower cap than the streaming formats. Above it, refuse rather than exhaust the
+   * heap on a release nobody is watching.
+   */
+  maxSevenZipArchiveBytes: 512 * 1024 ** 2,
+} as const;
+
+export class ReleaseArchiveError extends Error {}
+
+/**
+ * Shared across every extraction pass of one release, so unwrapping a zip that holds a rar cannot
+ * spend the ceiling twice. Bytes accumulate; entry and per-entry limits apply per archive, since a
+ * second archive of ordinary size is not itself suspicious.
+ *
+ * Two counters, because a size in an archive's directory is a claim and a byte on the wire is a
+ * fact, and both have to be bounded. `declaredBytes` is spent while planning, before anything is
+ * written; `writtenBytes` is spent as the bytes actually land. They are separate so an honest
+ * archive is not charged twice for the same entry, and both span every pass of one release: a
+ * counter that restarted per archive would let a nested one spend the ceiling once per level.
+ */
+export interface ArchiveBudget {
+  declaredBytes: number;
+  writtenBytes: number;
+}
+
+export function createArchiveBudget(): ArchiveBudget {
+  return { declaredBytes: 0, writtenBytes: 0 };
+}
+
+interface PlannedEntry {
+  path: string;
+  sizeBytes: number;
+  packedBytes: number;
+}
+
+/**
+ * Extracts one archive into `targetDirectory`, which the caller owns and must remove. Unwrapping a
+ * nested archive is the caller's decision, made by calling again with the same `budget`; nothing
+ * here recurses on its own.
+ */
+export async function extractReleaseArchive(
+  archivePath: string,
+  kind: ReleaseArchiveKind,
+  targetDirectory: string,
+  budget: ArchiveBudget = createArchiveBudget(),
+): Promise<void> {
+  await mkdir(targetDirectory, { recursive: true });
+
+  if (kind === 'zip') return extractZip(archivePath, targetDirectory, budget);
+  if (kind === 'rar') return extractRar(archivePath, targetDirectory, budget);
+  return extractSevenZip(archivePath, targetDirectory, budget);
+}
+
+/**
+ * Rejects anything that would write outside the extraction root. Absolute paths and `..` are the
+ * obvious cases; a normalized path that still escapes covers the rest, including the spellings
+ * that only escape after the separators are resolved.
+ */
+function safeEntryPath(rawPath: string, targetDirectory: string): string {
+  const cleaned = rawPath.replace(/\\/g, '/').trim();
+  if (!cleaned || cleaned === '.' || cleaned.endsWith('/')) {
+    throw new ReleaseArchiveError('The archive contains an entry with no file name');
+  }
+  if (isAbsolute(cleaned) || /^[a-zA-Z]:/.test(cleaned)) {
+    throw new ReleaseArchiveError('The archive contains an absolute path, which is not safe to extract');
+  }
+
+  const resolvedTarget = resolve(targetDirectory);
+  const resolvedEntry = resolve(resolvedTarget, normalize(cleaned));
+  if (resolvedEntry !== resolvedTarget && !resolvedEntry.startsWith(resolvedTarget + sep)) {
+    throw new ReleaseArchiveError('The archive contains a path that escapes the extraction folder');
+  }
+  return resolvedEntry;
+}
+
+/** Applied to the whole archive before a single byte is written, so a bomb never lands on disk. */
+function planEntries(entries: PlannedEntry[], targetDirectory: string, budget: ArchiveBudget): Array<{ path: string; destination: string }> {
+  if (entries.length === 0) throw new ReleaseArchiveError('The archive is empty');
+  if (entries.length > ARCHIVE_BOUNDS.maxEntries) {
+    throw new ReleaseArchiveError(`The archive contains more than ${ARCHIVE_BOUNDS.maxEntries} files`);
+  }
+
+  const planned: Array<{ path: string; destination: string }> = [];
+
+  for (const entry of entries) {
+    if (entry.sizeBytes > ARCHIVE_BOUNDS.maxEntryBytes) {
+      throw new ReleaseArchiveError('The archive contains a file larger than BookOrbit will extract');
+    }
+    // The aggregate is checked before the ratio, so a release that is simply too big is reported
+    // as too big rather than as a decompression bomb. It spans passes: a zip holding a rar spends
+    // one budget between them, not one each.
+    budget.declaredBytes += entry.sizeBytes;
+    if (budget.declaredBytes > ARCHIVE_BOUNDS.maxTotalBytes) {
+      throw new ReleaseArchiveError('The archive expands to more than BookOrbit will extract');
+    }
+
+    // Only meaningful for an entry that was actually compressed: a stored entry has a ratio of 1,
+    // and a tiny entry's ratio is noise rather than evidence.
+    if (entry.packedBytes > 0 && entry.sizeBytes > 1024 * 1024 && entry.sizeBytes / entry.packedBytes > ARCHIVE_BOUNDS.maxCompressionRatio) {
+      throw new ReleaseArchiveError('The archive is compressed far beyond what a book release is, and was not extracted');
+    }
+
+    planned.push({ path: entry.path, destination: safeEntryPath(entry.path, targetDirectory) });
+  }
+
+  return planned;
+}
+
+async function extractZip(archivePath: string, targetDirectory: string, budget: ArchiveBudget): Promise<void> {
+  const unzipper = await import('unzipper');
+  const directory = await unzipper.Open.file(archivePath).catch(() => {
+    throw new ReleaseArchiveError('That ZIP file could not be read');
+  });
+
+  const files = directory.files.filter((file) => file.type === 'File');
+  // Bit 0 of the general-purpose flag. An encrypted entry streams as garbage rather than failing,
+  // so it has to be refused up front or the release imports as unreadable bytes.
+  if (files.some((file) => ((file as { flags?: number }).flags ?? 0) & 0x1)) {
+    throw new ReleaseArchiveError('That ZIP file is password protected');
+  }
+
+  const planned = planEntries(
+    files.map((file) => ({ path: file.path, sizeBytes: file.uncompressedSize ?? 0, packedBytes: file.compressedSize ?? 0 })),
+    targetDirectory,
+    budget,
+  );
+  const destinations = new Map(planned.map((entry) => [entry.path, entry.destination]));
+
+  // The sizes in a ZIP's directory are a claim, not a fact: an entry may declare a kilobyte and
+  // then stream gigabytes. So both ceilings are enforced again as the bytes actually land, against
+  // the budget's own written counter rather than the declared one.
+  for (const file of files) {
+    const destination = destinations.get(file.path);
+    if (!destination) continue;
+    await mkdir(dirname(destination), { recursive: true });
+    await pipeline(file.stream(), meterBytes(budget), createWriteStream(destination));
+  }
+}
+
+/**
+ * Both runtime ceilings, per entry and in aggregate. A lying directory is the whole reason this
+ * exists, so a claim of a kilobyte buys an entry nothing once it starts streaming gigabytes.
+ */
+function meterBytes(budget: ArchiveBudget): Transform {
+  let entryBytes = 0;
+  return new Transform({
+    transform(chunk: Buffer, _encoding, callback) {
+      entryBytes += chunk.length;
+      if (entryBytes > ARCHIVE_BOUNDS.maxEntryBytes) {
+        callback(new ReleaseArchiveError('The archive contains a file larger than BookOrbit will extract'));
+        return;
+      }
+      budget.writtenBytes += chunk.length;
+      if (budget.writtenBytes > ARCHIVE_BOUNDS.maxTotalBytes) {
+        callback(new ReleaseArchiveError('The archive expands to more than BookOrbit will extract'));
+        return;
+      }
+      callback(null, chunk);
+    },
+  });
+}
+
+async function extractRar(archivePath: string, targetDirectory: string, budget: ArchiveBudget): Promise<void> {
+  const { createExtractorFromFile } = await import('node-unrar-js');
+  const extractor = await createExtractorFromFile({ filepath: archivePath, targetPath: targetDirectory }).catch(() => {
+    throw new ReleaseArchiveError('That RAR file could not be read');
+  });
+
+  // Opening succeeds on any readable file; it is reading the header that rejects a non-RAR, and
+  // the library's own wording ("File is not RAR archive") is not what an operator should be shown.
+  const list = (() => {
+    try {
+      return extractor.getFileList();
+    } catch {
+      throw new ReleaseArchiveError('That RAR file could not be read');
+    }
+  })();
+
+  if (list.arcHeader.flags.headerEncrypted) throw new ReleaseArchiveError('That RAR file is password protected');
+
+  const headers = (() => {
+    try {
+      return [...list.fileHeaders].filter((header) => !header.flags.directory);
+    } catch {
+      throw new ReleaseArchiveError('That RAR file could not be read');
+    }
+  })();
+  if (headers.some((header) => header.flags.encrypted)) throw new ReleaseArchiveError('That RAR file is password protected');
+
+  const planned = planEntries(
+    headers.map((header) => ({ path: header.name, sizeBytes: header.unpSize, packedBytes: header.packSize })),
+    targetDirectory,
+    budget,
+  );
+  const wanted = new Set(planned.map((entry) => entry.path));
+
+  try {
+    // The generator is lazy: extraction only happens as it is walked.
+    const extracted = extractor.extract({ files: (header) => wanted.has(header.name) });
+    for (const _file of extracted.files) void _file;
+  } catch (error) {
+    // A multi-volume set that is missing volumes fails here rather than silently importing the
+    // part that happened to be readable, which is the outcome worth protecting against.
+    const reason = (error as { reason?: string }).reason;
+    if (reason === 'ERAR_MISSING_PASSWORD' || reason === 'ERAR_BAD_PASSWORD') {
+      throw new ReleaseArchiveError('That RAR file is password protected');
+    }
+    throw new ReleaseArchiveError(
+      list.arcHeader.flags.volume
+        ? 'That RAR release is split across volumes and at least one of them could not be read'
+        : 'That RAR file could not be extracted',
+    );
+  }
+}
+
+async function extractSevenZip(archivePath: string, targetDirectory: string, budget: ArchiveBudget): Promise<void> {
+  const { size } = await stat(archivePath);
+  if (size > ARCHIVE_BOUNDS.maxSevenZipArchiveBytes) {
+    throw new ReleaseArchiveError('That 7z file is too large for BookOrbit to extract');
+  }
+
+  const sevenZip = await getSevenZip();
+  // A random id rather than a timestamp: the WASM filesystem is one shared instance, so two
+  // extractions starting in the same millisecond collided on the directory name, and whichever
+  // finished first removed the other one's tree out from under it.
+  const workingDirectory = `/${createSevenZipTempId('release')}`;
+  const archiveName = `${workingDirectory}/archive.7z`;
+
+  try {
+    sevenZip.FS.mkdir(workingDirectory);
+    const bytes = await readFileBytes(archivePath);
+    const fd = sevenZip.FS.open(archiveName, 'w+');
+    sevenZip.FS.write(fd, bytes, 0, bytes.length);
+    sevenZip.FS.close(fd);
+
+    try {
+      sevenZip.callMain(['x', archiveName, `-o${workingDirectory}/out`, '-y', '-p']);
+    } catch {
+      throw new ReleaseArchiveError('That 7z file could not be extracted, and may be password protected');
+    }
+
+    // Sizes first, contents afterwards. `stat` reads the entry's length without materializing it,
+    // so a release past a bound is refused while its bytes are still only in the WASM heap rather
+    // than also copied into ours. The heap itself is what the archive-size cap above bounds.
+    const entries = collectSevenZipEntries(sevenZip, `${workingDirectory}/out`, '');
+    const planned = planEntries(
+      entries.map((entry) => ({ path: entry.relativePath, sizeBytes: entry.sizeBytes, packedBytes: entry.sizeBytes })),
+      targetDirectory,
+      budget,
+    );
+
+    for (const [index, entry] of planned.entries()) {
+      const source = entries[index]!;
+      const contents = sevenZip.FS.readFile(source.path);
+      // Metered against what was read rather than what was claimed, and before it lands, so a
+      // directory that understated an entry does not get to write it anyway.
+      budget.writtenBytes += contents.length;
+      if (budget.writtenBytes > ARCHIVE_BOUNDS.maxTotalBytes) {
+        throw new ReleaseArchiveError('The archive expands to more than BookOrbit will extract');
+      }
+      await mkdir(dirname(entry.destination), { recursive: true });
+      await writeFileBytes(entry.destination, contents);
+      // Freed as it goes, so the peak is the archive plus one file rather than both copies whole.
+      try {
+        sevenZip.FS.unlink(source.path);
+      } catch {
+        // Best effort: the finally below removes whatever is left of the tree.
+      }
+    }
+  } finally {
+    removeSevenZipDirectory(sevenZip, workingDirectory);
+  }
+}
+
+/** Walks the expanded tree for paths and sizes only; nothing is read into our heap here. */
+function collectSevenZipEntries(
+  sevenZip: Awaited<ReturnType<typeof getSevenZip>>,
+  path: string,
+  relativePath: string,
+): Array<{ relativePath: string; path: string; sizeBytes: number }> {
+  const collected: Array<{ relativePath: string; path: string; sizeBytes: number }> = [];
+
+  let names: string[];
+  try {
+    names = sevenZip.FS.readdir(path).filter((name) => name !== '.' && name !== '..');
+  } catch {
+    return collected;
+  }
+
+  for (const name of names) {
+    const child = `${path}/${name}`;
+    const childRelative = relativePath ? `${relativePath}/${name}` : name;
+    const stats = statSevenZipEntry(sevenZip, child);
+    if (stats === null) continue;
+    if (stats.isDirectory) {
+      collected.push(...collectSevenZipEntries(sevenZip, child, childRelative));
+      continue;
+    }
+    collected.push({ relativePath: childRelative, path: child, sizeBytes: stats.sizeBytes });
+  }
+
+  return collected;
+}
+
+function statSevenZipEntry(sevenZip: Awaited<ReturnType<typeof getSevenZip>>, path: string): { isDirectory: boolean; sizeBytes: number } | null {
+  try {
+    const stats = sevenZip.FS.stat(path);
+    return { isDirectory: sevenZip.FS.isDir(stats.mode), sizeBytes: stats.size };
+  } catch {
+    return null;
+  }
+}
+
+function removeSevenZipDirectory(sevenZip: Awaited<ReturnType<typeof getSevenZip>>, path: string): void {
+  let names: string[];
+  try {
+    names = sevenZip.FS.readdir(path).filter((name) => name !== '.' && name !== '..');
+  } catch {
+    return;
+  }
+
+  for (const name of names) {
+    const child = `${path}/${name}`;
+    try {
+      sevenZip.FS.unlink(child);
+    } catch {
+      removeSevenZipDirectory(sevenZip, child);
+    }
+  }
+
+  try {
+    sevenZip.FS.rmdir(path);
+  } catch {
+    // Best effort: a leftover directory in the WASM FS is not worth failing an import over.
+  }
+}
+
+async function readFileBytes(path: string): Promise<Uint8Array> {
+  const { readFile } = await import('fs/promises');
+  return new Uint8Array(await readFile(path));
+}
+
+async function writeFileBytes(path: string, bytes: Uint8Array): Promise<void> {
+  const { writeFile } = await import('fs/promises');
+  await writeFile(path, bytes);
+}
+
+/** Removes an extraction directory in full. Only ever called on a directory this module created. */
+export async function removeExtractionDirectory(path: string): Promise<void> {
+  await rm(path, { recursive: true, force: true }).catch(() => {});
+}
+
+/**
+ * Where one import expands a release.
+ *
+ * `token` keeps two imports of the same download apart. They should not overlap - the attempt is
+ * claimed before either starts - but the cost of being wrong is one pass deleting the tree the
+ * other is still reading out of, in a `finally` that cannot tell whose it was.
+ */
+export function extractionDirectoryFor(stagingRoot: string, downloadId: number, token: string): string {
+  return join(stagingRoot, `release-${downloadId}-${token}`);
+}
diff --git a/server/src/common/decorators/common-decorators.test.ts b/server/src/common/decorators/common-decorators.test.ts
index 8fda1fd0d..945fae715 100644
--- a/server/src/common/decorators/common-decorators.test.ts
+++ b/server/src/common/decorators/common-decorators.test.ts
@@ -7,6 +7,7 @@ import { Auditable, AUDITABLE_KEY } from './auditable.decorator';
 import { ForbidPermission, FORBIDDEN_PERMISSION_KEY } from './forbid-permission.decorator';
 import { Public, IS_PUBLIC_KEY } from './public.decorator';
 import { RequireLibraryAccess, LIBRARY_ACCESS_KEY } from './require-library-access.decorator';
+import { RequireAnyPermission, ANY_PERMISSION_KEY } from './require-any-permission.decorator';
 import { RequirePermission, PERMISSION_KEY } from './require-permission.decorator';
 
 describe('common decorators', () => {
@@ -30,6 +31,9 @@ describe('common decorators', () => {
       @RequirePermission(Permission.BookDockAccess, Permission.LibraryUpload)
       withPermissions() {}
 
+      @RequireAnyPermission(Permission.BookRequestAccess, Permission.ManageAppSettings)
+      withAnyPermission() {}
+
       @ForbidPermission(Permission.DemoRestricted, 'Demo-restricted account cannot perform bulk edits')
       withoutPermission() {}
 
@@ -47,6 +51,10 @@ describe('common decorators', () => {
       Permission.BookDockAccess,
       Permission.LibraryUpload,
     ]);
+    expect(Reflect.getMetadata(ANY_PERMISSION_KEY, DecoratedController.prototype.withAnyPermission)).toEqual([
+      Permission.BookRequestAccess,
+      Permission.ManageAppSettings,
+    ]);
     expect(Reflect.getMetadata(FORBIDDEN_PERMISSION_KEY, DecoratedController.prototype.withoutPermission)).toEqual({
       permission: Permission.DemoRestricted,
       message: 'Demo-restricted account cannot perform bulk edits',
diff --git a/server/src/common/decorators/require-any-permission.decorator.ts b/server/src/common/decorators/require-any-permission.decorator.ts
new file mode 100644
index 000000000..b01153677
--- /dev/null
+++ b/server/src/common/decorators/require-any-permission.decorator.ts
@@ -0,0 +1,11 @@
+import { SetMetadata } from '@nestjs/common';
+import { Permission } from '@bookorbit/types';
+
+export const ANY_PERMISSION_KEY = 'anyPermission';
+
+/**
+ * Any one of these is enough, where `@RequirePermission` demands all of them.
+ *
+ * On a handler it replaces the controller's class-level requirement instead of adding to it.
+ */
+export const RequireAnyPermission = (...permissions: [Permission, Permission, ...Permission[]]) => SetMetadata(ANY_PERMISSION_KEY, permissions);
diff --git a/server/src/common/filters/http-exception.filter.test.ts b/server/src/common/filters/http-exception.filter.test.ts
index 6d4f954fc..c50107604 100644
--- a/server/src/common/filters/http-exception.filter.test.ts
+++ b/server/src/common/filters/http-exception.filter.test.ts
@@ -50,6 +50,47 @@ describe('GlobalExceptionFilter', () => {
     expect(send).toHaveBeenCalledWith(expect.objectContaining({ errorCode: 'READING_INSIGHTS_PRIVATE' }));
   });
 
+  /**
+   * A code without its parameters is a sentence a client cannot finish. "You can have {limit} in
+   * flight at once" translated with no `limit` renders the placeholder empty, which is how the
+   * one refusal that carries a number told nobody what the number was.
+   */
+  it('carries the code’s translation parameters alongside it', () => {
+    const filter = new GlobalExceptionFilter();
+    const { host, send } = makeHost();
+
+    filter.catch(
+      new HttpException({ message: 'too many in flight', errorCode: 'SUBMIT_SELF_SERVE_LIMIT', errorMeta: { limit: 10 } }, HttpStatus.FORBIDDEN),
+      host,
+    );
+
+    expect(send).toHaveBeenCalledWith(expect.objectContaining({ errorCode: 'SUBMIT_SELF_SERVE_LIMIT', errorMeta: { limit: 10 } }));
+  });
+
+  it('keeps only the scalars a translation could use, so an error body cannot carry internals', () => {
+    const filter = new GlobalExceptionFilter();
+    const { host, send } = makeHost();
+
+    filter.catch(
+      new HttpException(
+        { message: 'nope', errorCode: 'SOME_CODE', errorMeta: { limit: 10, source: 'tracker', internals: { stack: 'secret' }, ids: [1, 2] } },
+        HttpStatus.BAD_REQUEST,
+      ),
+      host,
+    );
+
+    expect(send).toHaveBeenCalledWith(expect.objectContaining({ errorMeta: { limit: 10, source: 'tracker' } }));
+  });
+
+  it('omits meta entirely when nothing coded it, so an uncoded refusal keeps its old shape', () => {
+    const filter = new GlobalExceptionFilter();
+    const { host, send } = makeHost();
+
+    filter.catch(new HttpException({ message: 'nope', errorMeta: { limit: 10 } }, HttpStatus.BAD_REQUEST), host);
+
+    expect(send).toHaveBeenCalledWith(expect.not.objectContaining({ errorMeta: expect.anything() }));
+  });
+
   it('falls back to statusCode/message fields on non-HttpException values', () => {
     const filter = new GlobalExceptionFilter();
     const { host, status, send } = makeHost();
diff --git a/server/src/common/filters/http-exception.filter.ts b/server/src/common/filters/http-exception.filter.ts
index 3eca1acff..d3cfe307e 100644
--- a/server/src/common/filters/http-exception.filter.ts
+++ b/server/src/common/filters/http-exception.filter.ts
@@ -27,6 +27,10 @@ export class GlobalExceptionFilter implements ExceptionFilter {
     const rawObject = typeof raw === 'object' && raw !== null ? (raw as Record<string, unknown>) : undefined;
     const message = typeof raw === 'string' ? raw : ((rawObject?.message as string) ?? (exc?.message as string) ?? 'An error occurred');
     const errorCode = typeof rawObject?.errorCode === 'string' ? rawObject.errorCode : undefined;
+    // The code's parameters, and useless without them: a client translating "you can have {limit}
+    // in flight at once" has the sentence but not the number, and renders the placeholder empty.
+    // Scalars only, so a thrower cannot smuggle a nested object of internals into an error body.
+    const errorMeta = errorCode ? scalarMeta(rawObject?.errorMeta) : undefined;
     const retryAfterSeconds = typeof rawObject?.retryAfterSeconds === 'number' ? rawObject.retryAfterSeconds : undefined;
 
     if (status >= (HttpStatus.INTERNAL_SERVER_ERROR as number)) {
@@ -44,7 +48,20 @@ export class GlobalExceptionFilter implements ExceptionFilter {
       timestamp: new Date().toISOString(),
       requestId: request.id,
       ...(errorCode ? { errorCode } : {}),
+      ...(errorMeta ? { errorMeta } : {}),
       ...(retryAfterSeconds !== undefined ? { retryAfterSeconds } : {}),
     });
   }
 }
+
+/**
+ * Translation parameters are strings and numbers. Anything else in there is either a mistake or
+ * somebody putting an object into an error body, and neither belongs on the wire.
+ */
+function scalarMeta(value: unknown): Record<string, string | number> | undefined {
+  if (typeof value !== 'object' || value === null || Array.isArray(value)) return undefined;
+  const entries = Object.entries(value).filter(([, item]) => typeof item === 'string' || typeof item === 'number') as Array<
+    [string, string | number]
+  >;
+  return entries.length ? Object.fromEntries(entries) : undefined;
+}
diff --git a/server/src/common/guards/permission.guard.test.ts b/server/src/common/guards/permission.guard.test.ts
index dd6ba9707..781c22046 100644
--- a/server/src/common/guards/permission.guard.test.ts
+++ b/server/src/common/guards/permission.guard.test.ts
@@ -2,6 +2,7 @@ import { ExecutionContext, ForbiddenException } from '@nestjs/common';
 import { Permission } from '@bookorbit/types';
 
 import { FORBIDDEN_PERMISSION_KEY } from '../decorators/forbid-permission.decorator';
+import { ANY_PERMISSION_KEY } from '../decorators/require-any-permission.decorator';
 import { IS_PUBLIC_KEY } from '../decorators/public.decorator';
 import { PERMISSION_KEY } from '../decorators/require-permission.decorator';
 import type { RequestUser } from '../types/request-user';
@@ -155,6 +156,59 @@ describe('PermissionGuard', () => {
     expect(guard.canActivate(makeContext(makeUser()))).toBe(true);
   });
 
+  it('accepts any one of an any-of set', () => {
+    const reflector = {
+      getAllAndOverride: vi.fn((key: string) => {
+        if (key === IS_PUBLIC_KEY) return false;
+        if (key === ANY_PERMISSION_KEY) return [Permission.BookRequestAccess, Permission.ManageAppSettings];
+        return undefined;
+      }),
+    };
+    const permissionService = {
+      userHas: vi.fn((_user: RequestUser, permission: Permission) => permission === Permission.ManageAppSettings),
+      userHasExplicit: vi.fn().mockReturnValue(false),
+    };
+    const guard = new PermissionGuard(reflector as never, permissionService as never);
+
+    expect(guard.canActivate(makeContext(makeUser()))).toBe(true);
+  });
+
+  it('refuses an any-of set the user holds none of, and names them all', () => {
+    const reflector = {
+      getAllAndOverride: vi.fn((key: string) => {
+        if (key === IS_PUBLIC_KEY) return false;
+        if (key === ANY_PERMISSION_KEY) return [Permission.BookRequestAccess, Permission.ManageAppSettings];
+        return undefined;
+      }),
+    };
+    const permissionService = { userHas: vi.fn().mockReturnValue(false), userHasExplicit: vi.fn().mockReturnValue(false) };
+    const guard = new PermissionGuard(reflector as never, permissionService as never);
+
+    expect(() => guard.canActivate(makeContext(makeUser()))).toThrow(
+      `Missing permission: ${Permission.BookRequestAccess} or ${Permission.ManageAppSettings}`,
+    );
+  });
+
+  /** A handler naming an any-of set answers for it instead of its controller's class-level rule. */
+  it('lets an any-of set stand in for the class-level requirement', () => {
+    const reflector = {
+      getAllAndOverride: vi.fn((key: string) => {
+        if (key === IS_PUBLIC_KEY) return false;
+        if (key === ANY_PERMISSION_KEY) return [Permission.BookRequestAccess, Permission.ManageAppSettings];
+        if (key === PERMISSION_KEY) return Permission.ManageUsers;
+        return undefined;
+      }),
+    };
+    const permissionService = {
+      userHas: vi.fn((_user: RequestUser, permission: Permission) => permission === Permission.ManageAppSettings),
+      userHasExplicit: vi.fn().mockReturnValue(false),
+    };
+    const guard = new PermissionGuard(reflector as never, permissionService as never);
+
+    expect(guard.canActivate(makeContext(makeUser()))).toBe(true);
+    expect(permissionService.userHas).not.toHaveBeenCalledWith(expect.any(Object), Permission.ManageUsers);
+  });
+
   it('requires every permission attached to a route', () => {
     const reflector = {
       getAllAndOverride: vi.fn((key: string) => {
diff --git a/server/src/common/guards/permission.guard.ts b/server/src/common/guards/permission.guard.ts
index a4646b5e2..89c4be3fe 100644
--- a/server/src/common/guards/permission.guard.ts
+++ b/server/src/common/guards/permission.guard.ts
@@ -4,6 +4,7 @@ import { Permission } from '@bookorbit/types';
 
 import { FORBIDDEN_PERMISSION_KEY, type ForbiddenPermissionRule } from '../decorators/forbid-permission.decorator';
 import { IS_PUBLIC_KEY } from '../decorators/public.decorator';
+import { ANY_PERMISSION_KEY } from '../decorators/require-any-permission.decorator';
 import { PERMISSION_KEY } from '../decorators/require-permission.decorator';
 import { PermissionService } from '../services/permission.service';
 import { RequestUser } from '../types/request-user';
@@ -28,6 +29,12 @@ export class PermissionGuard implements CanActivate {
       throw new ForbiddenException(forbidden.message ?? `Forbidden permission: ${forbidden.permission}`);
     }
 
+    const anyOf = this.reflector.getAllAndOverride<Permission[] | undefined>(ANY_PERMISSION_KEY, [context.getHandler()]);
+    if (anyOf) {
+      if (anyOf.some((permission) => this.permissionService.userHas(user, permission))) return true;
+      throw new ForbiddenException(`Missing permission: ${anyOf.join(' or ')}`);
+    }
+
     const required = this.reflector.getAllAndOverride<Permission | Permission[] | undefined>(PERMISSION_KEY, [
       context.getHandler(),
       context.getClass(),
diff --git a/server/src/common/sevenzip.ts b/server/src/common/sevenzip.ts
index 0ab282300..b526c126b 100644
--- a/server/src/common/sevenzip.ts
+++ b/server/src/common/sevenzip.ts
@@ -1,5 +1,7 @@
-// Shared 7z-wasm singleton — one WASM instance for the server lifetime.
-// Both the comic reader service and metadata extraction use this.
+// Shared 7z-wasm singleton - one WASM instance for the server lifetime.
+// The comic reader, metadata extraction and release archives all use this.
+
+import { randomUUID } from 'crypto';
 
 export interface SevenZipFS {
   open(path: string, flags: string): number;
@@ -8,6 +10,9 @@ export interface SevenZipFS {
   mkdir(path: string): void;
   readdir(path: string): string[];
   readFile(path: string): Uint8Array;
+  /** An entry's size and kind without reading it, which is what bounds an extraction. */
+  stat(path: string): { mode: number; size: number };
+  isDir(mode: number): boolean;
   unlink(path: string): void;
   rmdir(path: string): void;
 }
@@ -40,3 +45,14 @@ export async function getSevenZip(): Promise<SevenZipModule> {
   }
   return _instancePromise;
 }
+
+/**
+ * A name for one caller's scratch directory in the shared WASM filesystem.
+ *
+ * There is one instance for the whole server, so two extractions running at once share a
+ * filesystem: anything derived from the clock collides, and a collision means one of them removes
+ * the other's tree while it is still being read.
+ */
+export function createSevenZipTempId(prefix: string): string {
+  return `${prefix}_${randomUUID()}`;
+}
diff --git a/server/src/common/text-match/isbn-normalize.ts b/server/src/common/text-match/isbn-normalize.ts
new file mode 100644
index 000000000..47c7b2ac7
--- /dev/null
+++ b/server/src/common/text-match/isbn-normalize.ts
@@ -0,0 +1,13 @@
+/** Strips separators and case so two spellings of one ISBN compare equal. */
+export function normalizeIsbn(raw: string): string {
+  return raw.replace(/[^0-9Xx]/g, '').toUpperCase();
+}
+
+/**
+ * The only generic piece of the ISBN helpers: string in, comparable string out. The
+ * candidate-shaped ones stay in `metadata-fetch`, because a release name and a byte count are not
+ * a `MetadataCandidate`.
+ */
+export function normalizeMetadataIsbn(value: string | null | undefined): string {
+  return value ? normalizeIsbn(value) : '';
+}
diff --git a/server/src/modules/metadata-fetch/title-match.test.ts b/server/src/common/text-match/title-match.test.ts
similarity index 100%
rename from server/src/modules/metadata-fetch/title-match.test.ts
rename to server/src/common/text-match/title-match.test.ts
diff --git a/server/src/modules/metadata-fetch/title-match.ts b/server/src/common/text-match/title-match.ts
similarity index 75%
rename from server/src/modules/metadata-fetch/title-match.ts
rename to server/src/common/text-match/title-match.ts
index 27f883d9e..c45772b47 100644
--- a/server/src/modules/metadata-fetch/title-match.ts
+++ b/server/src/common/text-match/title-match.ts
@@ -147,6 +147,44 @@ export function scoreTitleMatch(query: string, candidate: string): number {
   return Math.max(tokenScore, levenshteinScore);
 }
 
+/**
+ * Symmetric 0-1 similarity, unlike `scoreTitleMatch`, which is deliberately generous about a
+ * candidate that extends the query so a search for "Dune" still surfaces "Dune (Special Edition)".
+ *
+ * That generosity is wrong when the question is "is this the book that was asked for": under it,
+ * "Dune" and "Dune Messiah" score as a prefix hit. Here every token either side does not share
+ * costs, so a sequel separates from its predecessor.
+ */
+export function symmetricTitleSimilarity(left: string, right: string): number {
+  const a = normalizeTitleText(left);
+  const b = normalizeTitleText(right);
+  if (!a || !b) return 0;
+  if (a === b) return 1;
+
+  const leftTokens = new Set(significantTokens(tokenizeTitleText(a)));
+  const rightTokens = new Set(significantTokens(tokenizeTitleText(b)));
+  let shared = 0;
+  for (const token of leftTokens) if (rightTokens.has(token)) shared++;
+  const union = leftTokens.size + rightTokens.size - shared;
+  const jaccard = union > 0 ? shared / union : 0;
+
+  // Below the floor, edit distance is measuring alphabet overlap rather than a typo, and two
+  // unrelated titles would carry a few points each into whatever weighting sits on top of this.
+  const similarity = levenshteinSimilarity(a, b);
+  return Math.max(jaccard, similarity >= MIN_LEVENSHTEIN_SIMILARITY ? similarity : 0);
+}
+
+/**
+ * The part of a title before its subtitle. A subtitle is punctuation-separated and a sequel is
+ * not, which is the one cheap signal that tells "The Hobbit: There and Back Again" apart from
+ * "Dune Messiah" when comparing against a bare series title.
+ */
+export function mainTitlePart(value: string): string {
+  const cut = value.search(/[:(\u2013\u2014]|\s-\s/);
+  const main = cut > 0 ? value.slice(0, cut) : value;
+  return main.trim() || value.trim();
+}
+
 export function shareSignificantToken(left: readonly string[], right: readonly string[]): boolean {
   const leftTokens = new Set(left.flatMap((value) => tokenizeTitleText(normalizeTitleText(value))).filter((token) => token.length > 2));
   if (leftTokens.size === 0) return false;
diff --git a/server/src/common/utils/bounded-response.test.ts b/server/src/common/utils/bounded-response.test.ts
new file mode 100644
index 000000000..bcee701a6
--- /dev/null
+++ b/server/src/common/utils/bounded-response.test.ts
@@ -0,0 +1,105 @@
+import { boundedResponse, readBoundedBytes, readBoundedText, ResponseTooLargeError } from './bounded-response';
+
+/** A body that never ends, and counts how much of it anyone actually pulled. */
+function endlessBody(chunkBytes: number): { response: Response; pulled: () => number } {
+  let pulls = 0;
+  // No read-ahead, so the count is what the reader asked for rather than what the queue primed.
+  const stream = new ReadableStream<Uint8Array>(
+    {
+      pull(controller) {
+        pulls++;
+        controller.enqueue(new Uint8Array(chunkBytes));
+      },
+    },
+    { highWaterMark: 0 },
+  );
+  return { response: new Response(stream), pulled: () => pulls };
+}
+
+describe('readBoundedBytes', () => {
+  it('returns a body that fits', async () => {
+    await expect(readBoundedBytes(new Response('a real file'), 1024)).resolves.toEqual(Buffer.from('a real file'));
+  });
+
+  /** The point of the header check: nothing is read at all when the sender already said too much. */
+  it('refuses an over-declared body before reading it', async () => {
+    const { response, pulled } = endlessBody(1024);
+    const declared = new Response(response.body, { headers: { 'content-length': String(64 * 1024) } });
+
+    await expect(readBoundedBytes(declared, 1024)).rejects.toBeInstanceOf(ResponseTooLargeError);
+    expect(pulled()).toBe(0);
+  });
+
+  /**
+   * The case the header check cannot cover, and the one that matters: a chunked body with nothing
+   * declared has to fail at the ceiling rather than once it is all resident.
+   */
+  it('stops an endless body at the ceiling rather than after buffering it', async () => {
+    const chunk = 1024;
+    const limit = 16 * chunk;
+    const { response, pulled } = endlessBody(chunk);
+
+    await expect(readBoundedBytes(response, limit)).rejects.toBeInstanceOf(ResponseTooLargeError);
+    // One chunk past the ceiling is what it takes to notice; anything more is buffering.
+    expect(pulled()).toBe(limit / chunk + 1);
+  });
+
+  it('accepts a body of exactly the ceiling', async () => {
+    const body = new Response(new Uint8Array(1024));
+
+    await expect(readBoundedBytes(body, 1024)).resolves.toHaveLength(1024);
+  });
+
+  it('reads a body with no content at all as empty', async () => {
+    await expect(readBoundedBytes(new Response(null, { status: 204 }), 1024)).resolves.toHaveLength(0);
+  });
+});
+
+describe('readBoundedText', () => {
+  it('decodes what it read', async () => {
+    await expect(readBoundedText(new Response('<rss/>'), 1024)).resolves.toBe('<rss/>');
+  });
+});
+
+describe('boundedResponse', () => {
+  it('hands back a response that still reads normally', async () => {
+    const wrapped = boundedResponse(new Response('ok', { status: 201, headers: { 'x-source': 'tracker' } }), 1024);
+
+    expect(wrapped.status).toBe(201);
+    expect(wrapped.headers.get('x-source')).toBe('tracker');
+    await expect(wrapped.text()).resolves.toBe('ok');
+  });
+
+  it('refuses an over-declared body without reading it', () => {
+    const declared = new Response('x', { headers: { 'content-length': String(64 * 1024) } });
+
+    expect(() => boundedResponse(declared, 1024)).toThrow(ResponseTooLargeError);
+  });
+
+  /** Whatever the reader does with the stream, it cannot get more than the ceiling out of it. */
+  it('errors the stream at the ceiling for whoever is reading it', async () => {
+    const chunk = 1024;
+    const limit = 16 * chunk;
+    const { response, pulled } = endlessBody(chunk);
+
+    const wrapped = boundedResponse(response, limit);
+
+    await expect(wrapped.arrayBuffer()).rejects.toThrow();
+    expect(pulled()).toBeLessThanOrEqual(limit / chunk + 2);
+  });
+
+  /** A relative link on a page a plugin fetched is resolved against this. */
+  it('keeps the URL the response came from', () => {
+    const original = new Response('ok');
+    Object.defineProperty(original, 'url', { value: 'https://tracker.example.com/page' });
+
+    expect(boundedResponse(original, 1024).url).toBe('https://tracker.example.com/page');
+  });
+
+  /** A 304 carries no body, and the Response constructor refuses to give it one. */
+  it('leaves a status that cannot carry a body alone', () => {
+    const notModified = new Response(null, { status: 304 });
+
+    expect(boundedResponse(notModified, 1024)).toBe(notModified);
+  });
+});
diff --git a/server/src/common/utils/bounded-response.ts b/server/src/common/utils/bounded-response.ts
new file mode 100644
index 000000000..8088a49a5
--- /dev/null
+++ b/server/src/common/utils/bounded-response.ts
@@ -0,0 +1,89 @@
+/**
+ * Reading a response from a source BookOrbit does not control, without letting that source decide
+ * how much memory the read costs.
+ *
+ * Two guards, because a body is only ever as honest as its sender. `Content-Length` is checked
+ * first, so an over-declared response fails before a byte is read; the stream is then counted as
+ * it arrives, so an understated or chunked one fails at the ceiling rather than after the whole
+ * thing is already resident.
+ */
+export class ResponseTooLargeError extends Error {
+  constructor(readonly limitBytes: number) {
+    super(`The response was larger than the ${limitBytes} byte limit`);
+    this.name = 'ResponseTooLargeError';
+  }
+}
+
+/** Statuses the Response constructor refuses to attach a body to, so they are handed back as-is. */
+const NULL_BODY_STATUSES = new Set([101, 103, 204, 205, 304]);
+
+/** What the sender claims, where it claims anything readable. */
+function declaredLength(response: Response): number | null {
+  const header = response.headers.get('content-length');
+  if (header === null) return null;
+  const declared = Number(header);
+  return Number.isFinite(declared) && declared >= 0 ? declared : null;
+}
+
+function refuseIfDeclaredTooLarge(response: Response, limitBytes: number): void {
+  const declared = declaredLength(response);
+  if (declared !== null && declared > limitBytes) {
+    void response.body?.cancel().catch(() => undefined);
+    throw new ResponseTooLargeError(limitBytes);
+  }
+}
+
+/** Reads a whole body, stopping at `limitBytes` rather than discovering the size once resident. */
+export async function readBoundedBytes(response: Response, limitBytes: number): Promise<Buffer> {
+  refuseIfDeclaredTooLarge(response, limitBytes);
+  if (!response.body) return Buffer.alloc(0);
+
+  const reader = response.body.getReader();
+  const chunks: Uint8Array[] = [];
+  let size = 0;
+  try {
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      size += value.byteLength;
+      if (size > limitBytes) throw new ResponseTooLargeError(limitBytes);
+      chunks.push(value);
+    }
+  } finally {
+    await reader.cancel().catch(() => undefined);
+  }
+
+  return Buffer.concat(chunks, size);
+}
+
+export async function readBoundedText(response: Response, limitBytes: number): Promise<string> {
+  return new TextDecoder().decode(await readBoundedBytes(response, limitBytes));
+}
+
+/**
+ * The same ceiling, for a body someone else will read.
+ *
+ * Handing a raw `Response` to a plugin makes the size of what it reads the plugin's choice; this
+ * keeps it ours, whatever the plugin does with the stream.
+ */
+export function boundedResponse(response: Response, limitBytes: number): Response {
+  refuseIfDeclaredTooLarge(response, limitBytes);
+  if (!response.body || NULL_BODY_STATUSES.has(response.status)) return response;
+
+  let seen = 0;
+  const counted = response.body.pipeThrough(
+    new TransformStream<Uint8Array, Uint8Array>({
+      transform(chunk, controller) {
+        seen += chunk.byteLength;
+        if (seen > limitBytes) throw new ResponseTooLargeError(limitBytes);
+        controller.enqueue(chunk);
+      },
+    }),
+  );
+
+  const wrapped = new Response(counted, { status: response.status, statusText: response.statusText, headers: response.headers });
+  // Rebuilding the response otherwise reports the URL as empty, and a plugin that follows a
+  // relative link off a page it fetched would resolve it against nothing.
+  Object.defineProperty(wrapped, 'url', { value: response.url, enumerable: true });
+  return wrapped;
+}
diff --git a/server/src/common/utils/content-filter-sql.utils.test.ts b/server/src/common/utils/content-filter-sql.utils.test.ts
index c8d84eaca..884597058 100644
--- a/server/src/common/utils/content-filter-sql.utils.test.ts
+++ b/server/src/common/utils/content-filter-sql.utils.test.ts
@@ -1,5 +1,6 @@
 vi.mock('drizzle-orm', () => ({
   and: vi.fn((...clauses: unknown[]) => ({ type: 'and', clauses })),
+  eq: vi.fn((left: unknown, right: unknown) => ({ type: 'eq', left, right })),
   or: vi.fn((...clauses: unknown[]) => ({ type: 'or', clauses })),
   inArray: vi.fn((left: unknown, right: unknown) => ({ type: 'inArray', left, right })),
   exists: vi.fn((subquery: unknown) => ({ type: 'exists', subquery })),
@@ -102,4 +103,14 @@ describe('buildContentFilterClauses', () => {
     expect(clauses).toHaveLength(2);
     expect(clauses.map((c) => (c as { type: string }).type)).toEqual(['notExists', 'notExists']);
   });
+
+  it('exempts books fulfilled for either the requester or a subscriber', () => {
+    const { db, where } = makeDb();
+
+    const clauses = buildContentFilterClauses({ ...EMPTY_CONTENT_FILTER_RULES, includeTagIds: [1], exemptRequestsFromUserId: 7 }, db as any);
+
+    expect(clauses).toHaveLength(1);
+    expect(clauses[0]).toMatchObject({ type: 'or' });
+    expect(where).toHaveBeenCalledTimes(4);
+  });
 });
diff --git a/server/src/common/utils/content-filter-sql.utils.ts b/server/src/common/utils/content-filter-sql.utils.ts
index 0ad43fccd..0a1f0cafb 100644
--- a/server/src/common/utils/content-filter-sql.utils.ts
+++ b/server/src/common/utils/content-filter-sql.utils.ts
@@ -1,4 +1,4 @@
-import { SQL, and, inArray, notExists, exists, or, sql } from 'drizzle-orm';
+import { SQL, and, eq, inArray, notExists, exists, or, sql } from 'drizzle-orm';
 import { NodePgDatabase } from 'drizzle-orm/node-postgres';
 
 import type { ContentFilterRules } from '@bookorbit/types';
@@ -20,6 +20,10 @@ type Db = NodePgDatabase<typeof schema>;
  * Exclude semantics (applied independently, after include):
  * - excludeTagIds: book must NOT have any of these tags.
  * - excludeGenreIds: book must NOT have any of these genres.
+ *
+ * Exemption (applied last, over the whole set):
+ * - exemptRequestsFromUserId: a book that fulfilled a request this user made or joined passes
+ *   regardless of every rule above. Absent unless an administrator ticked it on that user.
  */
 export function buildContentFilterClauses(contentFilters: ContentFilterRules, db: Db): SQL[] {
   const clauses: SQL[] = [];
@@ -71,5 +75,47 @@ export function buildContentFilterClauses(contentFilters: ContentFilterRules, db
     clauses.push(notExists(sq));
   }
 
+  if (clauses.length === 0) return clauses;
+
+  // Exemption wraps the whole rule set rather than joining the include side, because a book the
+  // user asked for should also survive their exclude rules: an operator who ticks this is saying
+  // "what they request, they may read", and half an exemption would hide the book they requested
+  // behind the very rule that made them request it instead of browsing to it.
+  if (contentFilters.exemptRequestsFromUserId !== undefined) {
+    const requestedByUser = exists(
+      db
+        .select({ one: sql`1` })
+        .from(schema.bookRequests)
+        .where(
+          and(
+            sql`${schema.bookRequests.matchedBookId} = ${schema.books.id}`,
+            eq(schema.bookRequests.userId, contentFilters.exemptRequestsFromUserId),
+          ),
+        ),
+    );
+    const joinedByUser = exists(
+      db
+        .select({ one: sql`1` })
+        .from(schema.bookRequestSubscribers)
+        .where(
+          and(
+            eq(schema.bookRequestSubscribers.userId, contentFilters.exemptRequestsFromUserId),
+            exists(
+              db
+                .select({ one: sql`1` })
+                .from(schema.bookRequests)
+                .where(
+                  and(
+                    eq(schema.bookRequests.id, schema.bookRequestSubscribers.requestId),
+                    sql`${schema.bookRequests.matchedBookId} = ${schema.books.id}`,
+                  ),
+                ),
+            ),
+          ),
+        ),
+    );
+    return [or(requestedByUser, joinedByUser, and(...clauses))!];
+  }
+
   return clauses;
 }
diff --git a/server/src/common/utils/db-error.utils.test.ts b/server/src/common/utils/db-error.utils.test.ts
new file mode 100644
index 000000000..2b52afabb
--- /dev/null
+++ b/server/src/common/utils/db-error.utils.test.ts
@@ -0,0 +1,27 @@
+import { describe, expect, it } from 'vitest';
+
+import { isUniqueViolation } from './db-error.utils';
+
+describe('isUniqueViolation', () => {
+  it('matches the driver error raised straight off the pool', () => {
+    expect(isUniqueViolation(Object.assign(new Error('duplicate key'), { code: '23505' }))).toBe(true);
+  });
+
+  it('matches the driver error Drizzle has wrapped', () => {
+    // The shape a real query throws: DrizzleQueryError carries no code of its own and holds the
+    // pg DatabaseError on `cause`. Reading only `error.code` here is what turned a 409 into a 500.
+    const wrapped = new Error('Failed query', { cause: Object.assign(new Error('duplicate key'), { code: '23505' }) });
+    expect(isUniqueViolation(wrapped)).toBe(true);
+  });
+
+  it('ignores other Postgres failures', () => {
+    expect(isUniqueViolation(Object.assign(new Error('not null'), { code: '23502' }))).toBe(false);
+    expect(isUniqueViolation(new Error('boom', { cause: { code: '23503' } }))).toBe(false);
+  });
+
+  it('ignores anything that is not an error object', () => {
+    expect(isUniqueViolation(null)).toBe(false);
+    expect(isUniqueViolation('23505')).toBe(false);
+    expect(isUniqueViolation(undefined)).toBe(false);
+  });
+});
diff --git a/server/src/common/utils/db-error.utils.ts b/server/src/common/utils/db-error.utils.ts
new file mode 100644
index 000000000..1154fa7e5
--- /dev/null
+++ b/server/src/common/utils/db-error.utils.ts
@@ -0,0 +1,20 @@
+/**
+ * Postgres error inspection that survives the ORM wrapper.
+ *
+ * Drizzle wraps every failed query in a `DrizzleQueryError` and hangs the driver's error off
+ * `cause`, so a predicate that only reads `error.code` silently stops matching the moment a
+ * query goes through Drizzle rather than the raw pool. That failure is invisible in tests that
+ * reject with a hand-built `{ code }` object, and shows up in production as a 500 where a
+ * translated conflict was expected. Both shapes are checked here so neither can regress.
+ */
+
+/** Postgres `unique_violation`. */
+const UNIQUE_VIOLATION = '23505';
+
+export function isUniqueViolation(error: unknown): boolean {
+  if (!error || typeof error !== 'object') return false;
+
+  if ((error as { code?: unknown }).code === UNIQUE_VIOLATION) return true;
+
+  return (error as { cause?: { code?: unknown } }).cause?.code === UNIQUE_VIOLATION;
+}
diff --git a/server/src/common/utils/safe-fetch.test.ts b/server/src/common/utils/safe-fetch.test.ts
new file mode 100644
index 000000000..9a283c3d7
--- /dev/null
+++ b/server/src/common/utils/safe-fetch.test.ts
@@ -0,0 +1,159 @@
+import { hasNetworkProfile } from '@bookorbit/types';
+
+/** The two resolutions the pinned path exists to collapse into one are both this function. */
+vi.mock('dns/promises', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('dns/promises')>();
+  return { ...actual, lookup: vi.fn(actual.lookup) };
+});
+
+import { lookup } from 'dns/promises';
+
+import { forgetDispatchers, safeFetch } from './safe-fetch';
+import { isPrivateOrLocalAddress } from './ssrf.utils';
+
+describe('hasNetworkProfile', () => {
+  /** The overwhelmingly common case, and it must cost nothing: no agent, no pooling, no undici. */
+  it('treats an absent or empty profile as nothing configured', () => {
+    expect(hasNetworkProfile(null)).toBe(false);
+    expect(hasNetworkProfile(undefined)).toBe(false);
+    expect(hasNetworkProfile({})).toBe(false);
+    expect(hasNetworkProfile({ resolvers: [] })).toBe(false);
+  });
+
+  it('recognises either half on its own', () => {
+    expect(hasNetworkProfile({ resolvers: ['1.1.1.1'] })).toBe(true);
+    expect(hasNetworkProfile({ proxyUrl: 'http://proxy.example.com:8080' })).toBe(true);
+  });
+});
+
+describe('safeFetch', () => {
+  let fetchMock: ReturnType<typeof vi.fn<typeof fetch>>;
+
+  beforeEach(() => {
+    fetchMock = vi.fn<typeof fetch>().mockResolvedValue(new Response('ok'));
+    vi.stubGlobal('fetch', fetchMock);
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+    forgetDispatchers();
+  });
+
+  /**
+   * Every existing caller passes no profile, so that path has to stay exactly what it was: the
+   * global fetch, no dispatcher, no behaviour change.
+   */
+  it('uses the ordinary fetch when nothing is configured', async () => {
+    await safeFetch('https://example.com/feed', { method: 'GET' });
+
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(new URL(fetchMock.mock.calls[0][0] as string | URL).href).toBe('https://example.com/feed');
+    expect(fetchMock.mock.calls[0][1]).toMatchObject({ method: 'GET' });
+  });
+
+  it('still refuses a private address before any connection is attempted', async () => {
+    await expect(safeFetch('http://127.0.0.1:8080/internal')).rejects.toThrow();
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it('allows a private address where the caller opted in', async () => {
+    await expect(safeFetch('http://127.0.0.1:8080/proxy', {}, { allowPrivate: true })).resolves.toBeDefined();
+  });
+
+  it('refuses a protocol that is not http or https', async () => {
+    await expect(safeFetch('file:///etc/passwd')).rejects.toThrow();
+    await expect(safeFetch('ftp://example.com/x')).rejects.toThrow();
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  /**
+   * A profile takes the undici path instead, so the global fetch must not be the one used: that is
+   * what carries the single resolve-check-connect lookup.
+   */
+  it('leaves the ordinary fetch alone once a profile is configured', async () => {
+    // A resolver on loopback refuses immediately rather than timing out, so the branch is proven
+    // without the test waiting on a real DNS deadline.
+    await safeFetch('https://example.com/', {}, { profile: { resolvers: ['127.0.0.1'] } }).catch(() => undefined);
+
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  /** A configured resolver changes how a name is found, never what is allowed once it is found. */
+  it('does not let a profile widen what an address may be', async () => {
+    await expect(safeFetch('http://169.254.169.254/latest/meta-data', {}, { profile: { resolvers: ['1.1.1.1'] } })).rejects.toThrow();
+  });
+});
+
+/**
+ * The window the pre-flight cannot close on its own: a name is resolved once to be approved and
+ * again to be connected to, and nothing says the two answers have to match.
+ */
+describe('safeFetch with the address pinned', () => {
+  let fetchMock: ReturnType<typeof vi.fn<typeof fetch>>;
+
+  beforeEach(() => {
+    fetchMock = vi.fn<typeof fetch>().mockResolvedValue(new Response('ok'));
+    vi.stubGlobal('fetch', fetchMock);
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+    vi.mocked(lookup).mockReset();
+    forgetDispatchers();
+  });
+
+  /**
+   * Public on the lookup that approves it, private on every lookup after that: undici may retry a
+   * refused connect, and a name that flipped once has flipped.
+   */
+  function answersPublicThenPrivate() {
+    vi.mocked(lookup)
+      .mockResolvedValueOnce([{ address: '93.184.216.34', family: 4 }] as never)
+      .mockResolvedValue([{ address: '127.0.0.1', family: 4 }] as never);
+  }
+
+  it('refuses a name that answers publicly and then privately', async () => {
+    answersPublicThenPrivate();
+
+    await expect(safeFetch('http://rebound.example.com/x', {}, { pinResolvedAddress: true })).rejects.toThrow();
+    // No socket was opened to either answer: the connect lookup refused before one could be.
+    expect(fetchMock).not.toHaveBeenCalled();
+    // Both halves of the window are the same call, and the second one is where it closes.
+    expect(vi.mocked(lookup).mock.calls.length).toBeGreaterThan(1);
+  });
+
+  /**
+   * The same sequence without pinning reaches the second answer, so what the option buys is stated
+   * rather than assumed. That is the documented trade for the callers whose URLs an operator chose.
+   */
+  it('reaches the second answer where the caller did not ask for pinning', async () => {
+    answersPublicThenPrivate();
+
+    await expect(safeFetch('http://rebound.example.com/x')).resolves.toBeDefined();
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+  });
+});
+
+/**
+ * The check the connect lookup applies is the same one the pre-flight applies, so the two cannot
+ * drift into disagreeing about an address.
+ */
+describe('isPrivateOrLocalAddress', () => {
+  it('catches the ranges an SSRF actually aims at', () => {
+    for (const address of ['127.0.0.1', '10.0.0.5', '192.168.1.1', '172.16.0.1', '169.254.169.254', '100.64.0.1', '::1', 'fd00::1']) {
+      expect(isPrivateOrLocalAddress(address)).toBe(true);
+    }
+  });
+
+  it('leaves ordinary public addresses alone', () => {
+    for (const address of ['1.1.1.1', '104.20.23.154', '185.178.208.181', '2606:4700::1111']) {
+      expect(isPrivateOrLocalAddress(address)).toBe(false);
+    }
+  });
+
+  /** An IPv4 address written as a mapped IPv6 one is the same address and the same risk. */
+  it('sees through an IPv4-mapped IPv6 address', () => {
+    expect(isPrivateOrLocalAddress('::ffff:127.0.0.1')).toBe(true);
+    expect(isPrivateOrLocalAddress('::ffff:8.8.8.8')).toBe(false);
+  });
+});
diff --git a/server/src/common/utils/safe-fetch.ts b/server/src/common/utils/safe-fetch.ts
new file mode 100644
index 000000000..4d3fc818a
--- /dev/null
+++ b/server/src/common/utils/safe-fetch.ts
@@ -0,0 +1,138 @@
+import { Resolver, lookup } from 'node:dns/promises';
+import { Agent, ProxyAgent, fetch as undiciFetch, type Dispatcher } from 'undici';
+import type { NetworkProfile } from '@bookorbit/types';
+import { hasNetworkProfile } from '@bookorbit/types';
+
+import { PrivateAddressException, ensureSafeUrl, isPrivateOrLocalAddress, type SafeRemoteHostOptions } from './ssrf.utils';
+
+export interface SafeFetchOptions extends SafeRemoteHostOptions {
+  /** How to reach this source, where the default path does not work. */
+  profile?: NetworkProfile | null;
+  signal?: AbortSignal;
+  /**
+   * Close the resolve-twice window described below, for a caller whose URL came from a tracker
+   * rather than from an operator. Costs an undici dispatcher on a path that would otherwise use
+   * the global fetch, which is why it is asked for rather than assumed.
+   */
+  pinResolvedAddress?: boolean;
+}
+
+/**
+ * Agents are pooled per profile so ordinary connection reuse still happens. Keyed on the profile
+ * itself rather than on a host, because that is what decides the network path.
+ */
+const dispatchers = new Map<string, Dispatcher>();
+
+/**
+ * Fetch a URL the way BookOrbit is allowed to.
+ *
+ * Two paths, and they do not offer the same guarantee.
+ *
+ * With a profile, **the address checked is the address connected to**: the policy runs inside the
+ * connect lookup, so there is one resolution and the connection uses exactly what it approved.
+ *
+ * Without one - the overwhelmingly common case - the request goes to the global `fetch` and the
+ * only check is the `ensureSafeUrl` pre-flight above. That resolves the host, approves it, and
+ * then hands the URL to `fetch`, which resolves it again, so a name answering publicly on the
+ * first lookup and privately on the second reaches the private host anyway. The window is left
+ * open deliberately: closing it means routing every caller through an undici dispatcher, which
+ * changes name resolution for all outbound traffic, and the callers whose URLs come from a
+ * tracker rather than from an operator are the narrow case rather than the rule.
+ *
+ * Those narrow callers ask for `pinResolvedAddress`, which takes the dispatcher path with no
+ * profile configured and so gets the same one-resolution guarantee an operator profile gets.
+ *
+ * A profile changes only *how* the address is found and which egress carries the request. It never
+ * relaxes what is allowed: whatever the resolver returns still has to pass the same policy.
+ */
+export async function safeFetch(rawUrl: string, init: RequestInit = {}, options: SafeFetchOptions = {}): Promise<Response> {
+  // A pre-flight so a bad host fails with a clear message rather than as a socket error, and so
+  // a caller with no profile behaves exactly as it did before this existed.
+  const url = await ensureSafeUrl(rawUrl, options);
+
+  if (!hasNetworkProfile(options.profile) && !options.pinResolvedAddress) {
+    return fetch(url, init);
+  }
+
+  const dispatcher = dispatcherFor(options);
+  // undici's own fetch, not the global one: the global fetch rejects a dispatcher built from this
+  // package, because Node bundles a separate copy of undici and type-checks against its own.
+  return undiciFetch(url.href, { ...(init as Record<string, unknown>), dispatcher } as never) as unknown as Promise<Response>;
+}
+
+/** Drop pooled agents, so a settings change is not served by a connection opened under the old one. */
+export function forgetDispatchers(): void {
+  for (const dispatcher of dispatchers.values()) void dispatcher.close();
+  dispatchers.clear();
+}
+
+function dispatcherFor(options: SafeFetchOptions): Dispatcher {
+  // An empty profile is a real case here: `pinResolvedAddress` wants the checked lookup without
+  // asking for a different resolver or an egress, and that pools as its own agent.
+  const profile = options.profile ?? {};
+  const key = JSON.stringify({ r: profile.resolvers ?? [], p: profile.proxyUrl ?? '', a: Boolean(options.allowPrivate) });
+  const existing = dispatchers.get(key);
+  if (existing) return existing;
+
+  const connect = { lookup: buildLookup(profile, options) };
+  const dispatcher: Dispatcher = profile.proxyUrl ? new ProxyAgent({ uri: profile.proxyUrl, connect }) : new Agent({ connect });
+
+  dispatchers.set(key, dispatcher);
+  return dispatcher;
+}
+
+type LookupCallback = (error: NodeJS.ErrnoException | null, addresses: Array<{ address: string; family: number }>) => void;
+
+/**
+ * The one resolution the connection actually uses, checked before it is handed back.
+ *
+ * A proxy resolves the destination itself, so when one is configured the name never reaches this
+ * lookup: only the proxy's own host does. That is the honest trade of proxying, and it is why the
+ * proxy address is validated when the profile is saved rather than only here.
+ */
+function buildLookup(profile: NetworkProfile, options: SafeFetchOptions) {
+  return (hostname: string, _opts: unknown, callback: LookupCallback): void => {
+    void resolveWith(profile, hostname)
+      .then((addresses) => {
+        if (addresses.length === 0) {
+          callback(Object.assign(new Error(`Unable to resolve ${hostname}`), { code: 'ENOTFOUND' }), []);
+          return;
+        }
+        if (!options.allowPrivate && addresses.some((entry) => isPrivateOrLocalAddress(entry.address))) {
+          callback(Object.assign(new PrivateAddressException(), { code: 'EACCES' }) as NodeJS.ErrnoException, []);
+          return;
+        }
+        callback(null, addresses);
+      })
+      .catch((error: unknown) => {
+        callback(Object.assign(error instanceof Error ? error : new Error(String(error)), { code: 'ENOTFOUND' }), []);
+      });
+  };
+}
+
+async function resolveWith(profile: NetworkProfile, hostname: string): Promise<Array<{ address: string; family: number }>> {
+  // With no resolver configured, the system one, which is what the request would have used anyway.
+  // `Resolver` asks a DNS server directly and so never sees a hosts-file or mDNS name, which is
+  // how a LAN source resolves; it is only correct where an operator asked for a specific server.
+  if (!profile.resolvers || profile.resolvers.length === 0) {
+    return systemLookup(hostname);
+  }
+
+  const resolver = new Resolver();
+  resolver.setServers(profile.resolvers);
+
+  // Both families, because a source may publish only one and a failure of the other is not an
+  // error. Rejecting only when neither answered keeps a v4-only host reachable.
+  const [v4, v6] = await Promise.allSettled([resolver.resolve4(hostname), resolver.resolve6(hostname)]);
+  const addresses = [
+    ...(v4.status === 'fulfilled' ? v4.value.map((address) => ({ address, family: 4 })) : []),
+    ...(v6.status === 'fulfilled' ? v6.value.map((address) => ({ address, family: 6 })) : []),
+  ];
+  if (addresses.length === 0 && v4.status === 'rejected') throw v4.reason as Error;
+  return addresses;
+}
+
+async function systemLookup(hostname: string): Promise<Array<{ address: string; family: number }>> {
+  const resolved = await lookup(hostname, { all: true, verbatim: true });
+  return resolved.map((entry) => ({ address: entry.address, family: entry.family }));
+}
diff --git a/server/src/common/utils/ssrf.utils.ts b/server/src/common/utils/ssrf.utils.ts
index f80dfbef1..75e0e84af 100644
--- a/server/src/common/utils/ssrf.utils.ts
+++ b/server/src/common/utils/ssrf.utils.ts
@@ -69,7 +69,8 @@ export async function ensureSafeRemoteHost(hostname: string, options?: SafeRemot
   }
 }
 
-function isPrivateOrLocalAddress(address: string): boolean {
+/** Exported so the one lookup a connection actually uses can apply the same policy. */
+export function isPrivateOrLocalAddress(address: string): boolean {
   const normalized = address.toLowerCase();
   const mappedV4Prefix = '::ffff:';
   const maybeV4 = normalized.startsWith(mappedV4Prefix) ? normalized.slice(mappedV4Prefix.length) : normalized;
diff --git a/server/src/common/utils/with-deadline.utils.test.ts b/server/src/common/utils/with-deadline.utils.test.ts
new file mode 100644
index 000000000..814bfaa54
--- /dev/null
+++ b/server/src/common/utils/with-deadline.utils.test.ts
@@ -0,0 +1,44 @@
+import { withDeadline } from './with-deadline.utils';
+
+describe('withDeadline', () => {
+  it('hands back what the work resolved with when it beats the deadline', async () => {
+    await expect(withDeadline(Promise.resolve('done'), AbortSignal.timeout(1_000))).resolves.toBe('done');
+  });
+
+  it("hands back the work's own failure rather than dressing it as a timeout", async () => {
+    await expect(withDeadline(Promise.reject(new Error('the tracker answered 500')), AbortSignal.timeout(1_000))).rejects.toThrow(
+      'the tracker answered 500',
+    );
+  });
+
+  /** The case the whole helper exists for: work that watches no signal and never settles. */
+  it('ends the wait on work that never settles', async () => {
+    await expect(withDeadline(new Promise(() => {}), AbortSignal.timeout(10))).rejects.toMatchObject({ name: 'TimeoutError' });
+  });
+
+  it("reports the overrun in the caller's own terms when it supplies them", async () => {
+    await expect(withDeadline(new Promise(() => {}), AbortSignal.timeout(10), () => new Error('jackett did not answer in time'))).rejects.toThrow(
+      'jackett did not answer in time',
+    );
+  });
+
+  /** A deadline that has already passed must not wait for an abort event that will never fire. */
+  it('refuses immediately against a signal that is already aborted', async () => {
+    await expect(withDeadline(new Promise(() => {}), AbortSignal.abort(new Error('too late')))).rejects.toThrow('too late');
+  });
+
+  /**
+   * One deadline can cover several calls, so a listener left behind per call is a leak that grows
+   * with the work rather than with the number of deadlines.
+   */
+  it('stops listening once the work has settled', async () => {
+    const controller = new AbortController();
+
+    await withDeadline(Promise.resolve('done'), controller.signal);
+    // Aborting after the fact must reach nothing: an unremoved listener would reject a settled
+    // promise, which is silent, or throw where nothing is waiting.
+    controller.abort(new Error('after the fact'));
+
+    await expect(Promise.resolve('still fine')).resolves.toBe('still fine');
+  });
+});
diff --git a/server/src/common/utils/with-deadline.utils.ts b/server/src/common/utils/with-deadline.utils.ts
new file mode 100644
index 000000000..cecb096aa
--- /dev/null
+++ b/server/src/common/utils/with-deadline.utils.ts
@@ -0,0 +1,33 @@
+/**
+ * A deadline as an outcome rather than as a request the callee may ignore.
+ *
+ * An `AbortSignal` handed to somebody else only ends the work that actually watches it. A plugin
+ * can check its signal between requests but not during one; an adapter may await a promise of its
+ * own that never settles; an HTTP client may lose its own timeout. Racing the signal against the
+ * promise ends the *wait* either way, which is what the caller can act on: a slot in a bounded
+ * pool comes back, a `Promise.all` resolves, a latch is released.
+ *
+ * It does not cancel the work. Whatever was running goes on running, unattached; the signal is
+ * still passed down so anything watching it can stop properly, and this is only the backstop for
+ * everything that does not.
+ *
+ * `timeoutError` shapes the rejection, because each caller reports an overrun in its own terms.
+ * Without one the signal's own reason is used, which is a `TimeoutError` for `AbortSignal.timeout`.
+ */
+export function withDeadline<T>(work: Promise<T>, signal: AbortSignal, timeoutError?: () => Error): Promise<T> {
+  // `signal.reason` is a `TimeoutError` for every deadline here, but an `AbortController` can be
+  // aborted with anything at all, and a rejection that is not an `Error` loses its stack.
+  const reason = (): Error => {
+    if (timeoutError) return timeoutError();
+    return signal.reason instanceof Error ? signal.reason : new Error(String(signal.reason));
+  };
+  if (signal.aborted) return Promise.reject(reason());
+
+  return new Promise<T>((resolve, reject) => {
+    const onAbort = (): void => reject(reason());
+    signal.addEventListener('abort', onAbort, { once: true });
+    // Removed on settle either way, so a long-lived deadline shared by several calls does not
+    // accumulate a listener per call.
+    work.then(resolve, reject).finally(() => signal.removeEventListener('abort', onAbort));
+  });
+}
diff --git a/server/src/common/utils/ws-cors.utils.test.ts b/server/src/common/utils/ws-cors.utils.test.ts
new file mode 100644
index 000000000..b3b3164c3
--- /dev/null
+++ b/server/src/common/utils/ws-cors.utils.test.ts
@@ -0,0 +1,37 @@
+import { afterEach, describe, expect, it } from 'vitest';
+
+import { wsCorsOrigin } from './ws-cors.utils';
+
+const original = process.env.CLIENT_URL;
+
+afterEach(() => {
+  if (original === undefined) delete process.env.CLIENT_URL;
+  else process.env.CLIENT_URL = original;
+});
+
+describe('wsCorsOrigin', () => {
+  it('falls back to the dev client when nothing is configured', () => {
+    delete process.env.CLIENT_URL;
+    expect(wsCorsOrigin()).toBe('http://localhost:5173');
+  });
+
+  it('drops a trailing slash, which no Origin header ever carries', () => {
+    process.env.CLIENT_URL = 'https://books.example.com/';
+    expect(wsCorsOrigin()).toBe('https://books.example.com');
+  });
+
+  it('drops a path, keeping the origin a browser would actually send', () => {
+    process.env.CLIENT_URL = 'https://books.example.com/app';
+    expect(wsCorsOrigin()).toBe('https://books.example.com');
+  });
+
+  it('keeps a non-default port', () => {
+    process.env.CLIENT_URL = 'http://192.168.1.10:8080';
+    expect(wsCorsOrigin()).toBe('http://192.168.1.10:8080');
+  });
+
+  it('falls back rather than throwing on a malformed value', () => {
+    process.env.CLIENT_URL = 'not a url';
+    expect(wsCorsOrigin()).toBe('http://localhost:5173');
+  });
+});
diff --git a/server/src/common/utils/ws-cors.utils.ts b/server/src/common/utils/ws-cors.utils.ts
new file mode 100644
index 000000000..806e8d72e
--- /dev/null
+++ b/server/src/common/utils/ws-cors.utils.ts
@@ -0,0 +1,23 @@
+/** What a dev client is served from, and the only origin allowed when nothing was configured. */
+const DEV_CLIENT_ORIGIN = 'http://localhost:5173';
+
+/**
+ * The origin a socket gateway's CORS check allows.
+ *
+ * `@WebSocketGateway` is evaluated while the class is being defined, before Nest has a container
+ * to inject a typed config from, so this is one of the few places `process.env` is read outside
+ * the config module. Shared so the fallback is stated once rather than once per gateway, and
+ * reduced to an origin because that is what a browser sends: a `CLIENT_URL` carrying a trailing
+ * slash or a path matches no `Origin` header at all, and the gateway then refuses every browser.
+ */
+export function wsCorsOrigin(): string {
+  const configured = process.env.CLIENT_URL?.trim();
+  if (!configured) return DEV_CLIENT_ORIGIN;
+  try {
+    return new URL(configured).origin;
+  } catch {
+    // Startup validation reports a malformed CLIENT_URL properly; refusing every browser here
+    // would only make that failure look like a broken feature instead of a broken setting.
+    return DEV_CLIENT_ORIGIN;
+  }
+}
diff --git a/server/src/config/config.ts b/server/src/config/config.ts
index 8012400ab..c18baa0eb 100644
--- a/server/src/config/config.ts
+++ b/server/src/config/config.ts
@@ -51,6 +51,15 @@ export const migrationConfig = registerAs('migration', () => ({
   importRoot: process.env.MIGRATION_IMPORT_ROOT?.trim() ? resolve(process.env.MIGRATION_IMPORT_ROOT) : undefined,
 }));
 
+/**
+ * Download-client and (from phase 3) indexer credentials. Unlike the email and migration keys,
+ * `RequestCredentialService` refuses to store a secret when this is unset rather than falling
+ * back to plaintext.
+ */
+export const bookRequestConfig = registerAs('bookRequest', () => ({
+  encryptionKey: process.env.BOOK_REQUEST_ENCRYPTION_KEY ?? '',
+}));
+
 export const oidcRuntimeConfig = registerAs('oidcRuntime', () => ({
   stateTtlMs: parsePositiveInteger(process.env.OIDC_STATE_TTL_SECS, 300) * 1000,
   discoveryCacheTtlMs: parsePositiveInteger(process.env.OIDC_DISCOVERY_CACHE_TTL_SECS, 3600) * 1000,
diff --git a/server/src/config/env.validation.ts b/server/src/config/env.validation.ts
index dd8323060..0a99396e2 100644
--- a/server/src/config/env.validation.ts
+++ b/server/src/config/env.validation.ts
@@ -72,6 +72,7 @@ const envSchema = z.object({
   TRUST_PROXY: trustProxyEnv(),
   EMAIL_ENCRYPTION_KEY: z.string().optional(),
   MIGRATION_ENCRYPTION_KEY: z.string().optional(),
+  BOOK_REQUEST_ENCRYPTION_KEY: z.string().optional(),
   MIGRATION_IMPORT_ROOT: z
     .string()
     .transform((val) => val.trim())
diff --git a/server/src/db/migrations/0083_add_book_requests.sql b/server/src/db/migrations/0083_add_book_requests.sql
new file mode 100644
index 000000000..d079dde4d
--- /dev/null
+++ b/server/src/db/migrations/0083_add_book_requests.sql
@@ -0,0 +1,214 @@
+CREATE TYPE "public"."book_request_media_kind" AS ENUM('ebook', 'audiobook', 'comic');--> statement-breakpoint
+CREATE TABLE "book_dock_unit_files" (
+	"id" serial PRIMARY KEY NOT NULL,
+	"dock_file_id" integer NOT NULL,
+	"absolute_path" text NOT NULL,
+	"file_name" varchar(500) NOT NULL,
+	"file_size" bigint,
+	"format" varchar(20),
+	"role" varchar(20) DEFAULT 'content' NOT NULL,
+	"sort_order" integer,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "book_dock_unit_files_absolute_path_unique" UNIQUE("absolute_path"),
+	CONSTRAINT "book_dock_unit_files_role_chk" CHECK ("book_dock_unit_files"."role" in ('content', 'cover', 'metadata', 'supplement'))
+);
+--> statement-breakpoint
+CREATE TABLE "book_request_dedupe_aliases" (
+	"request_id" integer NOT NULL,
+	"dedupe_key" varchar(500) NOT NULL,
+	CONSTRAINT "book_request_dedupe_aliases_request_id_dedupe_key_pk" PRIMARY KEY("request_id","dedupe_key")
+);
+--> statement-breakpoint
+CREATE TABLE "book_request_dismissals" (
+	"request_id" integer NOT NULL,
+	"user_id" integer NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "book_request_dismissals_request_id_user_id_pk" PRIMARY KEY("request_id","user_id")
+);
+--> statement-breakpoint
+CREATE TABLE "book_request_subscribers" (
+	"request_id" integer NOT NULL,
+	"user_id" integer NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "book_request_subscribers_request_id_user_id_pk" PRIMARY KEY("request_id","user_id")
+);
+--> statement-breakpoint
+CREATE TABLE "book_requests" (
+	"id" serial PRIMARY KEY NOT NULL,
+	"user_id" integer NOT NULL,
+	"media_kind" "book_request_media_kind" NOT NULL,
+	"status" varchar(20) DEFAULT 'pending' NOT NULL,
+	"title" varchar(500) NOT NULL,
+	"subtitle" varchar(500),
+	"authors" jsonb DEFAULT '[]'::jsonb NOT NULL,
+	"series_name" varchar(500),
+	"series_index" integer,
+	"isbn10" varchar(20),
+	"isbn13" varchar(20),
+	"published_year" integer,
+	"language" varchar(20),
+	"cover_url" text,
+	"provider_key" varchar(50),
+	"provider_id" varchar(255),
+	"metadata_sources" jsonb DEFAULT '[]'::jsonb NOT NULL,
+	"preferred_formats" jsonb DEFAULT '[]'::jsonb NOT NULL,
+	"note" text,
+	"target_library_id" integer,
+	"target_folder_id" integer,
+	"created_by_user_id" integer,
+	"decided_by_user_id" integer,
+	"decided_at" timestamp with time zone,
+	"decision_note" text,
+	"matched_book_id" integer,
+	"book_dock_file_id" integer,
+	"status_reason" text,
+	"failure_code" varchar(50),
+	"failure_meta" jsonb,
+	"self_serve" boolean DEFAULT false NOT NULL,
+	"fulfiller_user_id" integer,
+	"dedupe_key" varchar(500) NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "book_requests_status_chk" CHECK ("book_requests"."status" in ('pending', 'approved', 'rejected', 'cancelled', 'searching', 'grabbed', 'downloading', 'importing', 'needs_review', 'available', 'failed')),
+	CONSTRAINT "book_requests_series_index_nonnegative_chk" CHECK ("book_requests"."series_index" is null or "book_requests"."series_index" >= 0)
+);
+--> statement-breakpoint
+CREATE TABLE "book_request_downloads" (
+	"id" serial PRIMARY KEY NOT NULL,
+	"request_id" integer NOT NULL,
+	"download_client_id" integer,
+	"indexer_id" integer,
+	"source" varchar(20) NOT NULL,
+	"automated" boolean DEFAULT false NOT NULL,
+	"release_title" varchar(500) NOT NULL,
+	"release_guid" text,
+	"release_size_bytes" bigint,
+	"release_seeders" integer,
+	"release_format" varchar(20),
+	"freeleech" boolean DEFAULT false NOT NULL,
+	"client_hash" varchar(64),
+	"status" varchar(20) DEFAULT 'queued' NOT NULL,
+	"progress_percent" integer DEFAULT 0 NOT NULL,
+	"downloaded_bytes" bigint DEFAULT 0 NOT NULL,
+	"total_bytes" bigint,
+	"direct_url" text,
+	"direct_file_name" varchar(500),
+	"direct_etag" varchar(1024),
+	"direct_last_modified" varchar(200),
+	"content_path" text,
+	"local_path" text,
+	"book_dock_file_id" integer,
+	"release_units" jsonb,
+	"error_message" text,
+	"grabbed_at" timestamp with time zone,
+	"last_progress_at" timestamp with time zone,
+	"completed_at" timestamp with time zone,
+	"imported_at" timestamp with time zone,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "book_request_downloads_source_chk" CHECK ("book_request_downloads"."source" in ('magnet', 'torrent_file', 'direct_url')),
+	CONSTRAINT "book_request_downloads_status_chk" CHECK ("book_request_downloads"."status" in ('queued', 'downloading', 'completed', 'importing', 'needs_review', 'imported', 'failed')),
+	CONSTRAINT "book_request_downloads_progress_range_chk" CHECK ("book_request_downloads"."progress_percent" >= 0 and "book_request_downloads"."progress_percent" <= 100)
+);
+--> statement-breakpoint
+CREATE TABLE "download_client_path_mappings" (
+	"id" serial PRIMARY KEY NOT NULL,
+	"download_client_id" integer NOT NULL,
+	"remote_path" varchar(4096) NOT NULL,
+	"local_path" varchar(4096) NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "download_clients" (
+	"id" serial PRIMARY KEY NOT NULL,
+	"name" varchar(100) NOT NULL,
+	"color" varchar(16),
+	"adapter_type" varchar(30) NOT NULL,
+	"enabled" boolean DEFAULT true NOT NULL,
+	"priority" integer DEFAULT 1 NOT NULL,
+	"base_url" text NOT NULL,
+	"username" varchar(255),
+	"credentials_enc" text,
+	"category" varchar(100) DEFAULT 'bookorbit' NOT NULL,
+	"use_hardlinks" boolean DEFAULT true NOT NULL,
+	"allow_private_address" boolean DEFAULT true NOT NULL,
+	"settings" jsonb,
+	"last_tested_at" timestamp with time zone,
+	"last_test_ok" boolean,
+	"last_error_message" text,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "download_clients_adapter_type_chk" CHECK ("download_clients"."adapter_type" in ('qbittorrent', 'transmission', 'deluge')),
+	CONSTRAINT "download_clients_priority_range_chk" CHECK ("download_clients"."priority" >= 1 and "download_clients"."priority" <= 100)
+);
+--> statement-breakpoint
+CREATE TABLE "request_indexers" (
+	"id" serial PRIMARY KEY NOT NULL,
+	"name" varchar(100) NOT NULL,
+	"color" varchar(16),
+	"adapter_type" varchar(30) NOT NULL,
+	"enabled" boolean DEFAULT true NOT NULL,
+	"base_url" text NOT NULL,
+	"credentials_enc" text,
+	"allow_private_address" boolean DEFAULT false NOT NULL,
+	"categories" jsonb,
+	"disabled_media_kinds" jsonb DEFAULT '[]'::jsonb NOT NULL,
+	"isbn_search_disabled" boolean DEFAULT false NOT NULL,
+	"settings" jsonb,
+	"network_profile" jsonb,
+	"last_tested_at" timestamp with time zone,
+	"last_test_ok" boolean,
+	"last_error_message" text,
+	"last_search_at" timestamp with time zone,
+	"last_search_ok" boolean,
+	"last_search_error" text,
+	"search_failure_streak" integer DEFAULT 0 NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "request_indexers_adapter_type_chk" CHECK ("request_indexers"."adapter_type" ~ '^[a-z0-9][a-z0-9-]{0,29}$')
+);
+--> statement-breakpoint
+ALTER TABLE "users" ADD COLUMN "see_own_requested_books" boolean DEFAULT false NOT NULL;--> statement-breakpoint
+ALTER TABLE "book_dock_files" ADD COLUMN "unit_directory" text;--> statement-breakpoint
+ALTER TABLE "book_dock_files" ADD COLUMN "auto_finalize_suppressed" boolean DEFAULT false NOT NULL;--> statement-breakpoint
+ALTER TABLE "book_dock_unit_files" ADD CONSTRAINT "book_dock_unit_files_dock_file_id_book_dock_files_id_fk" FOREIGN KEY ("dock_file_id") REFERENCES "public"."book_dock_files"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "book_request_dedupe_aliases" ADD CONSTRAINT "book_request_dedupe_aliases_request_id_book_requests_id_fk" FOREIGN KEY ("request_id") REFERENCES "public"."book_requests"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "book_request_dismissals" ADD CONSTRAINT "book_request_dismissals_request_id_book_requests_id_fk" FOREIGN KEY ("request_id") REFERENCES "public"."book_requests"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "book_request_dismissals" ADD CONSTRAINT "book_request_dismissals_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "book_request_subscribers" ADD CONSTRAINT "book_request_subscribers_request_id_book_requests_id_fk" FOREIGN KEY ("request_id") REFERENCES "public"."book_requests"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "book_request_subscribers" ADD CONSTRAINT "book_request_subscribers_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "book_requests" ADD CONSTRAINT "book_requests_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "book_requests" ADD CONSTRAINT "book_requests_target_library_id_libraries_id_fk" FOREIGN KEY ("target_library_id") REFERENCES "public"."libraries"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "book_requests" ADD CONSTRAINT "book_requests_target_folder_id_library_folders_id_fk" FOREIGN KEY ("target_folder_id") REFERENCES "public"."library_folders"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "book_requests" ADD CONSTRAINT "book_requests_created_by_user_id_users_id_fk" FOREIGN KEY ("created_by_user_id") REFERENCES "public"."users"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "book_requests" ADD CONSTRAINT "book_requests_decided_by_user_id_users_id_fk" FOREIGN KEY ("decided_by_user_id") REFERENCES "public"."users"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "book_requests" ADD CONSTRAINT "book_requests_matched_book_id_books_id_fk" FOREIGN KEY ("matched_book_id") REFERENCES "public"."books"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "book_requests" ADD CONSTRAINT "book_requests_book_dock_file_id_book_dock_files_id_fk" FOREIGN KEY ("book_dock_file_id") REFERENCES "public"."book_dock_files"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "book_requests" ADD CONSTRAINT "book_requests_fulfiller_user_id_users_id_fk" FOREIGN KEY ("fulfiller_user_id") REFERENCES "public"."users"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "book_request_downloads" ADD CONSTRAINT "book_request_downloads_request_id_book_requests_id_fk" FOREIGN KEY ("request_id") REFERENCES "public"."book_requests"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "book_request_downloads" ADD CONSTRAINT "book_request_downloads_download_client_id_download_clients_id_fk" FOREIGN KEY ("download_client_id") REFERENCES "public"."download_clients"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "book_request_downloads" ADD CONSTRAINT "book_request_downloads_indexer_id_request_indexers_id_fk" FOREIGN KEY ("indexer_id") REFERENCES "public"."request_indexers"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "book_request_downloads" ADD CONSTRAINT "book_request_downloads_book_dock_file_id_book_dock_files_id_fk" FOREIGN KEY ("book_dock_file_id") REFERENCES "public"."book_dock_files"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "download_client_path_mappings" ADD CONSTRAINT "download_client_path_mappings_download_client_id_download_clients_id_fk" FOREIGN KEY ("download_client_id") REFERENCES "public"."download_clients"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "book_dock_unit_files_dock_file_id_sort_order_idx" ON "book_dock_unit_files" USING btree ("dock_file_id","sort_order");--> statement-breakpoint
+CREATE INDEX "book_request_dedupe_aliases_key_idx" ON "book_request_dedupe_aliases" USING btree ("dedupe_key");--> statement-breakpoint
+CREATE INDEX "book_request_dismissals_user_id_idx" ON "book_request_dismissals" USING btree ("user_id");--> statement-breakpoint
+CREATE INDEX "book_request_subscribers_user_id_idx" ON "book_request_subscribers" USING btree ("user_id");--> statement-breakpoint
+CREATE INDEX "book_requests_user_status_idx" ON "book_requests" USING btree ("user_id","status");--> statement-breakpoint
+CREATE INDEX "book_requests_status_created_at_idx" ON "book_requests" USING btree ("status","created_at");--> statement-breakpoint
+CREATE INDEX "book_requests_target_library_id_idx" ON "book_requests" USING btree ("target_library_id");--> statement-breakpoint
+CREATE INDEX "book_requests_created_at_idx" ON "book_requests" USING btree ("created_at");--> statement-breakpoint
+CREATE INDEX "book_requests_title_idx" ON "book_requests" USING btree ("title");--> statement-breakpoint
+CREATE INDEX "book_requests_matched_book_user_idx" ON "book_requests" USING btree ("matched_book_id","user_id") WHERE "book_requests"."matched_book_id" is not null;--> statement-breakpoint
+CREATE INDEX "book_requests_self_serve_idx" ON "book_requests" USING btree ("self_serve","status","created_at") WHERE "book_requests"."self_serve";--> statement-breakpoint
+CREATE UNIQUE INDEX "book_requests_active_dedupe_key_uidx" ON "book_requests" USING btree ("dedupe_key") WHERE "book_requests"."status" in ('pending', 'approved', 'searching', 'grabbed', 'downloading', 'importing', 'needs_review');--> statement-breakpoint
+CREATE INDEX "book_request_downloads_status_idx" ON "book_request_downloads" USING btree ("status");--> statement-breakpoint
+CREATE INDEX "book_request_downloads_request_latest_idx" ON "book_request_downloads" USING btree ("request_id","id" DESC NULLS LAST);--> statement-breakpoint
+CREATE INDEX "book_request_downloads_book_dock_file_id_idx" ON "book_request_downloads" USING btree ("book_dock_file_id");--> statement-breakpoint
+CREATE UNIQUE INDEX "book_request_downloads_active_hash_uidx" ON "book_request_downloads" USING btree (coalesce("download_client_id", 0),"client_hash") WHERE "book_request_downloads"."status" in ('queued', 'downloading', 'completed', 'importing', 'needs_review');--> statement-breakpoint
+CREATE UNIQUE INDEX "download_client_path_mappings_client_remote_uidx" ON "download_client_path_mappings" USING btree ("download_client_id","remote_path");--> statement-breakpoint
+CREATE UNIQUE INDEX "download_clients_name_lower_uidx" ON "download_clients" USING btree (lower("name"));--> statement-breakpoint
+CREATE INDEX "download_clients_enabled_priority_idx" ON "download_clients" USING btree ("enabled","priority");--> statement-breakpoint
+CREATE UNIQUE INDEX "request_indexers_name_lower_uidx" ON "request_indexers" USING btree (lower("name"));--> statement-breakpoint
+CREATE INDEX "request_indexers_enabled_idx" ON "request_indexers" USING btree ("enabled");--> statement-breakpoint
+ALTER TABLE "book_dock_files" ADD CONSTRAINT "book_dock_files_unit_directory_unique" UNIQUE("unit_directory");
\ No newline at end of file
diff --git a/server/src/db/migrations/meta/0083_snapshot.json b/server/src/db/migrations/meta/0083_snapshot.json
new file mode 100644
index 000000000..a117c0ee3
--- /dev/null
+++ b/server/src/db/migrations/meta/0083_snapshot.json
@@ -0,0 +1,18335 @@
+{
+  "id": "83ab09ee-18a6-4cae-be8e-85bf70e35655",
+  "prevId": "4766afdd-f1d7-4a41-acdb-ab9e2499154f",
+  "version": "7",
+  "dialect": "postgresql",
+  "tables": {
+    "public.audit_log": {
+      "name": "audit_log",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "bigserial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_username": {
+          "name": "actor_username",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "action": {
+          "name": "action",
+          "type": "varchar(100)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource": {
+          "name": "resource",
+          "type": "varchar(100)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resource_id": {
+          "name": "resource_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ip": {
+          "name": "ip",
+          "type": "varchar(45)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "meta": {
+          "name": "meta",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "idx_audit_user_id": {
+          "name": "idx_audit_user_id",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "idx_audit_actor_username": {
+          "name": "idx_audit_actor_username",
+          "columns": [
+            {
+              "expression": "actor_username",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "idx_audit_actor_username_trgm": {
+          "name": "idx_audit_actor_username_trgm",
+          "columns": [
+            {
+              "expression": "actor_username",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "idx_audit_resource": {
+          "name": "idx_audit_resource",
+          "columns": [
+            {
+              "expression": "resource",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "idx_audit_resource_id": {
+          "name": "idx_audit_resource_id",
+          "columns": [
+            {
+              "expression": "resource_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "idx_audit_resource_trgm": {
+          "name": "idx_audit_resource_trgm",
+          "columns": [
+            {
+              "expression": "resource",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "idx_audit_action": {
+          "name": "idx_audit_action",
+          "columns": [
+            {
+              "expression": "action",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "idx_audit_action_trgm": {
+          "name": "idx_audit_action_trgm",
+          "columns": [
+            {
+              "expression": "action",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "idx_audit_description_trgm": {
+          "name": "idx_audit_description_trgm",
+          "columns": [
+            {
+              "expression": "description",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "idx_audit_meta_text_trgm": {
+          "name": "idx_audit_meta_text_trgm",
+          "columns": [
+            {
+              "expression": "(\"meta\"::text) gin_trgm_ops",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "idx_audit_ip": {
+          "name": "idx_audit_ip",
+          "columns": [
+            {
+              "expression": "ip",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "idx_audit_created_at": {
+          "name": "idx_audit_created_at",
+          "columns": [
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "idx_audit_reading_insights_access": {
+          "name": "idx_audit_reading_insights_access",
+          "columns": [
+            {
+              "expression": "resource",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "action",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "audit_log_user_id_users_id_fk": {
+          "name": "audit_log_user_id_users_id_fk",
+          "tableFrom": "audit_log",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.app_settings": {
+      "name": "app_settings",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "varchar(100)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "value": {
+          "name": "value",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "app_settings_key_unique": {
+          "name": "app_settings_key_unique",
+          "nullsNotDistinct": false,
+          "columns": ["key"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.magic_access_tokens": {
+      "name": "magic_access_tokens",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "label": {
+          "name": "label",
+          "type": "varchar(100)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "raw_token": {
+          "name": "raw_token",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "is_active": {
+          "name": "is_active",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "use_count": {
+          "name": "use_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "magic_access_tokens_user_id_idx": {
+          "name": "magic_access_tokens_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "magic_access_tokens_user_id_users_id_fk": {
+          "name": "magic_access_tokens_user_id_users_id_fk",
+          "tableFrom": "magic_access_tokens",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "magic_access_tokens_created_by_users_id_fk": {
+          "name": "magic_access_tokens_created_by_users_id_fk",
+          "tableFrom": "magic_access_tokens",
+          "tableTo": "users",
+          "columnsFrom": ["created_by"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "magic_access_tokens_token_hash_unique": {
+          "name": "magic_access_tokens_token_hash_unique",
+          "nullsNotDistinct": false,
+          "columns": ["token_hash"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "magic_access_tokens_use_count_nonneg_chk": {
+          "name": "magic_access_tokens_use_count_nonneg_chk",
+          "value": "\"magic_access_tokens\".\"use_count\" >= 0"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.password_reset_tokens": {
+      "name": "password_reset_tokens",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "used_at": {
+          "name": "used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "password_reset_tokens_user_id_idx": {
+          "name": "password_reset_tokens_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "password_reset_tokens_expires_at_idx": {
+          "name": "password_reset_tokens_expires_at_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "password_reset_tokens_user_id_users_id_fk": {
+          "name": "password_reset_tokens_user_id_users_id_fk",
+          "tableFrom": "password_reset_tokens",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "password_reset_tokens_token_hash_unique": {
+          "name": "password_reset_tokens_token_hash_unique",
+          "nullsNotDistinct": false,
+          "columns": ["token_hash"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "password_reset_tokens_expires_after_created_chk": {
+          "name": "password_reset_tokens_expires_after_created_chk",
+          "value": "\"password_reset_tokens\".\"expires_at\" > \"password_reset_tokens\".\"created_at\""
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.refresh_tokens": {
+      "name": "refresh_tokens",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "rotated_at": {
+          "name": "rotated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "replaced_by_token_hash": {
+          "name": "replaced_by_token_hash",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "refresh_tokens_user_id_idx": {
+          "name": "refresh_tokens_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "refresh_tokens_expires_at_idx": {
+          "name": "refresh_tokens_expires_at_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "refresh_tokens_user_id_users_id_fk": {
+          "name": "refresh_tokens_user_id_users_id_fk",
+          "tableFrom": "refresh_tokens",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "refresh_tokens_token_hash_unique": {
+          "name": "refresh_tokens_token_hash_unique",
+          "nullsNotDistinct": false,
+          "columns": ["token_hash"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "refresh_tokens_expires_after_created_chk": {
+          "name": "refresh_tokens_expires_after_created_chk",
+          "value": "\"refresh_tokens\".\"expires_at\" > \"refresh_tokens\".\"created_at\""
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.user_content_filter_genres": {
+      "name": "user_content_filter_genres",
+      "schema": "",
+      "columns": {
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "filter_type": {
+          "name": "filter_type",
+          "type": "content_filter_type",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "genre_id": {
+          "name": "genre_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "user_content_filter_genres_genre_id_idx": {
+          "name": "user_content_filter_genres_genre_id_idx",
+          "columns": [
+            {
+              "expression": "genre_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "user_content_filter_genres_user_id_users_id_fk": {
+          "name": "user_content_filter_genres_user_id_users_id_fk",
+          "tableFrom": "user_content_filter_genres",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "user_content_filter_genres_genre_id_genres_id_fk": {
+          "name": "user_content_filter_genres_genre_id_genres_id_fk",
+          "tableFrom": "user_content_filter_genres",
+          "tableTo": "genres",
+          "columnsFrom": ["genre_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "user_content_filter_genres_user_id_filter_type_genre_id_pk": {
+          "name": "user_content_filter_genres_user_id_filter_type_genre_id_pk",
+          "columns": ["user_id", "filter_type", "genre_id"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.user_content_filter_tags": {
+      "name": "user_content_filter_tags",
+      "schema": "",
+      "columns": {
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "filter_type": {
+          "name": "filter_type",
+          "type": "content_filter_type",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "tag_id": {
+          "name": "tag_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "user_content_filter_tags_tag_id_idx": {
+          "name": "user_content_filter_tags_tag_id_idx",
+          "columns": [
+            {
+              "expression": "tag_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "user_content_filter_tags_user_id_users_id_fk": {
+          "name": "user_content_filter_tags_user_id_users_id_fk",
+          "tableFrom": "user_content_filter_tags",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "user_content_filter_tags_tag_id_tags_id_fk": {
+          "name": "user_content_filter_tags_tag_id_tags_id_fk",
+          "tableFrom": "user_content_filter_tags",
+          "tableTo": "tags",
+          "columnsFrom": ["tag_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "user_content_filter_tags_user_id_filter_type_tag_id_pk": {
+          "name": "user_content_filter_tags_user_id_filter_type_tag_id_pk",
+          "columns": ["user_id", "filter_type", "tag_id"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.user_library_access": {
+      "name": "user_library_access",
+      "schema": "",
+      "columns": {
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "library_id": {
+          "name": "library_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "access_level": {
+          "name": "access_level",
+          "type": "library_access_level",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'viewer'"
+        }
+      },
+      "indexes": {
+        "user_library_access_library_user_idx": {
+          "name": "user_library_access_library_user_idx",
+          "columns": [
+            {
+              "expression": "library_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "user_library_access_user_id_users_id_fk": {
+          "name": "user_library_access_user_id_users_id_fk",
+          "tableFrom": "user_library_access",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "user_library_access_library_id_libraries_id_fk": {
+          "name": "user_library_access_library_id_libraries_id_fk",
+          "tableFrom": "user_library_access",
+          "tableTo": "libraries",
+          "columnsFrom": ["library_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "user_library_access_user_id_library_id_pk": {
+          "name": "user_library_access_user_id_library_id_pk",
+          "columns": ["user_id", "library_id"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.user_permissions": {
+      "name": "user_permissions",
+      "schema": "",
+      "columns": {
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "permission_name": {
+          "name": "permission_name",
+          "type": "varchar(100)",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "user_permissions_user_id_users_id_fk": {
+          "name": "user_permissions_user_id_users_id_fk",
+          "tableFrom": "user_permissions",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "user_permissions_user_id_permission_name_pk": {
+          "name": "user_permissions_user_id_permission_name_pk",
+          "columns": ["user_id", "permission_name"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.users": {
+      "name": "users",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "username": {
+          "name": "username",
+          "type": "varchar(100)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "email": {
+          "name": "email",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "password_hash": {
+          "name": "password_hash",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "active": {
+          "name": "active",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "is_superuser": {
+          "name": "is_superuser",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "is_default_password": {
+          "name": "is_default_password",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "token_version": {
+          "name": "token_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "failed_login_attempts": {
+          "name": "failed_login_attempts",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "locked_until": {
+          "name": "locked_until",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "settings": {
+          "name": "settings",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "oidc_subject": {
+          "name": "oidc_subject",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "oidc_issuer": {
+          "name": "oidc_issuer",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "avatar_url": {
+          "name": "avatar_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "avatar_source": {
+          "name": "avatar_source",
+          "type": "user_avatar_source",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'none'"
+        },
+        "avatar_version": {
+          "name": "avatar_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "provisioning_method": {
+          "name": "provisioning_method",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local'"
+        },
+        "last_login_at": {
+          "name": "last_login_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_authenticated_at": {
+          "name": "last_authenticated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "see_own_requested_books": {
+          "name": "see_own_requested_books",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "reading_insights_sharing_level": {
+          "name": "reading_insights_sharing_level",
+          "type": "reading_insights_sharing_level",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'private'"
+        },
+        "reading_insights_consented_at": {
+          "name": "reading_insights_consented_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "users_username_lower_uidx": {
+          "name": "users_username_lower_uidx",
+          "columns": [
+            {
+              "expression": "lower(\"username\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "users_email_lower_uidx": {
+          "name": "users_email_lower_uidx",
+          "columns": [
+            {
+              "expression": "lower(\"email\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"users\".\"email\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "users_oidc_subject_issuer_uidx": {
+          "name": "users_oidc_subject_issuer_uidx",
+          "columns": [
+            {
+              "expression": "oidc_subject",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "oidc_issuer",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"users\".\"oidc_subject\" is not null and \"users\".\"oidc_issuer\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "users_last_authenticated_at_idx": {
+          "name": "users_last_authenticated_at_idx",
+          "columns": [
+            {
+              "expression": "last_authenticated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "users_username_unique": {
+          "name": "users_username_unique",
+          "nullsNotDistinct": false,
+          "columns": ["username"]
+        },
+        "users_email_unique": {
+          "name": "users_email_unique",
+          "nullsNotDistinct": false,
+          "columns": ["email"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "users_provisioning_method_chk": {
+          "name": "users_provisioning_method_chk",
+          "value": "\"users\".\"provisioning_method\" in ('local', 'manual', 'oidc', 'shared')"
+        },
+        "users_token_version_nonnegative_chk": {
+          "name": "users_token_version_nonnegative_chk",
+          "value": "\"users\".\"token_version\" >= 0"
+        },
+        "users_failed_login_attempts_nonnegative_chk": {
+          "name": "users_failed_login_attempts_nonnegative_chk",
+          "value": "\"users\".\"failed_login_attempts\" >= 0"
+        },
+        "users_avatar_version_nonnegative_chk": {
+          "name": "users_avatar_version_nonnegative_chk",
+          "value": "\"users\".\"avatar_version\" >= 0"
+        },
+        "users_reading_insights_consent_chk": {
+          "name": "users_reading_insights_consent_chk",
+          "value": "(\"users\".\"reading_insights_sharing_level\" = 'private' and \"users\".\"reading_insights_consented_at\" is null) or (\"users\".\"reading_insights_sharing_level\" <> 'private' and \"users\".\"reading_insights_consented_at\" is not null)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.comic_metadata": {
+      "name": "comic_metadata",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "book_id": {
+          "name": "book_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_number": {
+          "name": "issue_number",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "volume_name": {
+          "name": "volume_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "pencillers": {
+          "name": "pencillers",
+          "type": "text[]",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "inkers": {
+          "name": "inkers",
+          "type": "text[]",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "colorists": {
+          "name": "colorists",
+          "type": "text[]",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "letterers": {
+          "name": "letterers",
+          "type": "text[]",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cover_artists": {
+          "name": "cover_artists",
+          "type": "text[]",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "characters": {
+          "name": "characters",
+          "type": "text[]",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "teams": {
+          "name": "teams",
+          "type": "text[]",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "locations": {
+          "name": "locations",
+          "type": "text[]",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "story_arcs": {
+          "name": "story_arcs",
+          "type": "text[]",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "comic_metadata_book_id_books_id_fk": {
+          "name": "comic_metadata_book_id_books_id_fk",
+          "tableFrom": "comic_metadata",
+          "tableTo": "books",
+          "columnsFrom": ["book_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "comic_metadata_book_id_unique": {
+          "name": "comic_metadata_book_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["book_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.book_custom_metadata_values": {
+      "name": "book_custom_metadata_values",
+      "schema": "",
+      "columns": {
+        "book_id": {
+          "name": "book_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "field_id": {
+          "name": "field_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "value_text": {
+          "name": "value_text",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "value_number": {
+          "name": "value_number",
+          "type": "double precision",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "value_date": {
+          "name": "value_date",
+          "type": "date",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "value_boolean": {
+          "name": "value_boolean",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "book_custom_metadata_values_field_idx": {
+          "name": "book_custom_metadata_values_field_idx",
+          "columns": [
+            {
+              "expression": "field_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "book_custom_metadata_values_book_id_books_id_fk": {
+          "name": "book_custom_metadata_values_book_id_books_id_fk",
+          "tableFrom": "book_custom_metadata_values",
+          "tableTo": "books",
+          "columnsFrom": ["book_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "book_custom_metadata_values_field_id_custom_metadata_fields_id_fk": {
+          "name": "book_custom_metadata_values_field_id_custom_metadata_fields_id_fk",
+          "tableFrom": "book_custom_metadata_values",
+          "tableTo": "custom_metadata_fields",
+          "columnsFrom": ["field_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "book_custom_metadata_values_book_id_field_id_pk": {
+          "name": "book_custom_metadata_values_book_id_field_id_pk",
+          "columns": ["book_id", "field_id"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "book_custom_metadata_values_single_value_chk": {
+          "name": "book_custom_metadata_values_single_value_chk",
+          "value": "(\n        (\"book_custom_metadata_values\".\"value_text\" is not null)::int +\n        (\"book_custom_metadata_values\".\"value_number\" is not null)::int +\n        (\"book_custom_metadata_values\".\"value_date\" is not null)::int +\n        (\"book_custom_metadata_values\".\"value_boolean\" is not null)::int\n      ) <= 1"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.custom_metadata_fields": {
+      "name": "custom_metadata_fields",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "varchar(100)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "label": {
+          "name": "label",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "type": {
+          "name": "type",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "display_order": {
+          "name": "display_order",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "custom_metadata_fields_key_uidx": {
+          "name": "custom_metadata_fields_key_uidx",
+          "columns": [
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "custom_metadata_fields_active_order_idx": {
+          "name": "custom_metadata_fields_active_order_idx",
+          "columns": [
+            {
+              "expression": "archived_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "display_order",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "label",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "custom_metadata_fields_type_chk": {
+          "name": "custom_metadata_fields_type_chk",
+          "value": "\"custom_metadata_fields\".\"type\" in ('text', 'url', 'number', 'date', 'boolean')"
+        },
+        "custom_metadata_fields_key_format_chk": {
+          "name": "custom_metadata_fields_key_format_chk",
+          "value": "\"custom_metadata_fields\".\"key\" ~ '^[a-z0-9][a-z0-9_]{0,99}$'"
+        },
+        "custom_metadata_fields_label_not_blank_chk": {
+          "name": "custom_metadata_fields_label_not_blank_chk",
+          "value": "length(btrim(\"custom_metadata_fields\".\"label\")) > 0"
+        },
+        "custom_metadata_fields_display_order_nonnegative_chk": {
+          "name": "custom_metadata_fields_display_order_nonnegative_chk",
+          "value": "\"custom_metadata_fields\".\"display_order\" >= 0"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.custom_metadata_library_fields": {
+      "name": "custom_metadata_library_fields",
+      "schema": "",
+      "columns": {
+        "field_id": {
+          "name": "field_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "library_id": {
+          "name": "library_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "display_order": {
+          "name": "display_order",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "custom_metadata_library_fields_field_idx": {
+          "name": "custom_metadata_library_fields_field_idx",
+          "columns": [
+            {
+              "expression": "field_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "custom_metadata_library_fields_library_order_idx": {
+          "name": "custom_metadata_library_fields_library_order_idx",
+          "columns": [
+            {
+              "expression": "library_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "display_order",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "field_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "custom_metadata_library_fields_field_id_custom_metadata_fields_id_fk": {
+          "name": "custom_metadata_library_fields_field_id_custom_metadata_fields_id_fk",
+          "tableFrom": "custom_metadata_library_fields",
+          "tableTo": "custom_metadata_fields",
+          "columnsFrom": ["field_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "custom_metadata_library_fields_library_id_libraries_id_fk": {
+          "name": "custom_metadata_library_fields_library_id_libraries_id_fk",
+          "tableFrom": "custom_metadata_library_fields",
+          "tableTo": "libraries",
+          "columnsFrom": ["library_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "custom_metadata_library_fields_library_id_field_id_pk": {
+          "name": "custom_metadata_library_fields_library_id_field_id_pk",
+          "columns": ["library_id", "field_id"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "custom_metadata_library_fields_display_order_nonnegative_chk": {
+          "name": "custom_metadata_library_fields_display_order_nonnegative_chk",
+          "value": "\"custom_metadata_library_fields\".\"display_order\" >= 0"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.custom_icons": {
+      "name": "custom_icons",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "slug": {
+          "name": "slug",
+          "type": "varchar(80)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(120)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "original_file_name": {
+          "name": "original_file_name",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stored_file_name": {
+          "name": "stored_file_name",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "file_size": {
+          "name": "file_size",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "file_hash": {
+          "name": "file_hash",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "custom_icons_slug_uidx": {
+          "name": "custom_icons_slug_uidx",
+          "columns": [
+            {
+              "expression": "slug",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "custom_icons_slug_chk": {
+          "name": "custom_icons_slug_chk",
+          "value": "\"custom_icons\".\"slug\" ~ '^[a-z0-9][a-z0-9-]*[a-z0-9]$' or \"custom_icons\".\"slug\" ~ '^[a-z0-9]$'"
+        },
+        "custom_icons_file_size_positive_chk": {
+          "name": "custom_icons_file_size_positive_chk",
+          "value": "\"custom_icons\".\"file_size\" > 0"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.migration_plan_artifacts": {
+      "name": "migration_plan_artifacts",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "source_id": {
+          "name": "source_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_snapshot_hash": {
+          "name": "source_snapshot_hash",
+          "type": "varchar(128)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "profile_hash": {
+          "name": "profile_hash",
+          "type": "varchar(128)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plan_hash": {
+          "name": "plan_hash",
+          "type": "varchar(128)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plan": {
+          "name": "plan",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_data": {
+          "name": "source_data",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "summary": {
+          "name": "summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "migration_plan_artifacts_plan_hash_uidx": {
+          "name": "migration_plan_artifacts_plan_hash_uidx",
+          "columns": [
+            {
+              "expression": "plan_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "migration_plan_artifacts_source_id_idx": {
+          "name": "migration_plan_artifacts_source_id_idx",
+          "columns": [
+            {
+              "expression": "source_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "migration_plan_artifacts_profile_id_idx": {
+          "name": "migration_plan_artifacts_profile_id_idx",
+          "columns": [
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "migration_plan_artifacts_source_id_migration_sources_id_fk": {
+          "name": "migration_plan_artifacts_source_id_migration_sources_id_fk",
+          "tableFrom": "migration_plan_artifacts",
+          "tableTo": "migration_sources",
+          "columnsFrom": ["source_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "migration_plan_artifacts_profile_id_migration_profiles_id_fk": {
+          "name": "migration_plan_artifacts_profile_id_migration_profiles_id_fk",
+          "tableFrom": "migration_plan_artifacts",
+          "tableTo": "migration_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "migration_plan_artifacts_created_by_user_id_users_id_fk": {
+          "name": "migration_plan_artifacts_created_by_user_id_users_id_fk",
+          "tableFrom": "migration_plan_artifacts",
+          "tableTo": "users",
+          "columnsFrom": ["created_by_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "migration_plan_artifacts_profile_source_fk": {
+          "name": "migration_plan_artifacts_profile_source_fk",
+          "tableFrom": "migration_plan_artifacts",
+          "tableTo": "migration_profiles",
+          "columnsFrom": ["profile_id", "source_id"],
+          "columnsTo": ["id", "source_id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "migration_plan_artifacts_id_source_profile_unique": {
+          "name": "migration_plan_artifacts_id_source_profile_unique",
+          "nullsNotDistinct": false,
+          "columns": ["id", "source_id", "profile_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.migration_profiles": {
+      "name": "migration_profiles",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "source_id": {
+          "name": "source_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "version": {
+          "name": "version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "user_mappings": {
+          "name": "user_mappings",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "path_mappings": {
+          "name": "path_mappings",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "scope": {
+          "name": "scope",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "migration_profiles_source_name_version_uidx": {
+          "name": "migration_profiles_source_name_version_uidx",
+          "columns": [
+            {
+              "expression": "source_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "version",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "migration_profiles_source_id_idx": {
+          "name": "migration_profiles_source_id_idx",
+          "columns": [
+            {
+              "expression": "source_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "migration_profiles_source_id_migration_sources_id_fk": {
+          "name": "migration_profiles_source_id_migration_sources_id_fk",
+          "tableFrom": "migration_profiles",
+          "tableTo": "migration_sources",
+          "columnsFrom": ["source_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "migration_profiles_created_by_user_id_users_id_fk": {
+          "name": "migration_profiles_created_by_user_id_users_id_fk",
+          "tableFrom": "migration_profiles",
+          "tableTo": "users",
+          "columnsFrom": ["created_by_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "migration_profiles_id_source_id_unique": {
+          "name": "migration_profiles_id_source_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["id", "source_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "migration_profiles_version_positive_chk": {
+          "name": "migration_profiles_version_positive_chk",
+          "value": "\"migration_profiles\".\"version\" >= 1"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.migration_run_metrics": {
+      "name": "migration_run_metrics",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stage": {
+          "name": "stage",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "entity_type": {
+          "name": "entity_type",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "processed": {
+          "name": "processed",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "imported": {
+          "name": "imported",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "skipped": {
+          "name": "skipped",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "unresolved": {
+          "name": "unresolved",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "failed": {
+          "name": "failed",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "migration_run_metrics_run_stage_entity_uidx": {
+          "name": "migration_run_metrics_run_stage_entity_uidx",
+          "columns": [
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "stage",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "entity_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "migration_run_metrics_run_id_idx": {
+          "name": "migration_run_metrics_run_id_idx",
+          "columns": [
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "migration_run_metrics_run_id_migration_runs_id_fk": {
+          "name": "migration_run_metrics_run_id_migration_runs_id_fk",
+          "tableFrom": "migration_run_metrics",
+          "tableTo": "migration_runs",
+          "columnsFrom": ["run_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "migration_run_metrics_processed_nonnegative_chk": {
+          "name": "migration_run_metrics_processed_nonnegative_chk",
+          "value": "\"migration_run_metrics\".\"processed\" >= 0"
+        },
+        "migration_run_metrics_imported_nonnegative_chk": {
+          "name": "migration_run_metrics_imported_nonnegative_chk",
+          "value": "\"migration_run_metrics\".\"imported\" >= 0"
+        },
+        "migration_run_metrics_skipped_nonnegative_chk": {
+          "name": "migration_run_metrics_skipped_nonnegative_chk",
+          "value": "\"migration_run_metrics\".\"skipped\" >= 0"
+        },
+        "migration_run_metrics_unresolved_nonnegative_chk": {
+          "name": "migration_run_metrics_unresolved_nonnegative_chk",
+          "value": "\"migration_run_metrics\".\"unresolved\" >= 0"
+        },
+        "migration_run_metrics_failed_nonnegative_chk": {
+          "name": "migration_run_metrics_failed_nonnegative_chk",
+          "value": "\"migration_run_metrics\".\"failed\" >= 0"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.migration_runs": {
+      "name": "migration_runs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "source_id": {
+          "name": "source_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plan_artifact_id": {
+          "name": "plan_artifact_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "target_key": {
+          "name": "target_key",
+          "type": "varchar(100)",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'bookorbit'"
+        },
+        "state": {
+          "name": "state",
+          "type": "varchar(32)",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'draft'"
+        },
+        "current_stage": {
+          "name": "current_stage",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "triggered_by_user_id": {
+          "name": "triggered_by_user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "ended_at": {
+          "name": "ended_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_message": {
+          "name": "error_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "migration_runs_source_target_state_idx": {
+          "name": "migration_runs_source_target_state_idx",
+          "columns": [
+            {
+              "expression": "source_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "state",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "migration_runs_state_idx": {
+          "name": "migration_runs_state_idx",
+          "columns": [
+            {
+              "expression": "state",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "migration_runs_source_id_migration_sources_id_fk": {
+          "name": "migration_runs_source_id_migration_sources_id_fk",
+          "tableFrom": "migration_runs",
+          "tableTo": "migration_sources",
+          "columnsFrom": ["source_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "migration_runs_profile_id_migration_profiles_id_fk": {
+          "name": "migration_runs_profile_id_migration_profiles_id_fk",
+          "tableFrom": "migration_runs",
+          "tableTo": "migration_profiles",
+          "columnsFrom": ["profile_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "migration_runs_plan_artifact_id_migration_plan_artifacts_id_fk": {
+          "name": "migration_runs_plan_artifact_id_migration_plan_artifacts_id_fk",
+          "tableFrom": "migration_runs",
+          "tableTo": "migration_plan_artifacts",
+          "columnsFrom": ["plan_artifact_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "migration_runs_triggered_by_user_id_users_id_fk": {
+          "name": "migration_runs_triggered_by_user_id_users_id_fk",
+          "tableFrom": "migration_runs",
+          "tableTo": "users",
+          "columnsFrom": ["triggered_by_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "migration_runs_profile_source_fk": {
+          "name": "migration_runs_profile_source_fk",
+          "tableFrom": "migration_runs",
+          "tableTo": "migration_profiles",
+          "columnsFrom": ["profile_id", "source_id"],
+          "columnsTo": ["id", "source_id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "migration_runs_plan_artifact_source_profile_fk": {
+          "name": "migration_runs_plan_artifact_source_profile_fk",
+          "tableFrom": "migration_runs",
+          "tableTo": "migration_plan_artifacts",
+          "columnsFrom": ["plan_artifact_id", "source_id", "profile_id"],
+          "columnsTo": ["id", "source_id", "profile_id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "migration_runs_state_chk": {
+          "name": "migration_runs_state_chk",
+          "value": "\"state\" IN ('draft', 'preflight_failed', 'dry_run_ready', 'running', 'failed', 'completed')"
+        },
+        "migration_runs_started_before_ended_chk": {
+          "name": "migration_runs_started_before_ended_chk",
+          "value": "\"migration_runs\".\"ended_at\" is null or \"migration_runs\".\"started_at\" is null or \"migration_runs\".\"ended_at\" >= \"migration_runs\".\"started_at\""
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.migration_sources": {
+      "name": "migration_sources",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "type": {
+          "name": "type",
+          "type": "varchar(50)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "connection_config": {
+          "name": "connection_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "capabilities": {
+          "name": "capabilities",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_validated_at": {
+          "name": "last_validated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "migration_sources_type_name_uidx": {
+          "name": "migration_sources_type_name_uidx",
+          "columns": [
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "migration_sources_created_by_user_id_idx": {
+          "name": "migration_sources_created_by_user_id_idx",
+          "columns": [
+            {
+              "expression": "created_by_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "migration_sources_created_by_user_id_users_id_fk": {
+          "name": "migration_sources_created_by_user_id_users_id_fk",
+          "tableFrom": "migration_sources",
+          "tableTo": "users",
+          "columnsFrom": ["created_by_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.libraries": {
+      "name": "libraries",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "icon": {
+          "name": "icon",
+          "type": "varchar(100)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "display_order": {
+          "name": "display_order",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "cover_aspect_ratio": {
+          "name": "cover_aspect_ratio",
+          "type": "varchar(10)",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'2/3'"
+        },
+        "watch": {
+          "name": "watch",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "auto_scan_cron_expression": {
+          "name": "auto_scan_cron_expression",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata_precedence": {
+          "name": "metadata_precedence",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[\"folderStructure\",\"embedded\",\"nfoFile\",\"opfFile\",\"sidecar\"]'::jsonb"
+        },
+        "format_priority": {
+          "name": "format_priority",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[\"epub\",\"pdf\",\"cbz\",\"cbr\",\"cb7\",\"mobi\",\"azw3\",\"azw\",\"fb2\",\"m4b\",\"mp3\",\"m4a\",\"opus\",\"ogg\",\"flac\"]'::jsonb"
+        },
+        "allowed_formats": {
+          "name": "allowed_formats",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "organization_mode": {
+          "name": "organization_mode",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'book_per_folder'"
+        },
+        "exclude_patterns": {
+          "name": "exclude_patterns",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "reading_threshold": {
+          "name": "reading_threshold",
+          "type": "double precision",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0.25
+        },
+        "mark_as_finished_percent_complete": {
+          "name": "mark_as_finished_percent_complete",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 98
+        },
+        "file_write_enabled": {
+          "name": "file_write_enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "file_write_write_cover": {
+          "name": "file_write_write_cover",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "file_write_epub_enabled": {
+          "name": "file_write_epub_enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "file_write_epub_max_file_size_mb": {
+          "name": "file_write_epub_max_file_size_mb",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 100
+        },
+        "file_write_fb2_enabled": {
+          "name": "file_write_fb2_enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "file_write_fb2_max_file_size_mb": {
+          "name": "file_write_fb2_max_file_size_mb",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 100
+        },
+        "file_write_pdf_enabled": {
+          "name": "file_write_pdf_enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "file_write_pdf_max_file_size_mb": {
+          "name": "file_write_pdf_max_file_size_mb",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 100
+        },
+        "file_write_cbx_enabled": {
+          "name": "file_write_cbx_enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "file_write_cbx_max_file_size_mb": {
+          "name": "file_write_cbx_max_file_size_mb",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 500
+        },
+        "file_write_kindle_enabled": {
+          "name": "file_write_kindle_enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "file_write_kindle_max_file_size_mb": {
+          "name": "file_write_kindle_max_file_size_mb",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 100
+        },
+        "file_write_audio_enabled": {
+          "name": "file_write_audio_enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "file_write_audio_max_file_size_mb": {
+          "name": "file_write_audio_max_file_size_mb",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 500
+        },
+        "file_rename_enabled": {
+          "name": "file_rename_enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "file_naming_pattern": {
+          "name": "file_naming_pattern",
+          "type": "varchar(500)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata_fetch_preferences": {
+          "name": "metadata_fetch_preferences",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "book_metadata_fetch_config": {
+          "name": "book_metadata_fetch_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "book_metadata_fetch_last_run_at": {
+          "name": "book_metadata_fetch_last_run_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "book_metadata_fetch_last_queued_count": {
+          "name": "book_metadata_fetch_last_queued_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scan_mode": {
+          "name": "scan_mode",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'auto'"
+        },
+        "poll_interval_seconds": {
+          "name": "poll_interval_seconds",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false,
+          "default": 300
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "libraries_name_lower_uidx": {
+          "name": "libraries_name_lower_uidx",
+          "columns": [
+            {
+              "expression": "lower(\"name\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "libraries_display_order_nonnegative_chk": {
+          "name": "libraries_display_order_nonnegative_chk",
+          "value": "\"libraries\".\"display_order\" >= 0"
+        },
+        "libraries_organization_mode_chk": {
+          "name": "libraries_organization_mode_chk",
+          "value": "\"libraries\".\"organization_mode\" in ('book_per_folder', 'book_per_file')"
+        },
+        "libraries_reading_threshold_range_chk": {
+          "name": "libraries_reading_threshold_range_chk",
+          "value": "\"libraries\".\"reading_threshold\" >= 0 and \"libraries\".\"reading_threshold\" <= 100"
+        },
+        "libraries_mark_finished_percent_range_chk": {
+          "name": "libraries_mark_finished_percent_range_chk",
+          "value": "\"libraries\".\"mark_as_finished_percent_complete\" >= 0 and \"libraries\".\"mark_as_finished_percent_complete\" <= 100"
+        },
+        "libraries_scan_mode_chk": {
+          "name": "libraries_scan_mode_chk",
+          "value": "\"libraries\".\"scan_mode\" in ('auto', 'manual')"
+        },
+        "libraries_poll_interval_nonnegative_chk": {
+          "name": "libraries_poll_interval_nonnegative_chk",
+          "value": "\"libraries\".\"poll_interval_seconds\" is null or \"libraries\".\"poll_interval_seconds\" >= 0"
+        },
+        "libraries_file_write_epub_max_size_chk": {
+          "name": "libraries_file_write_epub_max_size_chk",
+          "value": "\"libraries\".\"file_write_epub_max_file_size_mb\" >= 1"
+        },
+        "libraries_file_write_pdf_max_size_chk": {
+          "name": "libraries_file_write_pdf_max_size_chk",
+          "value": "\"libraries\".\"file_write_pdf_max_file_size_mb\" >= 1"
+        },
+        "libraries_file_write_cbx_max_size_chk": {
+          "name": "libraries_file_write_cbx_max_size_chk",
+          "value": "\"libraries\".\"file_write_cbx_max_file_size_mb\" >= 1"
+        },
+        "libraries_file_write_kindle_max_size_chk": {
+          "name": "libraries_file_write_kindle_max_size_chk",
+          "value": "\"libraries\".\"file_write_kindle_max_file_size_mb\" >= 1"
+        },
+        "libraries_file_write_audio_max_size_chk": {
+          "name": "libraries_file_write_audio_max_size_chk",
+          "value": "\"libraries\".\"file_write_audio_max_file_size_mb\" >= 1"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.library_folders": {
+      "name": "library_folders",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "library_id": {
+          "name": "library_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "path": {
+          "name": "path",
+          "type": "varchar(4096)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "library_folders_library_id_idx": {
+          "name": "library_folders_library_id_idx",
+          "columns": [
+            {
+              "expression": "library_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "library_folders_library_path_uidx": {
+          "name": "library_folders_library_path_uidx",
+          "columns": [
+            {
+              "expression": "library_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "path",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "library_folders_library_id_libraries_id_fk": {
+          "name": "library_folders_library_id_libraries_id_fk",
+          "tableFrom": "library_folders",
+          "tableTo": "libraries",
+          "columnsFrom": ["library_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "library_folders_id_library_id_unique": {
+          "name": "library_folders_id_library_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["id", "library_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.book_files": {
+      "name": "book_files",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "book_id": {
+          "name": "book_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "library_folder_id": {
+          "name": "library_folder_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "absolute_path": {
+          "name": "absolute_path",
+          "type": "varchar(4096)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "rel_path": {
+          "name": "rel_path",
+          "type": "varchar(4096)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "ino": {
+          "name": "ino",
+          "type": "numeric(20, 0)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "size_bytes": {
+          "name": "size_bytes",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "mtime": {
+          "name": "mtime",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "file_hash": {
+          "name": "file_hash",
+          "type": "varchar(32)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "format": {
+          "name": "format",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "role": {
+          "name": "role",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'content'"
+        },
+        "sort_order": {
+          "name": "sort_order",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "duration_seconds": {
+          "name": "duration_seconds",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "is_fixed_layout": {
+          "name": "is_fixed_layout",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "book_files_absolute_path_uidx": {
+          "name": "book_files_absolute_path_uidx",
+          "columns": [
+            {
+              "expression": "absolute_path",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "book_files_book_id_idx": {
+          "name": "book_files_book_id_idx",
+          "columns": [
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "book_files_library_folder_id_idx": {
+          "name": "book_files_library_folder_id_idx",
+          "columns": [
+            {
+              "expression": "library_folder_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "book_files_file_hash_idx": {
+          "name": "book_files_file_hash_idx",
+          "columns": [
+            {
+              "expression": "file_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "book_files_ino_idx": {
+          "name": "book_files_ino_idx",
+          "columns": [
+            {
+              "expression": "ino",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "book_files_format_idx": {
+          "name": "book_files_format_idx",
+          "columns": [
+            {
+              "expression": "format",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "book_files_library_folder_file_hash_idx": {
+          "name": "book_files_library_folder_file_hash_idx",
+          "columns": [
+            {
+              "expression": "library_folder_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "file_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "book_files_library_folder_ino_idx": {
+          "name": "book_files_library_folder_ino_idx",
+          "columns": [
+            {
+              "expression": "library_folder_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ino",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "book_files_book_id_books_id_fk": {
+          "name": "book_files_book_id_books_id_fk",
+          "tableFrom": "book_files",
+          "tableTo": "books",
+          "columnsFrom": ["book_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "book_files_library_folder_id_library_folders_id_fk": {
+          "name": "book_files_library_folder_id_library_folders_id_fk",
+          "tableFrom": "book_files",
+          "tableTo": "library_folders",
+          "columnsFrom": ["library_folder_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "book_files_book_folder_consistency_fk": {
+          "name": "book_files_book_folder_consistency_fk",
+          "tableFrom": "book_files",
+          "tableTo": "books",
+          "columnsFrom": ["book_id", "library_folder_id"],
+          "columnsTo": ["id", "library_folder_id"],
+          "onDelete": "cascade",
+          "onUpdate": "cascade"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "book_files_role_chk": {
+          "name": "book_files_role_chk",
+          "value": "\"book_files\".\"role\" in ('content', 'cover', 'metadata', 'supplement')"
+        },
+        "book_files_size_bytes_nonnegative_chk": {
+          "name": "book_files_size_bytes_nonnegative_chk",
+          "value": "\"book_files\".\"size_bytes\" is null or \"book_files\".\"size_bytes\" >= 0"
+        },
+        "book_files_duration_seconds_nonnegative_chk": {
+          "name": "book_files_duration_seconds_nonnegative_chk",
+          "value": "\"book_files\".\"duration_seconds\" is null or \"book_files\".\"duration_seconds\" >= 0"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.books": {
+      "name": "books",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "library_id": {
+          "name": "library_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "library_folder_id": {
+          "name": "library_folder_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "primary_file_id": {
+          "name": "primary_file_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "primary_author_sort_name": {
+          "name": "primary_author_sort_name",
+          "type": "varchar(500)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "folder_path": {
+          "name": "folder_path",
+          "type": "varchar(4096)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'present'"
+        },
+        "added_at": {
+          "name": "added_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "books_library_id_folder_path_idx": {
+          "name": "books_library_id_folder_path_idx",
+          "columns": [
+            {
+              "expression": "library_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "folder_path",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "books_primary_file_id_idx": {
+          "name": "books_primary_file_id_idx",
+          "columns": [
+            {
+              "expression": "primary_file_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "books_library_status_id_idx": {
+          "name": "books_library_status_id_idx",
+          "columns": [
+            {
+              "expression": "library_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "books_library_added_at_idx": {
+          "name": "books_library_added_at_idx",
+          "columns": [
+            {
+              "expression": "library_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "\"added_at\" desc",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "books_library_visible_added_id_idx": {
+          "name": "books_library_visible_added_id_idx",
+          "columns": [
+            {
+              "expression": "library_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "\"added_at\" desc",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"books\".\"status\" <> 'processing'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "books_library_author_sort_id_idx": {
+          "name": "books_library_author_sort_id_idx",
+          "columns": [
+            {
+              "expression": "library_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "\"primary_author_sort_name\" asc nulls last",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"books\".\"status\" <> 'processing'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "books_library_author_sort_desc_id_idx": {
+          "name": "books_library_author_sort_desc_id_idx",
+          "columns": [
+            {
+              "expression": "library_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "\"primary_author_sort_name\" desc nulls last",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"books\".\"status\" <> 'processing'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "books_library_id_libraries_id_fk": {
+          "name": "books_library_id_libraries_id_fk",
+          "tableFrom": "books",
+          "tableTo": "libraries",
+          "columnsFrom": ["library_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "books_library_folder_id_library_folders_id_fk": {
+          "name": "books_library_folder_id_library_folders_id_fk",
+          "tableFrom": "books",
+          "tableTo": "library_folders",
+          "columnsFrom": ["library_folder_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "books_primary_file_id_book_files_id_fk": {
+          "name": "books_primary_file_id_book_files_id_fk",
+          "tableFrom": "books",
+          "tableTo": "book_files",
+          "columnsFrom": ["primary_file_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "books_library_folder_library_fk": {
+          "name": "books_library_folder_library_fk",
+          "tableFrom": "books",
+          "tableTo": "library_folders",
+          "columnsFrom": ["library_folder_id", "library_id"],
+          "columnsTo": ["id", "library_id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "books_id_library_folder_id_unique": {
+          "name": "books_id_library_folder_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["id", "library_folder_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "books_status_chk": {
+          "name": "books_status_chk",
+          "value": "\"books\".\"status\" in ('present', 'missing', 'processing')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.book_duplicate_group_members": {
+      "name": "book_duplicate_group_members",
+      "schema": "",
+      "columns": {
+        "group_id": {
+          "name": "group_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scan_id": {
+          "name": "scan_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "book_id": {
+          "name": "book_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "book_duplicate_group_members_group_idx": {
+          "name": "book_duplicate_group_members_group_idx",
+          "columns": [
+            {
+              "expression": "group_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "book_duplicate_group_members_group_id_book_duplicate_groups_id_fk": {
+          "name": "book_duplicate_group_members_group_id_book_duplicate_groups_id_fk",
+          "tableFrom": "book_duplicate_group_members",
+          "tableTo": "book_duplicate_groups",
+          "columnsFrom": ["group_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "book_duplicate_group_members_scan_id_book_duplicate_scans_id_fk": {
+          "name": "book_duplicate_group_members_scan_id_book_duplicate_scans_id_fk",
+          "tableFrom": "book_duplicate_group_members",
+          "tableTo": "book_duplicate_scans",
+          "columnsFrom": ["scan_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "book_duplicate_group_members_book_id_books_id_fk": {
+          "name": "book_duplicate_group_members_book_id_books_id_fk",
+          "tableFrom": "book_duplicate_group_members",
+          "tableTo": "books",
+          "columnsFrom": ["book_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "book_duplicate_group_members_scan_id_book_id_pk": {
+          "name": "book_duplicate_group_members_scan_id_book_id_pk",
+          "columns": ["scan_id", "book_id"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.book_duplicate_groups": {
+      "name": "book_duplicate_groups",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "scan_id": {
+          "name": "scan_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "root_book_id": {
+          "name": "root_book_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reasons": {
+          "name": "reasons",
+          "type": "text[]",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "max_title_similarity": {
+          "name": "max_title_similarity",
+          "type": "real",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "member_count": {
+          "name": "member_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "book_duplicate_groups_scan_root_uidx": {
+          "name": "book_duplicate_groups_scan_root_uidx",
+          "columns": [
+            {
+              "expression": "scan_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "root_book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "book_duplicate_groups_scan_id_idx": {
+          "name": "book_duplicate_groups_scan_id_idx",
+          "columns": [
+            {
+              "expression": "scan_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "book_duplicate_groups_scan_member_count_idx": {
+          "name": "book_duplicate_groups_scan_member_count_idx",
+          "columns": [
+            {
+              "expression": "scan_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "member_count",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "book_duplicate_groups_scan_id_book_duplicate_scans_id_fk": {
+          "name": "book_duplicate_groups_scan_id_book_duplicate_scans_id_fk",
+          "tableFrom": "book_duplicate_groups",
+          "tableTo": "book_duplicate_scans",
+          "columnsFrom": ["scan_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "book_duplicate_groups_root_book_id_books_id_fk": {
+          "name": "book_duplicate_groups_root_book_id_books_id_fk",
+          "tableFrom": "book_duplicate_groups",
+          "tableTo": "books",
+          "columnsFrom": ["root_book_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.book_duplicate_pairs": {
+      "name": "book_duplicate_pairs",
+      "schema": "",
+      "columns": {
+        "scan_id": {
+          "name": "scan_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "group_id": {
+          "name": "group_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "book_id_a": {
+          "name": "book_id_a",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "book_id_b": {
+          "name": "book_id_b",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reasons": {
+          "name": "reasons",
+          "type": "text[]",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title_similarity": {
+          "name": "title_similarity",
+          "type": "real",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "book_duplicate_pairs_group_idx": {
+          "name": "book_duplicate_pairs_group_idx",
+          "columns": [
+            {
+              "expression": "group_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "book_duplicate_pairs_scan_a_idx": {
+          "name": "book_duplicate_pairs_scan_a_idx",
+          "columns": [
+            {
+              "expression": "scan_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "book_id_a",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "book_duplicate_pairs_scan_b_idx": {
+          "name": "book_duplicate_pairs_scan_b_idx",
+          "columns": [
+            {
+              "expression": "scan_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "book_id_b",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "book_duplicate_pairs_scan_id_book_duplicate_scans_id_fk": {
+          "name": "book_duplicate_pairs_scan_id_book_duplicate_scans_id_fk",
+          "tableFrom": "book_duplicate_pairs",
+          "tableTo": "book_duplicate_scans",
+          "columnsFrom": ["scan_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "book_duplicate_pairs_group_id_book_duplicate_groups_id_fk": {
+          "name": "book_duplicate_pairs_group_id_book_duplicate_groups_id_fk",
+          "tableFrom": "book_duplicate_pairs",
+          "tableTo": "book_duplicate_groups",
+          "columnsFrom": ["group_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "book_duplicate_pairs_book_id_a_books_id_fk": {
+          "name": "book_duplicate_pairs_book_id_a_books_id_fk",
+          "tableFrom": "book_duplicate_pairs",
+          "tableTo": "books",
+          "columnsFrom": ["book_id_a"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "book_duplicate_pairs_book_id_b_books_id_fk": {
+          "name": "book_duplicate_pairs_book_id_b_books_id_fk",
+          "tableFrom": "book_duplicate_pairs",
+          "tableTo": "books",
+          "columnsFrom": ["book_id_b"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "book_duplicate_pairs_scan_id_book_id_a_book_id_b_pk": {
+          "name": "book_duplicate_pairs_scan_id_book_id_a_book_id_b_pk",
+          "columns": ["scan_id", "book_id_a", "book_id_b"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "book_duplicate_pairs_order_chk": {
+          "name": "book_duplicate_pairs_order_chk",
+          "value": "\"book_duplicate_pairs\".\"book_id_a\" < \"book_duplicate_pairs\".\"book_id_b\""
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.book_duplicate_scan_keys": {
+      "name": "book_duplicate_scan_keys",
+      "schema": "",
+      "columns": {
+        "scan_id": {
+          "name": "scan_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "book_id": {
+          "name": "book_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "value": {
+          "name": "value",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "book_duplicate_scan_keys_lookup_idx": {
+          "name": "book_duplicate_scan_keys_lookup_idx",
+          "columns": [
+            {
+              "expression": "scan_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "value",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "book_duplicate_scan_keys_scan_id_book_duplicate_scans_id_fk": {
+          "name": "book_duplicate_scan_keys_scan_id_book_duplicate_scans_id_fk",
+          "tableFrom": "book_duplicate_scan_keys",
+          "tableTo": "book_duplicate_scans",
+          "columnsFrom": ["scan_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "book_duplicate_scan_keys_book_id_books_id_fk": {
+          "name": "book_duplicate_scan_keys_book_id_books_id_fk",
+          "tableFrom": "book_duplicate_scan_keys",
+          "tableTo": "books",
+          "columnsFrom": ["book_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "book_duplicate_scan_keys_scan_id_book_id_kind_value_pk": {
+          "name": "book_duplicate_scan_keys_scan_id_book_id_kind_value_pk",
+          "columns": ["scan_id", "book_id", "kind", "value"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "book_duplicate_scan_keys_kind_chk": {
+          "name": "book_duplicate_scan_keys_kind_chk",
+          "value": "\"book_duplicate_scan_keys\".\"kind\" in ('file_hash', 'isbn', 'exact_metadata')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.book_duplicate_scans": {
+      "name": "book_duplicate_scans",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "library_ids": {
+          "name": "library_ids",
+          "type": "integer[]",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requested_library_id": {
+          "name": "requested_library_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "similarity_percent": {
+          "name": "similarity_percent",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'queued'"
+        },
+        "processed_books": {
+          "name": "processed_books",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "total_books": {
+          "name": "total_books",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "total_groups": {
+          "name": "total_groups",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "varchar(50)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "book_duplicate_scans_user_created_idx": {
+          "name": "book_duplicate_scans_user_created_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "\"created_at\" desc",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "book_duplicate_scans_status_idx": {
+          "name": "book_duplicate_scans_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "book_duplicate_scans_user_id_users_id_fk": {
+          "name": "book_duplicate_scans_user_id_users_id_fk",
+          "tableFrom": "book_duplicate_scans",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "book_duplicate_scans_similarity_chk": {
+          "name": "book_duplicate_scans_similarity_chk",
+          "value": "\"book_duplicate_scans\".\"similarity_percent\" between 70 and 100"
+        },
+        "book_duplicate_scans_status_chk": {
+          "name": "book_duplicate_scans_status_chk",
+          "value": "\"book_duplicate_scans\".\"status\" in ('queued', 'running', 'completed', 'failed')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.book_move_jobs": {
+      "name": "book_move_jobs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "started_by": {
+          "name": "started_by",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_library_id": {
+          "name": "target_library_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_folder_id": {
+          "name": "target_folder_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_library_ids": {
+          "name": "source_library_ids",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "status": {
+          "name": "status",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'running'"
+        },
+        "total_books": {
+          "name": "total_books",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "succeeded": {
+          "name": "succeeded",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "merged": {
+          "name": "merged",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "failed": {
+          "name": "failed",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "skipped": {
+          "name": "skipped",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "book_move_jobs_status_idx": {
+          "name": "book_move_jobs_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "book_move_jobs_started_at_idx": {
+          "name": "book_move_jobs_started_at_idx",
+          "columns": [
+            {
+              "expression": "\"started_at\" desc",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "book_move_jobs_started_by_users_id_fk": {
+          "name": "book_move_jobs_started_by_users_id_fk",
+          "tableFrom": "book_move_jobs",
+          "tableTo": "users",
+          "columnsFrom": ["started_by"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "book_move_jobs_target_library_id_libraries_id_fk": {
+          "name": "book_move_jobs_target_library_id_libraries_id_fk",
+          "tableFrom": "book_move_jobs",
+          "tableTo": "libraries",
+          "columnsFrom": ["target_library_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "book_move_jobs_target_folder_id_library_folders_id_fk": {
+          "name": "book_move_jobs_target_folder_id_library_folders_id_fk",
+          "tableFrom": "book_move_jobs",
+          "tableTo": "library_folders",
+          "columnsFrom": ["target_folder_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "book_move_jobs_status_chk": {
+          "name": "book_move_jobs_status_chk",
+          "value": "\"book_move_jobs\".\"status\" in ('running', 'completed', 'failed', 'interrupted')"
+        },
+        "book_move_jobs_counts_nonnegative_chk": {
+          "name": "book_move_jobs_counts_nonnegative_chk",
+          "value": "\"book_move_jobs\".\"total_books\" >= 0 and \"book_move_jobs\".\"succeeded\" >= 0 and \"book_move_jobs\".\"merged\" >= 0 and \"book_move_jobs\".\"failed\" >= 0 and \"book_move_jobs\".\"skipped\" >= 0"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.collection_books": {
+      "name": "collection_books",
+      "schema": "",
+      "columns": {
+        "collection_id": {
+          "name": "collection_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "book_id": {
+          "name": "book_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "added_at": {
+          "name": "added_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "position": {
+          "name": "position",
+          "type": "bigserial",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "collection_books_book_id_idx": {
+          "name": "collection_books_book_id_idx",
+          "columns": [
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "collection_books_collection_position_idx": {
+          "name": "collection_books_collection_position_idx",
+          "columns": [
+            {
+              "expression": "collection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "position",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "collection_books_collection_id_collections_id_fk": {
+          "name": "collection_books_collection_id_collections_id_fk",
+          "tableFrom": "collection_books",
+          "tableTo": "collections",
+          "columnsFrom": ["collection_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "collection_books_book_id_books_id_fk": {
+          "name": "collection_books_book_id_books_id_fk",
+          "tableFrom": "collection_books",
+          "tableTo": "books",
+          "columnsFrom": ["book_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "collection_books_collection_id_book_id_pk": {
+          "name": "collection_books_collection_id_book_id_pk",
+          "columns": ["collection_id", "book_id"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.collections": {
+      "name": "collections",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "icon": {
+          "name": "icon",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "is_public": {
+          "name": "is_public",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "sync_to_kobo": {
+          "name": "sync_to_kobo",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "display_order": {
+          "name": "display_order",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "collections_user_name_uidx": {
+          "name": "collections_user_name_uidx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "collections_user_display_name_idx": {
+          "name": "collections_user_display_name_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "display_order",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "collections_public_display_name_idx": {
+          "name": "collections_public_display_name_idx",
+          "columns": [
+            {
+              "expression": "is_public",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "display_order",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "collections_user_id_users_id_fk": {
+          "name": "collections_user_id_users_id_fk",
+          "tableFrom": "collections",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.smart_scope_kobo_subscriptions": {
+      "name": "smart_scope_kobo_subscriptions",
+      "schema": "",
+      "columns": {
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "smart_scope_id": {
+          "name": "smart_scope_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "smart_scope_kobo_subscriptions_smart_scope_id_idx": {
+          "name": "smart_scope_kobo_subscriptions_smart_scope_id_idx",
+          "columns": [
+            {
+              "expression": "smart_scope_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "smart_scope_kobo_subscriptions_user_id_users_id_fk": {
+          "name": "smart_scope_kobo_subscriptions_user_id_users_id_fk",
+          "tableFrom": "smart_scope_kobo_subscriptions",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "smart_scope_kobo_subscriptions_smart_scope_id_smart_scopes_id_fk": {
+          "name": "smart_scope_kobo_subscriptions_smart_scope_id_smart_scopes_id_fk",
+          "tableFrom": "smart_scope_kobo_subscriptions",
+          "tableTo": "smart_scopes",
+          "columnsFrom": ["smart_scope_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "smart_scope_kobo_subscriptions_user_id_smart_scope_id_pk": {
+          "name": "smart_scope_kobo_subscriptions_user_id_smart_scope_id_pk",
+          "columns": ["user_id", "smart_scope_id"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.smart_scopes": {
+      "name": "smart_scopes",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "icon": {
+          "name": "icon",
+          "type": "varchar(100)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "filter": {
+          "name": "filter",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "default_sort": {
+          "name": "default_sort",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "is_public": {
+          "name": "is_public",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "sync_to_kobo": {
+          "name": "sync_to_kobo",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "display_order": {
+          "name": "display_order",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "smart_scopes_user_id_users_id_fk": {
+          "name": "smart_scopes_user_id_users_id_fk",
+          "tableFrom": "smart_scopes",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "smart_scopes_user_id_name_unique": {
+          "name": "smart_scopes_user_id_name_unique",
+          "nullsNotDistinct": false,
+          "columns": ["user_id", "name"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.book_series": {
+      "name": "book_series",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(500)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "normalized_name": {
+          "name": "normalized_name",
+          "type": "varchar(500)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expected_book_count": {
+          "name": "expected_book_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expected_book_count_source": {
+          "name": "expected_book_count_source",
+          "type": "varchar(50)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expected_book_count_updated_at": {
+          "name": "expected_book_count_updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "book_series_normalized_name_uidx": {
+          "name": "book_series_normalized_name_uidx",
+          "columns": [
+            {
+              "expression": "normalized_name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "book_series_name_trgm_idx": {
+          "name": "book_series_name_trgm_idx",
+          "columns": [
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "book_series_name_unaccent_trgm_idx": {
+          "name": "book_series_name_unaccent_trgm_idx",
+          "columns": [
+            {
+              "expression": "public.bookorbit_unaccent(\"name\") gin_trgm_ops",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "book_series_name_lower_idx": {
+          "name": "book_series_name_lower_idx",
+          "columns": [
+            {
+              "expression": "lower(\"name\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "book_series_expected_book_count_range_chk": {
+          "name": "book_series_expected_book_count_range_chk",
+          "value": "\"book_series\".\"expected_book_count\" IS NULL OR (\"book_series\".\"expected_book_count\" >= 1 AND \"book_series\".\"expected_book_count\" <= 10000)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.book_series_memberships": {
+      "name": "book_series_memberships",
+      "schema": "",
+      "columns": {
+        "book_id": {
+          "name": "book_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "series_id": {
+          "name": "series_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "series_index": {
+          "name": "series_index",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "display_order": {
+          "name": "display_order",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "book_series_memberships_book_display_uidx": {
+          "name": "book_series_memberships_book_display_uidx",
+          "columns": [
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "display_order",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "book_series_memberships_series_index_book_idx": {
+          "name": "book_series_memberships_series_index_book_idx",
+          "columns": [
+            {
+              "expression": "series_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "(CASE WHEN \"series_index\" IS NULL THEN NULL ELSE ARRAY[split_part(\"series_index\", '.', 1)::numeric, CASE WHEN strpos(\"series_index\", '.') = 0 THEN -1::numeric ELSE split_part(\"series_index\", '.', 2)::numeric END] END)",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "\"series_index\" COLLATE \"C\"",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "book_series_memberships_book_display_idx": {
+          "name": "book_series_memberships_book_display_idx",
+          "columns": [
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "display_order",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "book_series_memberships_book_id_books_id_fk": {
+          "name": "book_series_memberships_book_id_books_id_fk",
+          "tableFrom": "book_series_memberships",
+          "tableTo": "books",
+          "columnsFrom": ["book_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "book_series_memberships_series_id_book_series_id_fk": {
+          "name": "book_series_memberships_series_id_book_series_id_fk",
+          "tableFrom": "book_series_memberships",
+          "tableTo": "book_series",
+          "columnsFrom": ["series_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "book_series_memberships_book_id_series_id_pk": {
+          "name": "book_series_memberships_book_id_series_id_pk",
+          "columns": ["book_id", "series_id"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "book_series_memberships_display_order_nonnegative_chk": {
+          "name": "book_series_memberships_display_order_nonnegative_chk",
+          "value": "\"book_series_memberships\".\"display_order\" >= 0"
+        },
+        "book_series_memberships_series_index_format_chk": {
+          "name": "book_series_memberships_series_index_format_chk",
+          "value": "\"book_series_memberships\".\"series_index\" is null or \"book_series_memberships\".\"series_index\" ~ '^[0-9]+([.][0-9]+)?$'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.author_enrichment_queue": {
+      "name": "author_enrichment_queue",
+      "schema": "",
+      "columns": {
+        "author_id": {
+          "name": "author_id",
+          "type": "integer",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'queued'"
+        },
+        "reason": {
+          "name": "reason",
+          "type": "varchar(50)",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unknown'"
+        },
+        "attempt_count": {
+          "name": "attempt_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "next_attempt_at": {
+          "name": "next_attempt_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "last_attempt_at": {
+          "name": "last_attempt_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_success_at": {
+          "name": "last_success_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_http_status": {
+          "name": "last_http_status",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "author_enrichment_queue_status_next_attempt_idx": {
+          "name": "author_enrichment_queue_status_next_attempt_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "next_attempt_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "author_enrichment_queue_next_attempt_idx": {
+          "name": "author_enrichment_queue_next_attempt_idx",
+          "columns": [
+            {
+              "expression": "next_attempt_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "author_enrichment_queue_single_processing_idx": {
+          "name": "author_enrichment_queue_single_processing_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"author_enrichment_queue\".\"status\" = 'processing'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "author_enrichment_queue_author_id_authors_id_fk": {
+          "name": "author_enrichment_queue_author_id_authors_id_fk",
+          "tableFrom": "author_enrichment_queue",
+          "tableTo": "authors",
+          "columnsFrom": ["author_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "author_enrichment_queue_status_chk": {
+          "name": "author_enrichment_queue_status_chk",
+          "value": "\"author_enrichment_queue\".\"status\" in ('queued', 'processing', 'rate_limited', 'failed', 'done')"
+        },
+        "author_enrichment_queue_reason_chk": {
+          "name": "author_enrichment_queue_reason_chk",
+          "value": "\"author_enrichment_queue\".\"reason\" in ('unknown', 'metadata_replace', 'manual_backfill', 'manual_backfill_all', 'author_rename', 'author_merge_target')"
+        },
+        "author_enrichment_queue_attempt_count_nonnegative_chk": {
+          "name": "author_enrichment_queue_attempt_count_nonnegative_chk",
+          "value": "\"author_enrichment_queue\".\"attempt_count\" >= 0"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.authors": {
+      "name": "authors",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(500)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "sort_name": {
+          "name": "sort_name",
+          "type": "varchar(500)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "has_photo": {
+          "name": "has_photo",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "birth_date": {
+          "name": "birth_date",
+          "type": "date",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "birth_year": {
+          "name": "birth_year",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "death_date": {
+          "name": "death_date",
+          "type": "date",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "death_year": {
+          "name": "death_year",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "website": {
+          "name": "website",
+          "type": "varchar(2048)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "genres": {
+          "name": "genres",
+          "type": "text[]",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "influences": {
+          "name": "influences",
+          "type": "text[]",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata_provider": {
+          "name": "metadata_provider",
+          "type": "varchar(50)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata_provider_id": {
+          "name": "metadata_provider_id",
+          "type": "varchar(128)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_enriched_at": {
+          "name": "last_enriched_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "authors_name_trgm_idx": {
+          "name": "authors_name_trgm_idx",
+          "columns": [
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "authors_name_unaccent_trgm_idx": {
+          "name": "authors_name_unaccent_trgm_idx",
+          "columns": [
+            {
+              "expression": "public.bookorbit_unaccent(\"name\") gin_trgm_ops",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "authors_name_unique": {
+          "name": "authors_name_unique",
+          "nullsNotDistinct": false,
+          "columns": ["name"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.book_authors": {
+      "name": "book_authors",
+      "schema": "",
+      "columns": {
+        "book_id": {
+          "name": "book_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "author_id": {
+          "name": "author_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "display_order": {
+          "name": "display_order",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        }
+      },
+      "indexes": {
+        "book_authors_author_id_idx": {
+          "name": "book_authors_author_id_idx",
+          "columns": [
+            {
+              "expression": "author_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "book_authors_book_display_idx": {
+          "name": "book_authors_book_display_idx",
+          "columns": [
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "display_order",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "book_authors_book_display_author_idx": {
+          "name": "book_authors_book_display_author_idx",
+          "columns": [
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "display_order",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "author_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "book_authors_book_id_books_id_fk": {
+          "name": "book_authors_book_id_books_id_fk",
+          "tableFrom": "book_authors",
+          "tableTo": "books",
+          "columnsFrom": ["book_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "book_authors_author_id_authors_id_fk": {
+          "name": "book_authors_author_id_authors_id_fk",
+          "tableFrom": "book_authors",
+          "tableTo": "authors",
+          "columnsFrom": ["author_id"],
+          "columnsTo": ["id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "book_authors_book_id_author_id_pk": {
+          "name": "book_authors_book_id_author_id_pk",
+          "columns": ["book_id", "author_id"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.book_community_ratings": {
+      "name": "book_community_ratings",
+      "schema": "",
+      "columns": {
+        "book_id": {
+          "name": "book_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "varchar(50)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "rating": {
+          "name": "rating",
+          "type": "real",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "rating_count": {
+          "name": "rating_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "book_community_ratings_provider_idx": {
+          "name": "book_community_ratings_provider_idx",
+          "columns": [
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "book_community_ratings_rating_book_idx": {
+          "name": "book_community_ratings_rating_book_idx",
+          "columns": [
+            {
+              "expression": "rating",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "book_community_ratings_provider_rating_book_idx": {
+          "name": "book_community_ratings_provider_rating_book_idx",
+          "columns": [
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "rating",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "book_community_ratings_count_book_idx": {
+          "name": "book_community_ratings_count_book_idx",
+          "columns": [
+            {
+              "expression": "rating_count",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "book_community_ratings_provider_count_book_idx": {
+          "name": "book_community_ratings_provider_count_book_idx",
+          "columns": [
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "rating_count",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "book_community_ratings_book_id_books_id_fk": {
+          "name": "book_community_ratings_book_id_books_id_fk",
+          "tableFrom": "book_community_ratings",
+          "tableTo": "books",
+          "columnsFrom": ["book_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "book_community_ratings_book_id_provider_pk": {
+          "name": "book_community_ratings_book_id_provider_pk",
+          "columns": ["book_id", "provider"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "book_community_ratings_rating_range_chk": {
+          "name": "book_community_ratings_rating_range_chk",
+          "value": "\"book_community_ratings\".\"rating\" >= 0 and \"book_community_ratings\".\"rating\" <= 5"
+        },
+        "book_community_ratings_count_nonnegative_chk": {
+          "name": "book_community_ratings_count_nonnegative_chk",
+          "value": "\"book_community_ratings\".\"rating_count\" is null or \"book_community_ratings\".\"rating_count\" >= 0"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.book_genres": {
+      "name": "book_genres",
+      "schema": "",
+      "columns": {
+        "book_id": {
+          "name": "book_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "genre_id": {
+          "name": "genre_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "book_genres_genre_id_idx": {
+          "name": "book_genres_genre_id_idx",
+          "columns": [
+            {
+              "expression": "genre_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "book_genres_book_id_books_id_fk": {
+          "name": "book_genres_book_id_books_id_fk",
+          "tableFrom": "book_genres",
+          "tableTo": "books",
+          "columnsFrom": ["book_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "book_genres_genre_id_genres_id_fk": {
+          "name": "book_genres_genre_id_genres_id_fk",
+          "tableFrom": "book_genres",
+          "tableTo": "genres",
+          "columnsFrom": ["genre_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "book_genres_book_id_genre_id_pk": {
+          "name": "book_genres_book_id_genre_id_pk",
+          "columns": ["book_id", "genre_id"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.book_metadata": {
+      "name": "book_metadata",
+      "schema": "",
+      "columns": {
+        "book_id": {
+          "name": "book_id",
+          "type": "integer",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "varchar(1000)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "subtitle": {
+          "name": "subtitle",
+          "type": "varchar(1000)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "isbn10": {
+          "name": "isbn10",
+          "type": "varchar(10)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "isbn13": {
+          "name": "isbn13",
+          "type": "varchar(13)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "publisher": {
+          "name": "publisher",
+          "type": "varchar(500)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "published_date": {
+          "name": "published_date",
+          "type": "date",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "published_year": {
+          "name": "published_year",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "language": {
+          "name": "language",
+          "type": "varchar(100)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "page_count": {
+          "name": "page_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "series_id": {
+          "name": "series_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "series_name": {
+          "name": "series_name",
+          "type": "varchar(500)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "series_index": {
+          "name": "series_index",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "rating": {
+          "name": "rating",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cover_source": {
+          "name": "cover_source",
+          "type": "varchar(9)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "google_books_id": {
+          "name": "google_books_id",
+          "type": "varchar(50)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "goodreads_id": {
+          "name": "goodreads_id",
+          "type": "varchar(50)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "amazon_id": {
+          "name": "amazon_id",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "hardcover_id": {
+          "name": "hardcover_id",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "hardcover_edition_id": {
+          "name": "hardcover_edition_id",
+          "type": "varchar(50)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "open_library_id": {
+          "name": "open_library_id",
+          "type": "varchar(50)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "itunes_id": {
+          "name": "itunes_id",
+          "type": "varchar(50)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "kobo_id": {
+          "name": "kobo_id",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata_score": {
+          "name": "metadata_score",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_metadata_fetch_at": {
+          "name": "last_metadata_fetch_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "embedding": {
+          "name": "embedding",
+          "type": "vector(256)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_written_at": {
+          "name": "last_written_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "duration_seconds": {
+          "name": "duration_seconds",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "abridged": {
+          "name": "abridged",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "audible_id": {
+          "name": "audible_id",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "librofm_id": {
+          "name": "librofm_id",
+          "type": "varchar(50)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "comicvine_id": {
+          "name": "comicvine_id",
+          "type": "varchar(50)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "ranobedb_id": {
+          "name": "ranobedb_id",
+          "type": "varchar(50)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "lubimyczytac_id": {
+          "name": "lubimyczytac_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "aladin_id": {
+          "name": "aladin_id",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "chapters": {
+          "name": "chapters",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "locked_fields": {
+          "name": "locked_fields",
+          "type": "text[]",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::text[]"
+        },
+        "cover_updated_at": {
+          "name": "cover_updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "bm_title_trgm_idx": {
+          "name": "bm_title_trgm_idx",
+          "columns": [
+            {
+              "expression": "title",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "bm_title_unaccent_trgm_idx": {
+          "name": "bm_title_unaccent_trgm_idx",
+          "columns": [
+            {
+              "expression": "public.bookorbit_unaccent(\"title\") gin_trgm_ops",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "bm_title_lower_idx": {
+          "name": "bm_title_lower_idx",
+          "columns": [
+            {
+              "expression": "lower(\"title\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "bm_title_book_id_idx": {
+          "name": "bm_title_book_id_idx",
+          "columns": [
+            {
+              "expression": "title",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "bm_series_trgm_idx": {
+          "name": "bm_series_trgm_idx",
+          "columns": [
+            {
+              "expression": "series_name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "bm_series_unaccent_trgm_idx": {
+          "name": "bm_series_unaccent_trgm_idx",
+          "columns": [
+            {
+              "expression": "public.bookorbit_unaccent(\"series_name\") gin_trgm_ops",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "bm_series_id_idx": {
+          "name": "bm_series_id_idx",
+          "columns": [
+            {
+              "expression": "series_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "bm_series_id_index_book_id_idx": {
+          "name": "bm_series_id_index_book_id_idx",
+          "columns": [
+            {
+              "expression": "series_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "(CASE WHEN \"series_index\" IS NULL THEN NULL ELSE ARRAY[split_part(\"series_index\", '.', 1)::numeric, CASE WHEN strpos(\"series_index\", '.') = 0 THEN -1::numeric ELSE split_part(\"series_index\", '.', 2)::numeric END] END)",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "\"series_index\" COLLATE \"C\"",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "bm_series_index_sort_idx": {
+          "name": "bm_series_index_sort_idx",
+          "columns": [
+            {
+              "expression": "(CASE WHEN \"series_index\" IS NULL THEN NULL ELSE ARRAY[split_part(\"series_index\", '.', 1)::numeric, CASE WHEN strpos(\"series_index\", '.') = 0 THEN -1::numeric ELSE split_part(\"series_index\", '.', 2)::numeric END] END)",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "\"series_index\" COLLATE \"C\"",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "bm_series_name_lower_btrim_idx": {
+          "name": "bm_series_name_lower_btrim_idx",
+          "columns": [
+            {
+              "expression": "lower(btrim(\"series_name\"))",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "bm_publisher_trgm_idx": {
+          "name": "bm_publisher_trgm_idx",
+          "columns": [
+            {
+              "expression": "publisher",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "bm_publisher_unaccent_trgm_idx": {
+          "name": "bm_publisher_unaccent_trgm_idx",
+          "columns": [
+            {
+              "expression": "public.bookorbit_unaccent(\"publisher\") gin_trgm_ops",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "bm_language_idx": {
+          "name": "bm_language_idx",
+          "columns": [
+            {
+              "expression": "language",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "bm_language_trgm_idx": {
+          "name": "bm_language_trgm_idx",
+          "columns": [
+            {
+              "expression": "language",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "bm_language_unaccent_trgm_idx": {
+          "name": "bm_language_unaccent_trgm_idx",
+          "columns": [
+            {
+              "expression": "public.bookorbit_unaccent(\"language\") gin_trgm_ops",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "bm_published_date_idx": {
+          "name": "bm_published_date_idx",
+          "columns": [
+            {
+              "expression": "published_date",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "bm_published_year_idx": {
+          "name": "bm_published_year_idx",
+          "columns": [
+            {
+              "expression": "published_year",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "bm_published_date_sort_idx": {
+          "name": "bm_published_date_sort_idx",
+          "columns": [
+            {
+              "expression": "coalesce(\"published_date\", make_date(\"published_year\", 1, 1))",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "bm_series_name_index_idx": {
+          "name": "bm_series_name_index_idx",
+          "columns": [
+            {
+              "expression": "series_name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "(CASE WHEN \"series_index\" IS NULL THEN NULL ELSE ARRAY[split_part(\"series_index\", '.', 1)::numeric, CASE WHEN strpos(\"series_index\", '.') = 0 THEN -1::numeric ELSE split_part(\"series_index\", '.', 2)::numeric END] END)",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "\"series_index\" COLLATE \"C\"",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "bm_isbn10_idx": {
+          "name": "bm_isbn10_idx",
+          "columns": [
+            {
+              "expression": "isbn10",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "bm_isbn13_idx": {
+          "name": "bm_isbn13_idx",
+          "columns": [
+            {
+              "expression": "isbn13",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "bm_embedding_hnsw_cosine_idx": {
+          "name": "bm_embedding_hnsw_cosine_idx",
+          "columns": [
+            {
+              "expression": "\"embedding\" vector_cosine_ops",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "hnsw",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "book_metadata_book_id_books_id_fk": {
+          "name": "book_metadata_book_id_books_id_fk",
+          "tableFrom": "book_metadata",
+          "tableTo": "books",
+          "columnsFrom": ["book_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "book_metadata_series_id_book_series_id_fk": {
+          "name": "book_metadata_series_id_book_series_id_fk",
+          "tableFrom": "book_metadata",
+          "tableTo": "book_series",
+          "columnsFrom": ["series_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "book_metadata_rating_range_chk": {
+          "name": "book_metadata_rating_range_chk",
+          "value": "\"book_metadata\".\"rating\" is null or (\"book_metadata\".\"rating\" >= 1 and \"book_metadata\".\"rating\" <= 10)"
+        },
+        "book_metadata_published_date_range_chk": {
+          "name": "book_metadata_published_date_range_chk",
+          "value": "\"book_metadata\".\"published_date\" is null or (extract(year from \"book_metadata\".\"published_date\") >= 1000 and extract(year from \"book_metadata\".\"published_date\") <= 2200)"
+        },
+        "book_metadata_published_year_range_chk": {
+          "name": "book_metadata_published_year_range_chk",
+          "value": "\"book_metadata\".\"published_year\" is null or (\"book_metadata\".\"published_year\" >= 1000 and \"book_metadata\".\"published_year\" <= 2200)"
+        },
+        "book_metadata_page_count_nonnegative_chk": {
+          "name": "book_metadata_page_count_nonnegative_chk",
+          "value": "\"book_metadata\".\"page_count\" is null or \"book_metadata\".\"page_count\" >= 0"
+        },
+        "book_metadata_series_index_format_chk": {
+          "name": "book_metadata_series_index_format_chk",
+          "value": "\"book_metadata\".\"series_index\" is null or \"book_metadata\".\"series_index\" ~ '^[0-9]+([.][0-9]+)?$'"
+        },
+        "book_metadata_duration_seconds_nonnegative_chk": {
+          "name": "book_metadata_duration_seconds_nonnegative_chk",
+          "value": "\"book_metadata\".\"duration_seconds\" is null or \"book_metadata\".\"duration_seconds\" >= 0"
+        },
+        "book_metadata_cover_source_chk": {
+          "name": "book_metadata_cover_source_chk",
+          "value": "\"book_metadata\".\"cover_source\" is null or \"book_metadata\".\"cover_source\" in ('extracted', 'custom')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.book_metadata_fetch_queue": {
+      "name": "book_metadata_fetch_queue",
+      "schema": "",
+      "columns": {
+        "book_id": {
+          "name": "book_id",
+          "type": "integer",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'queued'"
+        },
+        "reason": {
+          "name": "reason",
+          "type": "varchar(50)",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'manual_trigger'"
+        },
+        "attempt_count": {
+          "name": "attempt_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "last_attempt_at": {
+          "name": "last_attempt_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_http_status": {
+          "name": "last_http_status",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "bmfq_status_idx": {
+          "name": "bmfq_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "bmfq_created_at_idx": {
+          "name": "bmfq_created_at_idx",
+          "columns": [
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "bmfq_status_created_book_idx": {
+          "name": "bmfq_status_created_book_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "book_metadata_fetch_queue_book_id_books_id_fk": {
+          "name": "book_metadata_fetch_queue_book_id_books_id_fk",
+          "tableFrom": "book_metadata_fetch_queue",
+          "tableTo": "books",
+          "columnsFrom": ["book_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "book_metadata_fetch_queue_status_chk": {
+          "name": "book_metadata_fetch_queue_status_chk",
+          "value": "\"book_metadata_fetch_queue\".\"status\" in ('queued', 'processing', 'failed')"
+        },
+        "book_metadata_fetch_queue_reason_chk": {
+          "name": "book_metadata_fetch_queue_reason_chk",
+          "value": "\"book_metadata_fetch_queue\".\"reason\" in ('event_import', 'manual_trigger', 'manual_retry')"
+        },
+        "book_metadata_fetch_queue_attempt_count_nonnegative_chk": {
+          "name": "book_metadata_fetch_queue_attempt_count_nonnegative_chk",
+          "value": "\"book_metadata_fetch_queue\".\"attempt_count\" >= 0"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.book_tags": {
+      "name": "book_tags",
+      "schema": "",
+      "columns": {
+        "book_id": {
+          "name": "book_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "tag_id": {
+          "name": "tag_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "book_tags_tag_id_idx": {
+          "name": "book_tags_tag_id_idx",
+          "columns": [
+            {
+              "expression": "tag_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "book_tags_book_id_books_id_fk": {
+          "name": "book_tags_book_id_books_id_fk",
+          "tableFrom": "book_tags",
+          "tableTo": "books",
+          "columnsFrom": ["book_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "book_tags_tag_id_tags_id_fk": {
+          "name": "book_tags_tag_id_tags_id_fk",
+          "tableFrom": "book_tags",
+          "tableTo": "tags",
+          "columnsFrom": ["tag_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "book_tags_book_id_tag_id_pk": {
+          "name": "book_tags_book_id_tag_id_pk",
+          "columns": ["book_id", "tag_id"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.genres": {
+      "name": "genres",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(200)",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "genres_name_trgm_idx": {
+          "name": "genres_name_trgm_idx",
+          "columns": [
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "genres_name_unaccent_trgm_idx": {
+          "name": "genres_name_unaccent_trgm_idx",
+          "columns": [
+            {
+              "expression": "public.bookorbit_unaccent(\"name\") gin_trgm_ops",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "genres_name_unique": {
+          "name": "genres_name_unique",
+          "nullsNotDistinct": false,
+          "columns": ["name"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tags": {
+      "name": "tags",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(200)",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "tags_name_trgm_idx": {
+          "name": "tags_name_trgm_idx",
+          "columns": [
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "tags_name_unaccent_trgm_idx": {
+          "name": "tags_name_unaccent_trgm_idx",
+          "columns": [
+            {
+              "expression": "public.bookorbit_unaccent(\"name\") gin_trgm_ops",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "tags_name_unique": {
+          "name": "tags_name_unique",
+          "nullsNotDistinct": false,
+          "columns": ["name"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.book_narrators": {
+      "name": "book_narrators",
+      "schema": "",
+      "columns": {
+        "book_id": {
+          "name": "book_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "narrator_id": {
+          "name": "narrator_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "display_order": {
+          "name": "display_order",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        }
+      },
+      "indexes": {
+        "book_narrators_narrator_id_idx": {
+          "name": "book_narrators_narrator_id_idx",
+          "columns": [
+            {
+              "expression": "narrator_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "book_narrators_book_id_books_id_fk": {
+          "name": "book_narrators_book_id_books_id_fk",
+          "tableFrom": "book_narrators",
+          "tableTo": "books",
+          "columnsFrom": ["book_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "book_narrators_narrator_id_narrators_id_fk": {
+          "name": "book_narrators_narrator_id_narrators_id_fk",
+          "tableFrom": "book_narrators",
+          "tableTo": "narrators",
+          "columnsFrom": ["narrator_id"],
+          "columnsTo": ["id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "book_narrators_book_id_narrator_id_pk": {
+          "name": "book_narrators_book_id_narrator_id_pk",
+          "columns": ["book_id", "narrator_id"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.narrators": {
+      "name": "narrators",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(500)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "sort_name": {
+          "name": "sort_name",
+          "type": "varchar(500)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "narrators_name_trgm_idx": {
+          "name": "narrators_name_trgm_idx",
+          "columns": [
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "narrators_name_unaccent_trgm_idx": {
+          "name": "narrators_name_unaccent_trgm_idx",
+          "columns": [
+            {
+              "expression": "public.bookorbit_unaccent(\"name\") gin_trgm_ops",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "narrators_name_unique": {
+          "name": "narrators_name_unique",
+          "nullsNotDistinct": false,
+          "columns": ["name"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.library_dir_scan_state": {
+      "name": "library_dir_scan_state",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "library_folder_id": {
+          "name": "library_folder_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "dir_path": {
+          "name": "dir_path",
+          "type": "varchar(4096)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_seen_mtime_ms": {
+          "name": "last_seen_mtime_ms",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "library_dir_scan_state_folder_dir_uidx": {
+          "name": "library_dir_scan_state_folder_dir_uidx",
+          "columns": [
+            {
+              "expression": "library_folder_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "dir_path",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "library_dir_scan_state_folder_idx": {
+          "name": "library_dir_scan_state_folder_idx",
+          "columns": [
+            {
+              "expression": "library_folder_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "library_dir_scan_state_library_folder_id_library_folders_id_fk": {
+          "name": "library_dir_scan_state_library_folder_id_library_folders_id_fk",
+          "tableFrom": "library_dir_scan_state",
+          "tableTo": "library_folders",
+          "columnsFrom": ["library_folder_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.scan_jobs": {
+      "name": "scan_jobs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "library_id": {
+          "name": "library_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'running'"
+        },
+        "triggered_by": {
+          "name": "triggered_by",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "added_count": {
+          "name": "added_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "updated_count": {
+          "name": "updated_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "missing_count": {
+          "name": "missing_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "error_message": {
+          "name": "error_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "scan_jobs_library_status_idx": {
+          "name": "scan_jobs_library_status_idx",
+          "columns": [
+            {
+              "expression": "library_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "scan_jobs_library_started_at_idx": {
+          "name": "scan_jobs_library_started_at_idx",
+          "columns": [
+            {
+              "expression": "library_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "\"started_at\" desc",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "scan_jobs_library_id_libraries_id_fk": {
+          "name": "scan_jobs_library_id_libraries_id_fk",
+          "tableFrom": "scan_jobs",
+          "tableTo": "libraries",
+          "columnsFrom": ["library_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "scan_jobs_status_chk": {
+          "name": "scan_jobs_status_chk",
+          "value": "\"scan_jobs\".\"status\" in ('running', 'completed', 'failed')"
+        },
+        "scan_jobs_triggered_by_chk": {
+          "name": "scan_jobs_triggered_by_chk",
+          "value": "\"scan_jobs\".\"triggered_by\" in ('manual', 'watcher', 'schedule')"
+        },
+        "scan_jobs_added_count_nonnegative_chk": {
+          "name": "scan_jobs_added_count_nonnegative_chk",
+          "value": "\"scan_jobs\".\"added_count\" >= 0"
+        },
+        "scan_jobs_updated_count_nonnegative_chk": {
+          "name": "scan_jobs_updated_count_nonnegative_chk",
+          "value": "\"scan_jobs\".\"updated_count\" >= 0"
+        },
+        "scan_jobs_missing_count_nonnegative_chk": {
+          "name": "scan_jobs_missing_count_nonnegative_chk",
+          "value": "\"scan_jobs\".\"missing_count\" >= 0"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.annotation_positions": {
+      "name": "annotation_positions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "annotation_id": {
+          "name": "annotation_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "book_file_id": {
+          "name": "book_file_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "format": {
+          "name": "format",
+          "type": "varchar(12)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "pos0": {
+          "name": "pos0",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "pos1": {
+          "name": "pos1",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "varchar(10)",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'exact'"
+        },
+        "converter_version": {
+          "name": "converter_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "extras": {
+          "name": "extras",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "annotation_positions_annotation_format_uidx": {
+          "name": "annotation_positions_annotation_format_uidx",
+          "columns": [
+            {
+              "expression": "annotation_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "format",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "annotation_positions_user_idx": {
+          "name": "annotation_positions_user_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "annotation_positions_book_file_id_idx": {
+          "name": "annotation_positions_book_file_id_idx",
+          "columns": [
+            {
+              "expression": "book_file_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "annotation_positions_format_status_idx": {
+          "name": "annotation_positions_format_status_idx",
+          "columns": [
+            {
+              "expression": "format",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "annotation_positions_annotation_id_annotations_id_fk": {
+          "name": "annotation_positions_annotation_id_annotations_id_fk",
+          "tableFrom": "annotation_positions",
+          "tableTo": "annotations",
+          "columnsFrom": ["annotation_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "annotation_positions_user_id_users_id_fk": {
+          "name": "annotation_positions_user_id_users_id_fk",
+          "tableFrom": "annotation_positions",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "annotation_positions_book_file_id_book_files_id_fk": {
+          "name": "annotation_positions_book_file_id_book_files_id_fk",
+          "tableFrom": "annotation_positions",
+          "tableTo": "book_files",
+          "columnsFrom": ["book_file_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "annotation_positions_format_chk": {
+          "name": "annotation_positions_format_chk",
+          "value": "\"annotation_positions\".\"format\" in ('cfi', 'xpointer', 'pdf', 'kobo_span')"
+        },
+        "annotation_positions_status_chk": {
+          "name": "annotation_positions_status_chk",
+          "value": "\"annotation_positions\".\"status\" in ('exact', 'repaired', 'failed', 'pending')"
+        },
+        "annotation_positions_pos0_chk": {
+          "name": "annotation_positions_pos0_chk",
+          "value": "\"annotation_positions\".\"status\" in ('failed', 'pending') or \"annotation_positions\".\"pos0\" is not null"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.annotation_sync_state": {
+      "name": "annotation_sync_state",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "annotation_id": {
+          "name": "annotation_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source": {
+          "name": "source",
+          "type": "varchar(10)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "device_id": {
+          "name": "device_id",
+          "type": "varchar(100)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "external_key": {
+          "name": "external_key",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "external_created_at": {
+          "name": "external_created_at",
+          "type": "varchar(19)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_applied_version": {
+          "name": "last_applied_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "delete_acked_at": {
+          "name": "delete_acked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "first_synced_at": {
+          "name": "first_synced_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "last_synced_at": {
+          "name": "last_synced_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "annotation_sync_state_annotation_source_device_uidx": {
+          "name": "annotation_sync_state_annotation_source_device_uidx",
+          "columns": [
+            {
+              "expression": "annotation_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "device_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "annotation_sync_state_user_source_device_key_idx": {
+          "name": "annotation_sync_state_user_source_device_key_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "device_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "external_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "annotation_sync_state_user_key_idx": {
+          "name": "annotation_sync_state_user_key_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "external_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "annotation_sync_state_annotation_id_idx": {
+          "name": "annotation_sync_state_annotation_id_idx",
+          "columns": [
+            {
+              "expression": "annotation_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "annotation_sync_state_annotation_id_annotations_id_fk": {
+          "name": "annotation_sync_state_annotation_id_annotations_id_fk",
+          "tableFrom": "annotation_sync_state",
+          "tableTo": "annotations",
+          "columnsFrom": ["annotation_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "annotation_sync_state_user_id_users_id_fk": {
+          "name": "annotation_sync_state_user_id_users_id_fk",
+          "tableFrom": "annotation_sync_state",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "annotation_sync_state_source_chk": {
+          "name": "annotation_sync_state_source_chk",
+          "value": "\"annotation_sync_state\".\"source\" in ('koreader', 'kobo')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.annotations": {
+      "name": "annotations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "book_id": {
+          "name": "book_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "text": {
+          "name": "text",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "color": {
+          "name": "color",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'yellow'"
+        },
+        "style": {
+          "name": "style",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'highlight'"
+        },
+        "note": {
+          "name": "note",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "chapter_title": {
+          "name": "chapter_title",
+          "type": "varchar(500)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "origin": {
+          "name": "origin",
+          "type": "varchar(10)",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'web'"
+        },
+        "version": {
+          "name": "version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "device_created_at": {
+          "name": "device_created_at",
+          "type": "varchar(19)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "device_updated_at": {
+          "name": "device_updated_at",
+          "type": "varchar(19)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "annotations_user_id_idx": {
+          "name": "annotations_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "annotations_user_id_id_idx": {
+          "name": "annotations_user_id_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "annotations_user_book_idx": {
+          "name": "annotations_user_book_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "annotations_book_id_idx": {
+          "name": "annotations_book_id_idx",
+          "columns": [
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "annotations_user_book_active_idx": {
+          "name": "annotations_user_book_active_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"annotations\".\"deleted_at\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "annotations_user_created_active_idx": {
+          "name": "annotations_user_created_active_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": false,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": false,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"annotations\".\"deleted_at\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "annotations_user_id_users_id_fk": {
+          "name": "annotations_user_id_users_id_fk",
+          "tableFrom": "annotations",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "annotations_book_id_books_id_fk": {
+          "name": "annotations_book_id_books_id_fk",
+          "tableFrom": "annotations",
+          "tableTo": "books",
+          "columnsFrom": ["book_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "annotations_style_chk": {
+          "name": "annotations_style_chk",
+          "value": "\"annotations\".\"style\" in ('highlight', 'underline', 'strikethrough', 'squiggly', 'invert')"
+        },
+        "annotations_origin_chk": {
+          "name": "annotations_origin_chk",
+          "value": "\"annotations\".\"origin\" in ('web', 'koreader', 'kobo')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.audiobook_progress": {
+      "name": "audiobook_progress",
+      "schema": "",
+      "columns": {
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "book_id": {
+          "name": "book_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "percentage": {
+          "name": "percentage",
+          "type": "real",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "current_file_id": {
+          "name": "current_file_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "position_seconds": {
+          "name": "position_seconds",
+          "type": "real",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "abp_user_id_idx": {
+          "name": "abp_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "audiobook_progress_book_id_idx": {
+          "name": "audiobook_progress_book_id_idx",
+          "columns": [
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "audiobook_progress_current_file_id_idx": {
+          "name": "audiobook_progress_current_file_id_idx",
+          "columns": [
+            {
+              "expression": "current_file_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "audiobook_progress_user_id_users_id_fk": {
+          "name": "audiobook_progress_user_id_users_id_fk",
+          "tableFrom": "audiobook_progress",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "audiobook_progress_book_id_books_id_fk": {
+          "name": "audiobook_progress_book_id_books_id_fk",
+          "tableFrom": "audiobook_progress",
+          "tableTo": "books",
+          "columnsFrom": ["book_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "audiobook_progress_current_file_id_book_files_id_fk": {
+          "name": "audiobook_progress_current_file_id_book_files_id_fk",
+          "tableFrom": "audiobook_progress",
+          "tableTo": "book_files",
+          "columnsFrom": ["current_file_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "audiobook_progress_user_id_book_id_pk": {
+          "name": "audiobook_progress_user_id_book_id_pk",
+          "columns": ["user_id", "book_id"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "audiobook_progress_percentage_range_chk": {
+          "name": "audiobook_progress_percentage_range_chk",
+          "value": "\"audiobook_progress\".\"percentage\" >= 0 and \"audiobook_progress\".\"percentage\" <= 100"
+        },
+        "audiobook_progress_position_seconds_nonnegative_chk": {
+          "name": "audiobook_progress_position_seconds_nonnegative_chk",
+          "value": "\"audiobook_progress\".\"position_seconds\" >= 0"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.bookmarks": {
+      "name": "bookmarks",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "book_id": {
+          "name": "book_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "cfi": {
+          "name": "cfi",
+          "type": "varchar(2000)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "varchar(500)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "position_seconds": {
+          "name": "position_seconds",
+          "type": "real",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "origin": {
+          "name": "origin",
+          "type": "varchar(10)",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'web'"
+        },
+        "device_pos": {
+          "name": "device_pos",
+          "type": "varchar(4000)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "pageno": {
+          "name": "pageno",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "bookmarks_user_book_idx": {
+          "name": "bookmarks_user_book_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "bookmarks_book_id_idx": {
+          "name": "bookmarks_book_id_idx",
+          "columns": [
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "bookmarks_deleted_at_idx": {
+          "name": "bookmarks_deleted_at_idx",
+          "columns": [
+            {
+              "expression": "deleted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"bookmarks\".\"deleted_at\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "bookmarks_user_book_cfi_uidx": {
+          "name": "bookmarks_user_book_cfi_uidx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "cfi",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"bookmarks\".\"cfi\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "bookmarks_user_book_pos_uidx": {
+          "name": "bookmarks_user_book_pos_uidx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "position_seconds",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"bookmarks\".\"position_seconds\" is not null and \"bookmarks\".\"cfi\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "bookmarks_user_id_users_id_fk": {
+          "name": "bookmarks_user_id_users_id_fk",
+          "tableFrom": "bookmarks",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "bookmarks_book_id_books_id_fk": {
+          "name": "bookmarks_book_id_books_id_fk",
+          "tableFrom": "bookmarks",
+          "tableTo": "books",
+          "columnsFrom": ["book_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "bookmarks_origin_chk": {
+          "name": "bookmarks_origin_chk",
+          "value": "\"bookmarks\".\"origin\" in ('web', 'koreader')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.reader_default_preferences": {
+      "name": "reader_default_preferences",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "format_group": {
+          "name": "format_group",
+          "type": "varchar(10)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "settings": {
+          "name": "settings",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "rdp_user_format_idx": {
+          "name": "rdp_user_format_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "format_group",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "reader_default_preferences_user_id_users_id_fk": {
+          "name": "reader_default_preferences_user_id_users_id_fk",
+          "tableFrom": "reader_default_preferences",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "reader_default_preferences_format_group_chk": {
+          "name": "reader_default_preferences_format_group_chk",
+          "value": "\"reader_default_preferences\".\"format_group\" in ('epub', 'pdf', 'cbx', 'audio')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.reader_preferences": {
+      "name": "reader_preferences",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "book_file_id": {
+          "name": "book_file_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "settings": {
+          "name": "settings",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "rp_user_file_idx": {
+          "name": "rp_user_file_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "book_file_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "reader_preferences_book_file_id_idx": {
+          "name": "reader_preferences_book_file_id_idx",
+          "columns": [
+            {
+              "expression": "book_file_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "reader_preferences_user_id_users_id_fk": {
+          "name": "reader_preferences_user_id_users_id_fk",
+          "tableFrom": "reader_preferences",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "reader_preferences_book_file_id_book_files_id_fk": {
+          "name": "reader_preferences_book_file_id_book_files_id_fk",
+          "tableFrom": "reader_preferences",
+          "tableTo": "book_files",
+          "columnsFrom": ["book_file_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.reading_attempts": {
+      "name": "reading_attempts",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "book_id": {
+          "name": "book_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "started_on": {
+          "name": "started_on",
+          "type": "date",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "ended_on": {
+          "name": "ended_on",
+          "type": "date",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "outcome": {
+          "name": "outcome",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "origin": {
+          "name": "origin",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "external_provider": {
+          "name": "external_provider",
+          "type": "varchar(40)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "external_id": {
+          "name": "external_id",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "reading_attempts_user_book_idx": {
+          "name": "reading_attempts_user_book_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "reading_attempts_book_id_idx": {
+          "name": "reading_attempts_book_id_idx",
+          "columns": [
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "reading_attempts_user_outcome_ended_idx": {
+          "name": "reading_attempts_user_outcome_ended_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "outcome",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "ended_on",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "reading_attempts_one_active_uidx": {
+          "name": "reading_attempts_one_active_uidx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"reading_attempts\".\"outcome\" is null and \"reading_attempts\".\"deleted_at\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "reading_attempts_external_uidx": {
+          "name": "reading_attempts_external_uidx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "external_provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "external_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"reading_attempts\".\"external_provider\" is not null and \"reading_attempts\".\"external_id\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "reading_attempts_user_id_users_id_fk": {
+          "name": "reading_attempts_user_id_users_id_fk",
+          "tableFrom": "reading_attempts",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "reading_attempts_book_id_books_id_fk": {
+          "name": "reading_attempts_book_id_books_id_fk",
+          "tableFrom": "reading_attempts",
+          "tableTo": "books",
+          "columnsFrom": ["book_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "reading_attempts_outcome_chk": {
+          "name": "reading_attempts_outcome_chk",
+          "value": "\"reading_attempts\".\"outcome\" is null or \"reading_attempts\".\"outcome\" in ('completed', 'skimmed', 'abandoned')"
+        },
+        "reading_attempts_origin_chk": {
+          "name": "reading_attempts_origin_chk",
+          "value": "\"reading_attempts\".\"origin\" in ('manual', 'bookorbit', 'kobo', 'koreader', 'hardcover', 'migration')"
+        },
+        "reading_attempts_end_after_start_chk": {
+          "name": "reading_attempts_end_after_start_chk",
+          "value": "\"reading_attempts\".\"ended_on\" is null or \"reading_attempts\".\"started_on\" is null or \"reading_attempts\".\"ended_on\" >= \"reading_attempts\".\"started_on\""
+        },
+        "reading_attempts_closed_has_outcome_chk": {
+          "name": "reading_attempts_closed_has_outcome_chk",
+          "value": "\"reading_attempts\".\"ended_on\" is null or \"reading_attempts\".\"outcome\" is not null"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.reading_progress": {
+      "name": "reading_progress",
+      "schema": "",
+      "columns": {
+        "book_file_id": {
+          "name": "book_file_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "percentage": {
+          "name": "percentage",
+          "type": "real",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "cfi": {
+          "name": "cfi",
+          "type": "varchar(2000)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "page_number": {
+          "name": "page_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "position_seconds": {
+          "name": "position_seconds",
+          "type": "real",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "kobo_location_source": {
+          "name": "kobo_location_source",
+          "type": "varchar(4096)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "kobo_location_type": {
+          "name": "kobo_location_type",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "kobo_location_value": {
+          "name": "kobo_location_value",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "kobo_content_source_progress_percent": {
+          "name": "kobo_content_source_progress_percent",
+          "type": "real",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "koreader_progress": {
+          "name": "koreader_progress",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "last_read_at": {
+          "name": "last_read_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "reading_progress_user_id_idx": {
+          "name": "reading_progress_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "reading_progress_user_last_read_at_idx": {
+          "name": "reading_progress_user_last_read_at_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "last_read_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "reading_progress_book_file_id_book_files_id_fk": {
+          "name": "reading_progress_book_file_id_book_files_id_fk",
+          "tableFrom": "reading_progress",
+          "tableTo": "book_files",
+          "columnsFrom": ["book_file_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "reading_progress_user_id_users_id_fk": {
+          "name": "reading_progress_user_id_users_id_fk",
+          "tableFrom": "reading_progress",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "reading_progress_book_file_id_user_id_pk": {
+          "name": "reading_progress_book_file_id_user_id_pk",
+          "columns": ["book_file_id", "user_id"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "reading_progress_percentage_range_chk": {
+          "name": "reading_progress_percentage_range_chk",
+          "value": "\"reading_progress\".\"percentage\" >= 0 and \"reading_progress\".\"percentage\" <= 100"
+        },
+        "reading_progress_page_number_nonnegative_chk": {
+          "name": "reading_progress_page_number_nonnegative_chk",
+          "value": "\"reading_progress\".\"page_number\" is null or \"reading_progress\".\"page_number\" >= 0"
+        },
+        "reading_progress_position_seconds_nonnegative_chk": {
+          "name": "reading_progress_position_seconds_nonnegative_chk",
+          "value": "\"reading_progress\".\"position_seconds\" is null or \"reading_progress\".\"position_seconds\" >= 0"
+        },
+        "reading_progress_kobo_content_source_progress_range_chk": {
+          "name": "reading_progress_kobo_content_source_progress_range_chk",
+          "value": "\"reading_progress\".\"kobo_content_source_progress_percent\" is null or (\"reading_progress\".\"kobo_content_source_progress_percent\" >= 0 and \"reading_progress\".\"kobo_content_source_progress_percent\" <= 100)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.reading_session_sync_cursors": {
+      "name": "reading_session_sync_cursors",
+      "schema": "",
+      "columns": {
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "book_id": {
+          "name": "book_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source": {
+          "name": "source",
+          "type": "varchar(32)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_device_key": {
+          "name": "source_device_key",
+          "type": "varchar(128)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "counter": {
+          "name": "counter",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "generation": {
+          "name": "generation",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "last_modified": {
+          "name": "last_modified",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "rssc_book_id_idx": {
+          "name": "rssc_book_id_idx",
+          "columns": [
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "reading_session_sync_cursors_user_id_users_id_fk": {
+          "name": "reading_session_sync_cursors_user_id_users_id_fk",
+          "tableFrom": "reading_session_sync_cursors",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "reading_session_sync_cursors_book_id_books_id_fk": {
+          "name": "reading_session_sync_cursors_book_id_books_id_fk",
+          "tableFrom": "reading_session_sync_cursors",
+          "tableTo": "books",
+          "columnsFrom": ["book_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "reading_session_sync_cursors_user_id_book_id_source_source_device_key_pk": {
+          "name": "reading_session_sync_cursors_user_id_book_id_source_source_device_key_pk",
+          "columns": ["user_id", "book_id", "source", "source_device_key"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "rssc_counter_nonnegative_chk": {
+          "name": "rssc_counter_nonnegative_chk",
+          "value": "\"reading_session_sync_cursors\".\"counter\" >= 0"
+        },
+        "rssc_generation_nonnegative_chk": {
+          "name": "rssc_generation_nonnegative_chk",
+          "value": "\"reading_session_sync_cursors\".\"generation\" >= 0"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.reading_sessions": {
+      "name": "reading_sessions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "book_file_id": {
+          "name": "book_file_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "book_id": {
+          "name": "book_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "attempt_id": {
+          "name": "attempt_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "session_id": {
+          "name": "session_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source": {
+          "name": "source",
+          "type": "varchar(10)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_device_key": {
+          "name": "source_device_key",
+          "type": "varchar(128)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ended_at": {
+          "name": "ended_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "duration_seconds": {
+          "name": "duration_seconds",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "progress_delta": {
+          "name": "progress_delta",
+          "type": "real",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "end_progress": {
+          "name": "end_progress",
+          "type": "real",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "rs_user_session_id_uidx": {
+          "name": "rs_user_session_id_uidx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "session_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "rs_user_started_at_idx": {
+          "name": "rs_user_started_at_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "rs_book_file_started_at_idx": {
+          "name": "rs_book_file_started_at_idx",
+          "columns": [
+            {
+              "expression": "book_file_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "rs_user_book_file_idx": {
+          "name": "rs_user_book_file_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "book_file_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "rs_user_book_started_at_idx": {
+          "name": "rs_user_book_started_at_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "rs_user_book_source_device_started_idx": {
+          "name": "rs_user_book_source_device_started_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_device_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "reading_sessions_book_id_idx": {
+          "name": "reading_sessions_book_id_idx",
+          "columns": [
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "rs_attempt_started_at_idx": {
+          "name": "rs_attempt_started_at_idx",
+          "columns": [
+            {
+              "expression": "attempt_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "reading_sessions_user_id_users_id_fk": {
+          "name": "reading_sessions_user_id_users_id_fk",
+          "tableFrom": "reading_sessions",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "reading_sessions_book_file_id_book_files_id_fk": {
+          "name": "reading_sessions_book_file_id_book_files_id_fk",
+          "tableFrom": "reading_sessions",
+          "tableTo": "book_files",
+          "columnsFrom": ["book_file_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "reading_sessions_book_id_books_id_fk": {
+          "name": "reading_sessions_book_id_books_id_fk",
+          "tableFrom": "reading_sessions",
+          "tableTo": "books",
+          "columnsFrom": ["book_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "reading_sessions_attempt_id_reading_attempts_id_fk": {
+          "name": "reading_sessions_attempt_id_reading_attempts_id_fk",
+          "tableFrom": "reading_sessions",
+          "tableTo": "reading_attempts",
+          "columnsFrom": ["attempt_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "reading_sessions_source_chk": {
+          "name": "reading_sessions_source_chk",
+          "value": "\"reading_sessions\".\"source\" in ('web', 'koreader', 'manual', 'kobo')"
+        },
+        "reading_sessions_duration_seconds_nonnegative_chk": {
+          "name": "reading_sessions_duration_seconds_nonnegative_chk",
+          "value": "\"reading_sessions\".\"duration_seconds\" >= 0"
+        },
+        "reading_sessions_end_progress_range_chk": {
+          "name": "reading_sessions_end_progress_range_chk",
+          "value": "\"reading_sessions\".\"end_progress\" is null or (\"reading_sessions\".\"end_progress\" >= 0 and \"reading_sessions\".\"end_progress\" <= 100)"
+        },
+        "reading_sessions_ended_after_started_chk": {
+          "name": "reading_sessions_ended_after_started_chk",
+          "value": "\"reading_sessions\".\"ended_at\" >= \"reading_sessions\".\"started_at\""
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.user_book_notes": {
+      "name": "user_book_notes",
+      "schema": "",
+      "columns": {
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "book_id": {
+          "name": "book_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "note": {
+          "name": "note",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "ubn_user_id_idx": {
+          "name": "ubn_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "ubn_book_id_idx": {
+          "name": "ubn_book_id_idx",
+          "columns": [
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "ubn_book_user_idx": {
+          "name": "ubn_book_user_idx",
+          "columns": [
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "user_book_notes_user_id_users_id_fk": {
+          "name": "user_book_notes_user_id_users_id_fk",
+          "tableFrom": "user_book_notes",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "user_book_notes_book_id_books_id_fk": {
+          "name": "user_book_notes_book_id_books_id_fk",
+          "tableFrom": "user_book_notes",
+          "tableTo": "books",
+          "columnsFrom": ["book_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "user_book_notes_user_id_book_id_pk": {
+          "name": "user_book_notes_user_id_book_id_pk",
+          "columns": ["user_id", "book_id"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "user_book_notes_note_length_chk": {
+          "name": "user_book_notes_note_length_chk",
+          "value": "\"user_book_notes\".\"note\" is null or char_length(\"user_book_notes\".\"note\") <= 10000"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.user_book_ratings": {
+      "name": "user_book_ratings",
+      "schema": "",
+      "columns": {
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "book_id": {
+          "name": "book_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "rating": {
+          "name": "rating",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "ubr_user_id_idx": {
+          "name": "ubr_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "ubr_book_id_idx": {
+          "name": "ubr_book_id_idx",
+          "columns": [
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "ubr_book_user_rating_idx": {
+          "name": "ubr_book_user_rating_idx",
+          "columns": [
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "user_book_ratings_user_id_users_id_fk": {
+          "name": "user_book_ratings_user_id_users_id_fk",
+          "tableFrom": "user_book_ratings",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "user_book_ratings_book_id_books_id_fk": {
+          "name": "user_book_ratings_book_id_books_id_fk",
+          "tableFrom": "user_book_ratings",
+          "tableTo": "books",
+          "columnsFrom": ["book_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "user_book_ratings_user_id_book_id_pk": {
+          "name": "user_book_ratings_user_id_book_id_pk",
+          "columns": ["user_id", "book_id"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "user_book_ratings_rating_range_chk": {
+          "name": "user_book_ratings_rating_range_chk",
+          "value": "\"user_book_ratings\".\"rating\" is null or (\"user_book_ratings\".\"rating\" >= 1 and \"user_book_ratings\".\"rating\" <= 5)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.user_book_status": {
+      "name": "user_book_status",
+      "schema": "",
+      "columns": {
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "book_id": {
+          "name": "book_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unread'"
+        },
+        "source": {
+          "name": "source",
+          "type": "varchar(10)",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'auto'"
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "ubs_user_id_idx": {
+          "name": "ubs_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "ubs_user_status_idx": {
+          "name": "ubs_user_status_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "ubs_book_user_idx": {
+          "name": "ubs_book_user_idx",
+          "columns": [
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "user_book_status_user_id_users_id_fk": {
+          "name": "user_book_status_user_id_users_id_fk",
+          "tableFrom": "user_book_status",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "user_book_status_book_id_books_id_fk": {
+          "name": "user_book_status_book_id_books_id_fk",
+          "tableFrom": "user_book_status",
+          "tableTo": "books",
+          "columnsFrom": ["book_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "user_book_status_user_id_book_id_pk": {
+          "name": "user_book_status_user_id_book_id_pk",
+          "columns": ["user_id", "book_id"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "user_book_status_status_chk": {
+          "name": "user_book_status_status_chk",
+          "value": "\"user_book_status\".\"status\" in ('unread', 'want_to_read', 'reading', 'on_hold', 'rereading', 'read', 'skimmed', 'abandoned')"
+        },
+        "user_book_status_source_chk": {
+          "name": "user_book_status_source_chk",
+          "value": "\"user_book_status\".\"source\" in ('auto', 'manual')"
+        },
+        "user_book_status_finished_after_started_chk": {
+          "name": "user_book_status_finished_after_started_chk",
+          "value": "\"user_book_status\".\"finished_at\" is null or \"user_book_status\".\"started_at\" is null or \"user_book_status\".\"finished_at\" >= \"user_book_status\".\"started_at\""
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.user_reading_daily_stats": {
+      "name": "user_reading_daily_stats",
+      "schema": "",
+      "columns": {
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "library_id": {
+          "name": "library_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "day": {
+          "name": "day",
+          "type": "date",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reading_seconds": {
+          "name": "reading_seconds",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "progress_delta": {
+          "name": "progress_delta",
+          "type": "real",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "sessions_count": {
+          "name": "sessions_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "urds_user_day_idx": {
+          "name": "urds_user_day_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "day",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_reading_daily_stats_library_id_idx": {
+          "name": "user_reading_daily_stats_library_id_idx",
+          "columns": [
+            {
+              "expression": "library_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "user_reading_daily_stats_user_id_users_id_fk": {
+          "name": "user_reading_daily_stats_user_id_users_id_fk",
+          "tableFrom": "user_reading_daily_stats",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "user_reading_daily_stats_library_id_libraries_id_fk": {
+          "name": "user_reading_daily_stats_library_id_libraries_id_fk",
+          "tableFrom": "user_reading_daily_stats",
+          "tableTo": "libraries",
+          "columnsFrom": ["library_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "user_reading_daily_stats_user_id_library_id_day_pk": {
+          "name": "user_reading_daily_stats_user_id_library_id_day_pk",
+          "columns": ["user_id", "library_id", "day"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "user_reading_daily_stats_reading_seconds_nonnegative_chk": {
+          "name": "user_reading_daily_stats_reading_seconds_nonnegative_chk",
+          "value": "\"user_reading_daily_stats\".\"reading_seconds\" >= 0"
+        },
+        "user_reading_daily_stats_sessions_count_nonnegative_chk": {
+          "name": "user_reading_daily_stats_sessions_count_nonnegative_chk",
+          "value": "\"user_reading_daily_stats\".\"sessions_count\" >= 0"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.oidc_group_mappings": {
+      "name": "oidc_group_mappings",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "provider_id": {
+          "name": "provider_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "oidc_group_claim": {
+          "name": "oidc_group_claim",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "permission_name": {
+          "name": "permission_name",
+          "type": "varchar(100)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "oidc_group_mappings_provider_claim_uidx": {
+          "name": "oidc_group_mappings_provider_claim_uidx",
+          "columns": [
+            {
+              "expression": "provider_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "oidc_group_claim",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "oidc_group_mappings_provider_id_oidc_providers_id_fk": {
+          "name": "oidc_group_mappings_provider_id_oidc_providers_id_fk",
+          "tableFrom": "oidc_group_mappings",
+          "tableTo": "oidc_providers",
+          "columnsFrom": ["provider_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.oidc_identities": {
+      "name": "oidc_identities",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_id": {
+          "name": "provider_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "oidc_subject": {
+          "name": "oidc_subject",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "oidc_issuer": {
+          "name": "oidc_issuer",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "linked_at": {
+          "name": "linked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "oidc_identities_provider_subject_uidx": {
+          "name": "oidc_identities_provider_subject_uidx",
+          "columns": [
+            {
+              "expression": "provider_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "oidc_subject",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "oidc_identities_user_provider_uidx": {
+          "name": "oidc_identities_user_provider_uidx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "oidc_identities_issuer_subject_uidx": {
+          "name": "oidc_identities_issuer_subject_uidx",
+          "columns": [
+            {
+              "expression": "oidc_issuer",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "oidc_subject",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "oidc_identities_user_id_idx": {
+          "name": "oidc_identities_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "oidc_identities_user_id_users_id_fk": {
+          "name": "oidc_identities_user_id_users_id_fk",
+          "tableFrom": "oidc_identities",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "oidc_identities_provider_id_oidc_providers_id_fk": {
+          "name": "oidc_identities_provider_id_oidc_providers_id_fk",
+          "tableFrom": "oidc_identities",
+          "tableTo": "oidc_providers",
+          "columnsFrom": ["provider_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.oidc_permission_grants": {
+      "name": "oidc_permission_grants",
+      "schema": "",
+      "columns": {
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_id": {
+          "name": "provider_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "permission_name": {
+          "name": "permission_name",
+          "type": "varchar(100)",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "oidc_permission_grants_user_id_users_id_fk": {
+          "name": "oidc_permission_grants_user_id_users_id_fk",
+          "tableFrom": "oidc_permission_grants",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "oidc_permission_grants_provider_id_oidc_providers_id_fk": {
+          "name": "oidc_permission_grants_provider_id_oidc_providers_id_fk",
+          "tableFrom": "oidc_permission_grants",
+          "tableTo": "oidc_providers",
+          "columnsFrom": ["provider_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "oidc_permission_grants_user_id_provider_id_permission_name_pk": {
+          "name": "oidc_permission_grants_user_id_provider_id_permission_name_pk",
+          "columns": ["user_id", "provider_id", "permission_name"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.oidc_providers": {
+      "name": "oidc_providers",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "slug": {
+          "name": "slug",
+          "type": "varchar(100)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "display_name": {
+          "name": "display_name",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "issuer_uri": {
+          "name": "issuer_uri",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "client_id": {
+          "name": "client_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "client_secret": {
+          "name": "client_secret",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scopes": {
+          "name": "scopes",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'openid profile email'"
+        },
+        "icon_url": {
+          "name": "icon_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "claim_mapping": {
+          "name": "claim_mapping",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{\"username\":\"preferred_username\",\"name\":\"name\",\"email\":\"email\",\"groups\":\"groups\"}'::jsonb"
+        },
+        "auto_provision": {
+          "name": "auto_provision",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{\"enabled\":false,\"allowLocalLinking\":false,\"defaultPermissionNames\":[]}'::jsonb"
+        },
+        "display_order": {
+          "name": "display_order",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "oidc_providers_enabled_order_idx": {
+          "name": "oidc_providers_enabled_order_idx",
+          "columns": [
+            {
+              "expression": "enabled",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "display_order",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "oidc_providers_slug_unique": {
+          "name": "oidc_providers_slug_unique",
+          "nullsNotDistinct": false,
+          "columns": ["slug"]
+        },
+        "oidc_providers_issuer_uri_unique": {
+          "name": "oidc_providers_issuer_uri_unique",
+          "nullsNotDistinct": false,
+          "columns": ["issuer_uri"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.oidc_sessions": {
+      "name": "oidc_sessions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_id": {
+          "name": "provider_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "oidc_subject": {
+          "name": "oidc_subject",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "oidc_issuer": {
+          "name": "oidc_issuer",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "oidc_session_id": {
+          "name": "oidc_session_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "id_token_hint": {
+          "name": "id_token_hint",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "idp_refresh_token": {
+          "name": "idp_refresh_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked": {
+          "name": "revoked",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "oidc_sessions_user_active_idx": {
+          "name": "oidc_sessions_user_active_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"oidc_sessions\".\"revoked\" = false",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "oidc_sessions_subject_issuer_idx": {
+          "name": "oidc_sessions_subject_issuer_idx",
+          "columns": [
+            {
+              "expression": "oidc_subject",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "oidc_issuer",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "oidc_sessions_sid_idx": {
+          "name": "oidc_sessions_sid_idx",
+          "columns": [
+            {
+              "expression": "oidc_session_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "oidc_sessions_expires_at_idx": {
+          "name": "oidc_sessions_expires_at_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "oidc_sessions_provider_id_idx": {
+          "name": "oidc_sessions_provider_id_idx",
+          "columns": [
+            {
+              "expression": "provider_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "oidc_sessions_user_id_users_id_fk": {
+          "name": "oidc_sessions_user_id_users_id_fk",
+          "tableFrom": "oidc_sessions",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "oidc_sessions_provider_id_oidc_providers_id_fk": {
+          "name": "oidc_sessions_provider_id_oidc_providers_id_fk",
+          "tableFrom": "oidc_sessions",
+          "tableTo": "oidc_providers",
+          "columnsFrom": ["provider_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.oidc_states": {
+      "name": "oidc_states",
+      "schema": "",
+      "columns": {
+        "state": {
+          "name": "state",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "provider_id": {
+          "name": "provider_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "meta": {
+          "name": "meta",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "oidc_states_expires_at_idx": {
+          "name": "oidc_states_expires_at_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "oidc_states_provider_id_oidc_providers_id_fk": {
+          "name": "oidc_states_provider_id_oidc_providers_id_fk",
+          "tableFrom": "oidc_states",
+          "tableTo": "oidc_providers",
+          "columnsFrom": ["provider_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.oidc_used_jtis": {
+      "name": "oidc_used_jtis",
+      "schema": "",
+      "columns": {
+        "jti": {
+          "name": "jti",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "oidc_used_jtis_expires_at_idx": {
+          "name": "oidc_used_jtis_expires_at_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.opds_users": {
+      "name": "opds_users",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "username": {
+          "name": "username",
+          "type": "varchar(100)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "password_hash": {
+          "name": "password_hash",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "sort_order": {
+          "name": "sort_order",
+          "type": "opds_sort_order",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'recent'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "opds_users_username_lower_uidx": {
+          "name": "opds_users_username_lower_uidx",
+          "columns": [
+            {
+              "expression": "lower(\"username\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "opds_users_user_id_users_id_fk": {
+          "name": "opds_users_user_id_users_id_fk",
+          "tableFrom": "opds_users",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "opds_users_username_unique": {
+          "name": "opds_users_username_unique",
+          "nullsNotDistinct": false,
+          "columns": ["username"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.kobo_book_entitlements": {
+      "name": "kobo_book_entitlements",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "book_id": {
+          "name": "book_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "entitlement_id": {
+          "name": "entitlement_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "cover_image_id": {
+          "name": "cover_image_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "needs_legacy_numeric_removal": {
+          "name": "needs_legacy_numeric_removal",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "kobo_book_entitlements_user_id_idx": {
+          "name": "kobo_book_entitlements_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "kobo_book_entitlements_book_id_idx": {
+          "name": "kobo_book_entitlements_book_id_idx",
+          "columns": [
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "kobo_book_entitlements_user_id_users_id_fk": {
+          "name": "kobo_book_entitlements_user_id_users_id_fk",
+          "tableFrom": "kobo_book_entitlements",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "kobo_book_entitlements_book_id_books_id_fk": {
+          "name": "kobo_book_entitlements_book_id_books_id_fk",
+          "tableFrom": "kobo_book_entitlements",
+          "tableTo": "books",
+          "columnsFrom": ["book_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "kobo_book_entitlements_user_book_unique": {
+          "name": "kobo_book_entitlements_user_book_unique",
+          "nullsNotDistinct": false,
+          "columns": ["user_id", "book_id"]
+        },
+        "kobo_book_entitlements_user_entitlement_unique": {
+          "name": "kobo_book_entitlements_user_entitlement_unique",
+          "nullsNotDistinct": false,
+          "columns": ["user_id", "entitlement_id"]
+        },
+        "kobo_book_entitlements_user_cover_unique": {
+          "name": "kobo_book_entitlements_user_cover_unique",
+          "nullsNotDistinct": false,
+          "columns": ["user_id", "cover_image_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.kobo_devices": {
+      "name": "kobo_devices",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token": {
+          "name": "token",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "client_device_id": {
+          "name": "client_device_id",
+          "type": "varchar(128)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_seen_at": {
+          "name": "last_seen_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "kobo_devices_user_id_idx": {
+          "name": "kobo_devices_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "kobo_devices_user_id_users_id_fk": {
+          "name": "kobo_devices_user_id_users_id_fk",
+          "tableFrom": "kobo_devices",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "kobo_devices_token_unique": {
+          "name": "kobo_devices_token_unique",
+          "nullsNotDistinct": false,
+          "columns": ["token"]
+        },
+        "kobo_devices_client_device_id_unique": {
+          "name": "kobo_devices_client_device_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["client_device_id"]
+        },
+        "kobo_devices_id_user_id_unique": {
+          "name": "kobo_devices_id_user_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["id", "user_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.kobo_library_snapshots": {
+      "name": "kobo_library_snapshots",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "legacy_device_cutoff_at": {
+          "name": "legacy_device_cutoff_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "kobo_library_snapshots_user_id_users_id_fk": {
+          "name": "kobo_library_snapshots_user_id_users_id_fk",
+          "tableFrom": "kobo_library_snapshots",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "kobo_library_snapshots_user_id_unique": {
+          "name": "kobo_library_snapshots_user_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["user_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.kobo_snapshot_books": {
+      "name": "kobo_snapshot_books",
+      "schema": "",
+      "columns": {
+        "snapshot_id": {
+          "name": "snapshot_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "book_id": {
+          "name": "book_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "synced": {
+          "name": "synced",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "pending_delete": {
+          "name": "pending_delete",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "is_new": {
+          "name": "is_new",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "removed_by_device": {
+          "name": "removed_by_device",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "file_hash": {
+          "name": "file_hash",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "delivery_hash": {
+          "name": "delivery_hash",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata_hash": {
+          "name": "metadata_hash",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "kobo_snapshot_books_book_id_idx": {
+          "name": "kobo_snapshot_books_book_id_idx",
+          "columns": [
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "kobo_snapshot_books_snapshot_synced_book_idx": {
+          "name": "kobo_snapshot_books_snapshot_synced_book_idx",
+          "columns": [
+            {
+              "expression": "snapshot_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "synced",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "kobo_snapshot_books_snapshot_id_kobo_library_snapshots_id_fk": {
+          "name": "kobo_snapshot_books_snapshot_id_kobo_library_snapshots_id_fk",
+          "tableFrom": "kobo_snapshot_books",
+          "tableTo": "kobo_library_snapshots",
+          "columnsFrom": ["snapshot_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "kobo_snapshot_books_book_id_books_id_fk": {
+          "name": "kobo_snapshot_books_book_id_books_id_fk",
+          "tableFrom": "kobo_snapshot_books",
+          "tableTo": "books",
+          "columnsFrom": ["book_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "kobo_snapshot_books_snapshot_id_book_id_pk": {
+          "name": "kobo_snapshot_books_snapshot_id_book_id_pk",
+          "columns": ["snapshot_id", "book_id"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.kobo_device_library_snapshots": {
+      "name": "kobo_device_library_snapshots",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "device_id": {
+          "name": "device_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "kobo_device_library_snapshots_user_id_idx": {
+          "name": "kobo_device_library_snapshots_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "kobo_device_library_snapshots_user_id_users_id_fk": {
+          "name": "kobo_device_library_snapshots_user_id_users_id_fk",
+          "tableFrom": "kobo_device_library_snapshots",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "kobo_device_library_snapshots_device_owner_fk": {
+          "name": "kobo_device_library_snapshots_device_owner_fk",
+          "tableFrom": "kobo_device_library_snapshots",
+          "tableTo": "kobo_devices",
+          "columnsFrom": ["device_id", "user_id"],
+          "columnsTo": ["id", "user_id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "kobo_device_library_snapshots_device_id_unique": {
+          "name": "kobo_device_library_snapshots_device_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["device_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.kobo_reading_states": {
+      "name": "kobo_reading_states",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "book_id": {
+          "name": "book_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "entitlement_id": {
+          "name": "entitlement_id",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at_kobo": {
+          "name": "created_at_kobo",
+          "type": "varchar(50)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_modified_kobo": {
+          "name": "last_modified_kobo",
+          "type": "varchar(50)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "priority_timestamp": {
+          "name": "priority_timestamp",
+          "type": "varchar(50)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "current_bookmark": {
+          "name": "current_bookmark",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "statistics": {
+          "name": "statistics",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status_info": {
+          "name": "status_info",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "kobo_reading_states_book_id_idx": {
+          "name": "kobo_reading_states_book_id_idx",
+          "columns": [
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "kobo_reading_states_user_id_users_id_fk": {
+          "name": "kobo_reading_states_user_id_users_id_fk",
+          "tableFrom": "kobo_reading_states",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "kobo_reading_states_book_id_books_id_fk": {
+          "name": "kobo_reading_states_book_id_books_id_fk",
+          "tableFrom": "kobo_reading_states",
+          "tableTo": "books",
+          "columnsFrom": ["book_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "kobo_reading_states_user_id_book_id_unique": {
+          "name": "kobo_reading_states_user_id_book_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["user_id", "book_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.kobo_device_snapshot_books": {
+      "name": "kobo_device_snapshot_books",
+      "schema": "",
+      "columns": {
+        "snapshot_id": {
+          "name": "snapshot_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "book_id": {
+          "name": "book_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "synced": {
+          "name": "synced",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "pending_delete": {
+          "name": "pending_delete",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "is_new": {
+          "name": "is_new",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "removed_by_device": {
+          "name": "removed_by_device",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "needs_legacy_numeric_removal": {
+          "name": "needs_legacy_numeric_removal",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "file_hash": {
+          "name": "file_hash",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "delivery_hash": {
+          "name": "delivery_hash",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata_hash": {
+          "name": "metadata_hash",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "kobo_device_snapshot_books_book_id_idx": {
+          "name": "kobo_device_snapshot_books_book_id_idx",
+          "columns": [
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "kobo_device_snapshot_books_snapshot_synced_book_idx": {
+          "name": "kobo_device_snapshot_books_snapshot_synced_book_idx",
+          "columns": [
+            {
+              "expression": "snapshot_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "synced",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "kobo_device_snapshot_books_snapshot_id_kobo_device_library_snapshots_id_fk": {
+          "name": "kobo_device_snapshot_books_snapshot_id_kobo_device_library_snapshots_id_fk",
+          "tableFrom": "kobo_device_snapshot_books",
+          "tableTo": "kobo_device_library_snapshots",
+          "columnsFrom": ["snapshot_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "kobo_device_snapshot_books_book_id_books_id_fk": {
+          "name": "kobo_device_snapshot_books_book_id_books_id_fk",
+          "tableFrom": "kobo_device_snapshot_books",
+          "tableTo": "books",
+          "columnsFrom": ["book_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "kobo_device_snapshot_books_snapshot_id_book_id_pk": {
+          "name": "kobo_device_snapshot_books_snapshot_id_book_id_pk",
+          "columns": ["snapshot_id", "book_id"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.kobo_sync_history": {
+      "name": "kobo_sync_history",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "device_id": {
+          "name": "device_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "event": {
+          "name": "event",
+          "type": "varchar(32)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "varchar(16)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "counts": {
+          "name": "counts",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "duration_ms": {
+          "name": "duration_ms",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "error_class": {
+          "name": "error_class",
+          "type": "varchar(128)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error": {
+          "name": "error",
+          "type": "varchar(500)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "kobo_sync_history_user_created_idx": {
+          "name": "kobo_sync_history_user_created_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "kobo_sync_history_device_created_idx": {
+          "name": "kobo_sync_history_device_created_idx",
+          "columns": [
+            {
+              "expression": "device_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "kobo_sync_history_user_id_users_id_fk": {
+          "name": "kobo_sync_history_user_id_users_id_fk",
+          "tableFrom": "kobo_sync_history",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "kobo_sync_history_device_id_kobo_devices_id_fk": {
+          "name": "kobo_sync_history_device_id_kobo_devices_id_fk",
+          "tableFrom": "kobo_sync_history",
+          "tableTo": "kobo_devices",
+          "columnsFrom": ["device_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "kobo_sync_history_event_chk": {
+          "name": "kobo_sync_history_event_chk",
+          "value": "\"kobo_sync_history\".\"event\" in ('library_sync', 'book_download', 'progress_update', 'annotations_pull', 'annotations_push')"
+        },
+        "kobo_sync_history_status_chk": {
+          "name": "kobo_sync_history_status_chk",
+          "value": "\"kobo_sync_history\".\"status\" in ('success', 'failed')"
+        },
+        "kobo_sync_history_duration_nonnegative_chk": {
+          "name": "kobo_sync_history_duration_nonnegative_chk",
+          "value": "\"kobo_sync_history\".\"duration_ms\" >= 0"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.kobo_sync_settings": {
+      "name": "kobo_sync_settings",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reading_threshold": {
+          "name": "reading_threshold",
+          "type": "real",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "finished_threshold": {
+          "name": "finished_threshold",
+          "type": "real",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 99
+        },
+        "convert_to_kepub": {
+          "name": "convert_to_kepub",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "force_enable_hyphenation": {
+          "name": "force_enable_hyphenation",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "kepub_conversion_limit_mb": {
+          "name": "kepub_conversion_limit_mb",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 100
+        },
+        "two_way_progress_sync": {
+          "name": "two_way_progress_sync",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "sync_bookorbit_annotations_to_kobo": {
+          "name": "sync_bookorbit_annotations_to_kobo",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "store_sync": {
+          "name": "store_sync",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "kobo_sync_settings_user_id_users_id_fk": {
+          "name": "kobo_sync_settings_user_id_users_id_fk",
+          "tableFrom": "kobo_sync_settings",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "kobo_sync_settings_user_id_unique": {
+          "name": "kobo_sync_settings_user_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["user_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "kobo_sync_settings_reading_threshold_range_chk": {
+          "name": "kobo_sync_settings_reading_threshold_range_chk",
+          "value": "\"kobo_sync_settings\".\"reading_threshold\" >= 0 and \"kobo_sync_settings\".\"reading_threshold\" <= 100"
+        },
+        "kobo_sync_settings_finished_threshold_range_chk": {
+          "name": "kobo_sync_settings_finished_threshold_range_chk",
+          "value": "\"kobo_sync_settings\".\"finished_threshold\" >= 0 and \"kobo_sync_settings\".\"finished_threshold\" <= 100"
+        },
+        "kobo_sync_settings_conversion_limit_nonnegative_chk": {
+          "name": "kobo_sync_settings_conversion_limit_nonnegative_chk",
+          "value": "\"kobo_sync_settings\".\"kepub_conversion_limit_mb\" >= 0"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.book_dock_files": {
+      "name": "book_dock_files",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "file_name": {
+          "name": "file_name",
+          "type": "varchar(500)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "absolute_path": {
+          "name": "absolute_path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "file_size": {
+          "name": "file_size",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "format": {
+          "name": "format",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "unit_directory": {
+          "name": "unit_directory",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "embedded_metadata": {
+          "name": "embedded_metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "selected_metadata": {
+          "name": "selected_metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "fetched_metadata": {
+          "name": "fetched_metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cover_path": {
+          "name": "cover_path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "target_library_id": {
+          "name": "target_library_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "target_folder_id": {
+          "name": "target_folder_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "confidence": {
+          "name": "confidence",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "fetched_metadata_sources": {
+          "name": "fetched_metadata_sources",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_message": {
+          "name": "error_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata_edited_at": {
+          "name": "metadata_edited_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "uploaded_by": {
+          "name": "uploaded_by",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "auto_finalize_suppressed": {
+          "name": "auto_finalize_suppressed",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "book_dock_files_status_idx": {
+          "name": "book_dock_files_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "book_dock_files_target_library_id_idx": {
+          "name": "book_dock_files_target_library_id_idx",
+          "columns": [
+            {
+              "expression": "target_library_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "book_dock_files_uploaded_by_idx": {
+          "name": "book_dock_files_uploaded_by_idx",
+          "columns": [
+            {
+              "expression": "uploaded_by",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "book_dock_files_target_library_id_libraries_id_fk": {
+          "name": "book_dock_files_target_library_id_libraries_id_fk",
+          "tableFrom": "book_dock_files",
+          "tableTo": "libraries",
+          "columnsFrom": ["target_library_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "book_dock_files_target_folder_id_library_folders_id_fk": {
+          "name": "book_dock_files_target_folder_id_library_folders_id_fk",
+          "tableFrom": "book_dock_files",
+          "tableTo": "library_folders",
+          "columnsFrom": ["target_folder_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "book_dock_files_uploaded_by_users_id_fk": {
+          "name": "book_dock_files_uploaded_by_users_id_fk",
+          "tableFrom": "book_dock_files",
+          "tableTo": "users",
+          "columnsFrom": ["uploaded_by"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "book_dock_files_absolute_path_unique": {
+          "name": "book_dock_files_absolute_path_unique",
+          "nullsNotDistinct": false,
+          "columns": ["absolute_path"]
+        },
+        "book_dock_files_unit_directory_unique": {
+          "name": "book_dock_files_unit_directory_unique",
+          "nullsNotDistinct": false,
+          "columns": ["unit_directory"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "book_dock_files_status_chk": {
+          "name": "book_dock_files_status_chk",
+          "value": "\"book_dock_files\".\"status\" in ('pending', 'extracting', 'fetching', 'ready', 'error')"
+        },
+        "book_dock_files_confidence_range_chk": {
+          "name": "book_dock_files_confidence_range_chk",
+          "value": "\"book_dock_files\".\"confidence\" is null or (\"book_dock_files\".\"confidence\" >= 0 and \"book_dock_files\".\"confidence\" <= 100)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.book_dock_unit_files": {
+      "name": "book_dock_unit_files",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "dock_file_id": {
+          "name": "dock_file_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "absolute_path": {
+          "name": "absolute_path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "file_name": {
+          "name": "file_name",
+          "type": "varchar(500)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "file_size": {
+          "name": "file_size",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "format": {
+          "name": "format",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "role": {
+          "name": "role",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'content'"
+        },
+        "sort_order": {
+          "name": "sort_order",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "book_dock_unit_files_dock_file_id_sort_order_idx": {
+          "name": "book_dock_unit_files_dock_file_id_sort_order_idx",
+          "columns": [
+            {
+              "expression": "dock_file_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "sort_order",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "book_dock_unit_files_dock_file_id_book_dock_files_id_fk": {
+          "name": "book_dock_unit_files_dock_file_id_book_dock_files_id_fk",
+          "tableFrom": "book_dock_unit_files",
+          "tableTo": "book_dock_files",
+          "columnsFrom": ["dock_file_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "book_dock_unit_files_absolute_path_unique": {
+          "name": "book_dock_unit_files_absolute_path_unique",
+          "nullsNotDistinct": false,
+          "columns": ["absolute_path"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "book_dock_unit_files_role_chk": {
+          "name": "book_dock_unit_files_role_chk",
+          "value": "\"book_dock_unit_files\".\"role\" in ('content', 'cover', 'metadata', 'supplement')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.book_request_dedupe_aliases": {
+      "name": "book_request_dedupe_aliases",
+      "schema": "",
+      "columns": {
+        "request_id": {
+          "name": "request_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "dedupe_key": {
+          "name": "dedupe_key",
+          "type": "varchar(500)",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "book_request_dedupe_aliases_key_idx": {
+          "name": "book_request_dedupe_aliases_key_idx",
+          "columns": [
+            {
+              "expression": "dedupe_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "book_request_dedupe_aliases_request_id_book_requests_id_fk": {
+          "name": "book_request_dedupe_aliases_request_id_book_requests_id_fk",
+          "tableFrom": "book_request_dedupe_aliases",
+          "tableTo": "book_requests",
+          "columnsFrom": ["request_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "book_request_dedupe_aliases_request_id_dedupe_key_pk": {
+          "name": "book_request_dedupe_aliases_request_id_dedupe_key_pk",
+          "columns": ["request_id", "dedupe_key"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.book_request_dismissals": {
+      "name": "book_request_dismissals",
+      "schema": "",
+      "columns": {
+        "request_id": {
+          "name": "request_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "book_request_dismissals_user_id_idx": {
+          "name": "book_request_dismissals_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "book_request_dismissals_request_id_book_requests_id_fk": {
+          "name": "book_request_dismissals_request_id_book_requests_id_fk",
+          "tableFrom": "book_request_dismissals",
+          "tableTo": "book_requests",
+          "columnsFrom": ["request_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "book_request_dismissals_user_id_users_id_fk": {
+          "name": "book_request_dismissals_user_id_users_id_fk",
+          "tableFrom": "book_request_dismissals",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "book_request_dismissals_request_id_user_id_pk": {
+          "name": "book_request_dismissals_request_id_user_id_pk",
+          "columns": ["request_id", "user_id"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.book_request_subscribers": {
+      "name": "book_request_subscribers",
+      "schema": "",
+      "columns": {
+        "request_id": {
+          "name": "request_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "book_request_subscribers_user_id_idx": {
+          "name": "book_request_subscribers_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "book_request_subscribers_request_id_book_requests_id_fk": {
+          "name": "book_request_subscribers_request_id_book_requests_id_fk",
+          "tableFrom": "book_request_subscribers",
+          "tableTo": "book_requests",
+          "columnsFrom": ["request_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "book_request_subscribers_user_id_users_id_fk": {
+          "name": "book_request_subscribers_user_id_users_id_fk",
+          "tableFrom": "book_request_subscribers",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "book_request_subscribers_request_id_user_id_pk": {
+          "name": "book_request_subscribers_request_id_user_id_pk",
+          "columns": ["request_id", "user_id"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.book_requests": {
+      "name": "book_requests",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "media_kind": {
+          "name": "media_kind",
+          "type": "book_request_media_kind",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "title": {
+          "name": "title",
+          "type": "varchar(500)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subtitle": {
+          "name": "subtitle",
+          "type": "varchar(500)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "authors": {
+          "name": "authors",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "series_name": {
+          "name": "series_name",
+          "type": "varchar(500)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "series_index": {
+          "name": "series_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "isbn10": {
+          "name": "isbn10",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "isbn13": {
+          "name": "isbn13",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "published_year": {
+          "name": "published_year",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "language": {
+          "name": "language",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cover_url": {
+          "name": "cover_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_key": {
+          "name": "provider_key",
+          "type": "varchar(50)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_id": {
+          "name": "provider_id",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata_sources": {
+          "name": "metadata_sources",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "preferred_formats": {
+          "name": "preferred_formats",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "note": {
+          "name": "note",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "target_library_id": {
+          "name": "target_library_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "target_folder_id": {
+          "name": "target_folder_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decided_by_user_id": {
+          "name": "decided_by_user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decided_at": {
+          "name": "decided_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decision_note": {
+          "name": "decision_note",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "matched_book_id": {
+          "name": "matched_book_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "book_dock_file_id": {
+          "name": "book_dock_file_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status_reason": {
+          "name": "status_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "failure_code": {
+          "name": "failure_code",
+          "type": "varchar(50)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "failure_meta": {
+          "name": "failure_meta",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "self_serve": {
+          "name": "self_serve",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "fulfiller_user_id": {
+          "name": "fulfiller_user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "dedupe_key": {
+          "name": "dedupe_key",
+          "type": "varchar(500)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "book_requests_user_status_idx": {
+          "name": "book_requests_user_status_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "book_requests_status_created_at_idx": {
+          "name": "book_requests_status_created_at_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "book_requests_target_library_id_idx": {
+          "name": "book_requests_target_library_id_idx",
+          "columns": [
+            {
+              "expression": "target_library_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "book_requests_created_at_idx": {
+          "name": "book_requests_created_at_idx",
+          "columns": [
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "book_requests_title_idx": {
+          "name": "book_requests_title_idx",
+          "columns": [
+            {
+              "expression": "title",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "book_requests_matched_book_user_idx": {
+          "name": "book_requests_matched_book_user_idx",
+          "columns": [
+            {
+              "expression": "matched_book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"book_requests\".\"matched_book_id\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "book_requests_self_serve_idx": {
+          "name": "book_requests_self_serve_idx",
+          "columns": [
+            {
+              "expression": "self_serve",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"book_requests\".\"self_serve\"",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "book_requests_active_dedupe_key_uidx": {
+          "name": "book_requests_active_dedupe_key_uidx",
+          "columns": [
+            {
+              "expression": "dedupe_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"book_requests\".\"status\" in ('pending', 'approved', 'searching', 'grabbed', 'downloading', 'importing', 'needs_review')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "book_requests_user_id_users_id_fk": {
+          "name": "book_requests_user_id_users_id_fk",
+          "tableFrom": "book_requests",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "book_requests_target_library_id_libraries_id_fk": {
+          "name": "book_requests_target_library_id_libraries_id_fk",
+          "tableFrom": "book_requests",
+          "tableTo": "libraries",
+          "columnsFrom": ["target_library_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "book_requests_target_folder_id_library_folders_id_fk": {
+          "name": "book_requests_target_folder_id_library_folders_id_fk",
+          "tableFrom": "book_requests",
+          "tableTo": "library_folders",
+          "columnsFrom": ["target_folder_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "book_requests_created_by_user_id_users_id_fk": {
+          "name": "book_requests_created_by_user_id_users_id_fk",
+          "tableFrom": "book_requests",
+          "tableTo": "users",
+          "columnsFrom": ["created_by_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "book_requests_decided_by_user_id_users_id_fk": {
+          "name": "book_requests_decided_by_user_id_users_id_fk",
+          "tableFrom": "book_requests",
+          "tableTo": "users",
+          "columnsFrom": ["decided_by_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "book_requests_matched_book_id_books_id_fk": {
+          "name": "book_requests_matched_book_id_books_id_fk",
+          "tableFrom": "book_requests",
+          "tableTo": "books",
+          "columnsFrom": ["matched_book_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "book_requests_book_dock_file_id_book_dock_files_id_fk": {
+          "name": "book_requests_book_dock_file_id_book_dock_files_id_fk",
+          "tableFrom": "book_requests",
+          "tableTo": "book_dock_files",
+          "columnsFrom": ["book_dock_file_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "book_requests_fulfiller_user_id_users_id_fk": {
+          "name": "book_requests_fulfiller_user_id_users_id_fk",
+          "tableFrom": "book_requests",
+          "tableTo": "users",
+          "columnsFrom": ["fulfiller_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "book_requests_status_chk": {
+          "name": "book_requests_status_chk",
+          "value": "\"book_requests\".\"status\" in ('pending', 'approved', 'rejected', 'cancelled', 'searching', 'grabbed', 'downloading', 'importing', 'needs_review', 'available', 'failed')"
+        },
+        "book_requests_series_index_nonnegative_chk": {
+          "name": "book_requests_series_index_nonnegative_chk",
+          "value": "\"book_requests\".\"series_index\" is null or \"book_requests\".\"series_index\" >= 0"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.book_request_downloads": {
+      "name": "book_request_downloads",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "request_id": {
+          "name": "request_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "download_client_id": {
+          "name": "download_client_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "indexer_id": {
+          "name": "indexer_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source": {
+          "name": "source",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "automated": {
+          "name": "automated",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "release_title": {
+          "name": "release_title",
+          "type": "varchar(500)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "release_guid": {
+          "name": "release_guid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "release_size_bytes": {
+          "name": "release_size_bytes",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "release_seeders": {
+          "name": "release_seeders",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "release_format": {
+          "name": "release_format",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "freeleech": {
+          "name": "freeleech",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "client_hash": {
+          "name": "client_hash",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'queued'"
+        },
+        "progress_percent": {
+          "name": "progress_percent",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "downloaded_bytes": {
+          "name": "downloaded_bytes",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "total_bytes": {
+          "name": "total_bytes",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "direct_url": {
+          "name": "direct_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "direct_file_name": {
+          "name": "direct_file_name",
+          "type": "varchar(500)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "direct_etag": {
+          "name": "direct_etag",
+          "type": "varchar(1024)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "direct_last_modified": {
+          "name": "direct_last_modified",
+          "type": "varchar(200)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "content_path": {
+          "name": "content_path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "local_path": {
+          "name": "local_path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "book_dock_file_id": {
+          "name": "book_dock_file_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "release_units": {
+          "name": "release_units",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_message": {
+          "name": "error_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "grabbed_at": {
+          "name": "grabbed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_progress_at": {
+          "name": "last_progress_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "imported_at": {
+          "name": "imported_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "book_request_downloads_status_idx": {
+          "name": "book_request_downloads_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "book_request_downloads_request_latest_idx": {
+          "name": "book_request_downloads_request_latest_idx",
+          "columns": [
+            {
+              "expression": "request_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "id",
+              "isExpression": false,
+              "asc": false,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "book_request_downloads_book_dock_file_id_idx": {
+          "name": "book_request_downloads_book_dock_file_id_idx",
+          "columns": [
+            {
+              "expression": "book_dock_file_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "book_request_downloads_active_hash_uidx": {
+          "name": "book_request_downloads_active_hash_uidx",
+          "columns": [
+            {
+              "expression": "coalesce(\"download_client_id\", 0)",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "client_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"book_request_downloads\".\"status\" in ('queued', 'downloading', 'completed', 'importing', 'needs_review')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "book_request_downloads_request_id_book_requests_id_fk": {
+          "name": "book_request_downloads_request_id_book_requests_id_fk",
+          "tableFrom": "book_request_downloads",
+          "tableTo": "book_requests",
+          "columnsFrom": ["request_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "book_request_downloads_download_client_id_download_clients_id_fk": {
+          "name": "book_request_downloads_download_client_id_download_clients_id_fk",
+          "tableFrom": "book_request_downloads",
+          "tableTo": "download_clients",
+          "columnsFrom": ["download_client_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "book_request_downloads_indexer_id_request_indexers_id_fk": {
+          "name": "book_request_downloads_indexer_id_request_indexers_id_fk",
+          "tableFrom": "book_request_downloads",
+          "tableTo": "request_indexers",
+          "columnsFrom": ["indexer_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "book_request_downloads_book_dock_file_id_book_dock_files_id_fk": {
+          "name": "book_request_downloads_book_dock_file_id_book_dock_files_id_fk",
+          "tableFrom": "book_request_downloads",
+          "tableTo": "book_dock_files",
+          "columnsFrom": ["book_dock_file_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "book_request_downloads_source_chk": {
+          "name": "book_request_downloads_source_chk",
+          "value": "\"book_request_downloads\".\"source\" in ('magnet', 'torrent_file', 'direct_url')"
+        },
+        "book_request_downloads_status_chk": {
+          "name": "book_request_downloads_status_chk",
+          "value": "\"book_request_downloads\".\"status\" in ('queued', 'downloading', 'completed', 'importing', 'needs_review', 'imported', 'failed')"
+        },
+        "book_request_downloads_progress_range_chk": {
+          "name": "book_request_downloads_progress_range_chk",
+          "value": "\"book_request_downloads\".\"progress_percent\" >= 0 and \"book_request_downloads\".\"progress_percent\" <= 100"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.download_client_path_mappings": {
+      "name": "download_client_path_mappings",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "download_client_id": {
+          "name": "download_client_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "remote_path": {
+          "name": "remote_path",
+          "type": "varchar(4096)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "local_path": {
+          "name": "local_path",
+          "type": "varchar(4096)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "download_client_path_mappings_client_remote_uidx": {
+          "name": "download_client_path_mappings_client_remote_uidx",
+          "columns": [
+            {
+              "expression": "download_client_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "remote_path",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "download_client_path_mappings_download_client_id_download_clients_id_fk": {
+          "name": "download_client_path_mappings_download_client_id_download_clients_id_fk",
+          "tableFrom": "download_client_path_mappings",
+          "tableTo": "download_clients",
+          "columnsFrom": ["download_client_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.download_clients": {
+      "name": "download_clients",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(100)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "color": {
+          "name": "color",
+          "type": "varchar(16)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "adapter_type": {
+          "name": "adapter_type",
+          "type": "varchar(30)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "priority": {
+          "name": "priority",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "base_url": {
+          "name": "base_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "username": {
+          "name": "username",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credentials_enc": {
+          "name": "credentials_enc",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "category": {
+          "name": "category",
+          "type": "varchar(100)",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'bookorbit'"
+        },
+        "use_hardlinks": {
+          "name": "use_hardlinks",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "allow_private_address": {
+          "name": "allow_private_address",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "settings": {
+          "name": "settings",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_tested_at": {
+          "name": "last_tested_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_test_ok": {
+          "name": "last_test_ok",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error_message": {
+          "name": "last_error_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "download_clients_name_lower_uidx": {
+          "name": "download_clients_name_lower_uidx",
+          "columns": [
+            {
+              "expression": "lower(\"name\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "download_clients_enabled_priority_idx": {
+          "name": "download_clients_enabled_priority_idx",
+          "columns": [
+            {
+              "expression": "enabled",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "priority",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "download_clients_adapter_type_chk": {
+          "name": "download_clients_adapter_type_chk",
+          "value": "\"download_clients\".\"adapter_type\" in ('qbittorrent', 'transmission', 'deluge')"
+        },
+        "download_clients_priority_range_chk": {
+          "name": "download_clients_priority_range_chk",
+          "value": "\"download_clients\".\"priority\" >= 1 and \"download_clients\".\"priority\" <= 100"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.request_indexers": {
+      "name": "request_indexers",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(100)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "color": {
+          "name": "color",
+          "type": "varchar(16)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "adapter_type": {
+          "name": "adapter_type",
+          "type": "varchar(30)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "base_url": {
+          "name": "base_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "credentials_enc": {
+          "name": "credentials_enc",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "allow_private_address": {
+          "name": "allow_private_address",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "categories": {
+          "name": "categories",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "disabled_media_kinds": {
+          "name": "disabled_media_kinds",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "isbn_search_disabled": {
+          "name": "isbn_search_disabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "settings": {
+          "name": "settings",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "network_profile": {
+          "name": "network_profile",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_tested_at": {
+          "name": "last_tested_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_test_ok": {
+          "name": "last_test_ok",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error_message": {
+          "name": "last_error_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_search_at": {
+          "name": "last_search_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_search_ok": {
+          "name": "last_search_ok",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_search_error": {
+          "name": "last_search_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "search_failure_streak": {
+          "name": "search_failure_streak",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "request_indexers_name_lower_uidx": {
+          "name": "request_indexers_name_lower_uidx",
+          "columns": [
+            {
+              "expression": "lower(\"name\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "request_indexers_enabled_idx": {
+          "name": "request_indexers_enabled_idx",
+          "columns": [
+            {
+              "expression": "enabled",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "request_indexers_adapter_type_chk": {
+          "name": "request_indexers_adapter_type_chk",
+          "value": "\"request_indexers\".\"adapter_type\" ~ '^[a-z0-9][a-z0-9-]{0,29}$'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.file_write_log": {
+      "name": "file_write_log",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "book_id": {
+          "name": "book_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "book_file_id": {
+          "name": "book_file_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "format": {
+          "name": "format",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "varchar(10)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "fields_written": {
+          "name": "fields_written",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_message": {
+          "name": "error_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "duration_ms": {
+          "name": "duration_ms",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "triggered_by": {
+          "name": "triggered_by",
+          "type": "varchar(10)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "written_at": {
+          "name": "written_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "fwl_book_id_written_at_idx": {
+          "name": "fwl_book_id_written_at_idx",
+          "columns": [
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "written_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "file_write_log_book_file_id_idx": {
+          "name": "file_write_log_book_file_id_idx",
+          "columns": [
+            {
+              "expression": "book_file_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "file_write_log_book_id_books_id_fk": {
+          "name": "file_write_log_book_id_books_id_fk",
+          "tableFrom": "file_write_log",
+          "tableTo": "books",
+          "columnsFrom": ["book_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "file_write_log_book_file_id_book_files_id_fk": {
+          "name": "file_write_log_book_file_id_book_files_id_fk",
+          "tableFrom": "file_write_log",
+          "tableTo": "book_files",
+          "columnsFrom": ["book_file_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "file_write_log_user_id_users_id_fk": {
+          "name": "file_write_log_user_id_users_id_fk",
+          "tableFrom": "file_write_log",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "file_write_log_status_chk": {
+          "name": "file_write_log_status_chk",
+          "value": "\"file_write_log\".\"status\" in ('success', 'skipped', 'failed')"
+        },
+        "file_write_log_triggered_by_chk": {
+          "name": "file_write_log_triggered_by_chk",
+          "value": "\"file_write_log\".\"triggered_by\" in ('auto', 'sync')"
+        },
+        "file_write_log_duration_ms_nonnegative_chk": {
+          "name": "file_write_log_duration_ms_nonnegative_chk",
+          "value": "\"file_write_log\".\"duration_ms\" is null or \"file_write_log\".\"duration_ms\" >= 0"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.email_templates": {
+      "name": "email_templates",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subject": {
+          "name": "subject",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "body_text": {
+          "name": "body_text",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "is_default": {
+          "name": "is_default",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "is_system": {
+          "name": "is_system",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "email_templates_one_default_per_user_uidx": {
+          "name": "email_templates_one_default_per_user_uidx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"email_templates\".\"is_default\" = true and \"email_templates\".\"user_id\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "email_templates_system_name_unique": {
+          "name": "email_templates_system_name_unique",
+          "columns": [
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"email_templates\".\"user_id\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "email_templates_user_id_users_id_fk": {
+          "name": "email_templates_user_id_users_id_fk",
+          "tableFrom": "email_templates",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "email_templates_user_id_name_unique": {
+          "name": "email_templates_user_id_name_unique",
+          "nullsNotDistinct": false,
+          "columns": ["user_id", "name"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.email_providers": {
+      "name": "email_providers",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "host": {
+          "name": "host",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "port": {
+          "name": "port",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "username": {
+          "name": "username",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "password_enc": {
+          "name": "password_enc",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "from_name": {
+          "name": "from_name",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "from_address": {
+          "name": "from_address",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "auth": {
+          "name": "auth",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "ssl": {
+          "name": "ssl",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "start_tls": {
+          "name": "start_tls",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "is_default": {
+          "name": "is_default",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "is_shared": {
+          "name": "is_shared",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "is_system_provider": {
+          "name": "is_system_provider",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "tls_reject_unauthorized": {
+          "name": "tls_reject_unauthorized",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "email_providers_one_default_per_user_uidx": {
+          "name": "email_providers_one_default_per_user_uidx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"email_providers\".\"is_default\" = true and \"email_providers\".\"user_id\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "email_providers_one_system_provider_uidx": {
+          "name": "email_providers_one_system_provider_uidx",
+          "columns": [
+            {
+              "expression": "is_system_provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"email_providers\".\"is_system_provider\" = true",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "email_providers_user_id_users_id_fk": {
+          "name": "email_providers_user_id_users_id_fk",
+          "tableFrom": "email_providers",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "email_providers_user_id_name_unique": {
+          "name": "email_providers_user_id_name_unique",
+          "nullsNotDistinct": false,
+          "columns": ["user_id", "name"]
+        },
+        "email_providers_id_user_id_unique": {
+          "name": "email_providers_id_user_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["id", "user_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "email_providers_port_range_chk": {
+          "name": "email_providers_port_range_chk",
+          "value": "\"email_providers\".\"port\" >= 1 and \"email_providers\".\"port\" <= 65535"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.email_recipient_group_members": {
+      "name": "email_recipient_group_members",
+      "schema": "",
+      "columns": {
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "group_id": {
+          "name": "group_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "recipient_id": {
+          "name": "recipient_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "email_recipient_group_members_user_id_users_id_fk": {
+          "name": "email_recipient_group_members_user_id_users_id_fk",
+          "tableFrom": "email_recipient_group_members",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "email_recipient_group_members_group_id_email_recipient_groups_id_fk": {
+          "name": "email_recipient_group_members_group_id_email_recipient_groups_id_fk",
+          "tableFrom": "email_recipient_group_members",
+          "tableTo": "email_recipient_groups",
+          "columnsFrom": ["group_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "email_recipient_group_members_recipient_id_email_recipients_id_fk": {
+          "name": "email_recipient_group_members_recipient_id_email_recipients_id_fk",
+          "tableFrom": "email_recipient_group_members",
+          "tableTo": "email_recipients",
+          "columnsFrom": ["recipient_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "email_recipient_group_members_group_user_fk": {
+          "name": "email_recipient_group_members_group_user_fk",
+          "tableFrom": "email_recipient_group_members",
+          "tableTo": "email_recipient_groups",
+          "columnsFrom": ["group_id", "user_id"],
+          "columnsTo": ["id", "user_id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "email_recipient_group_members_recipient_user_fk": {
+          "name": "email_recipient_group_members_recipient_user_fk",
+          "tableFrom": "email_recipient_group_members",
+          "tableTo": "email_recipients",
+          "columnsFrom": ["recipient_id", "user_id"],
+          "columnsTo": ["id", "user_id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "email_recipient_group_members_group_id_recipient_id_pk": {
+          "name": "email_recipient_group_members_group_id_recipient_id_pk",
+          "columns": ["group_id", "recipient_id"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.email_recipient_groups": {
+      "name": "email_recipient_groups",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "default_template_id": {
+          "name": "default_template_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "email_recipient_groups_user_id_users_id_fk": {
+          "name": "email_recipient_groups_user_id_users_id_fk",
+          "tableFrom": "email_recipient_groups",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "email_recipient_groups_default_template_id_email_templates_id_fk": {
+          "name": "email_recipient_groups_default_template_id_email_templates_id_fk",
+          "tableFrom": "email_recipient_groups",
+          "tableTo": "email_templates",
+          "columnsFrom": ["default_template_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "email_recipient_groups_user_id_name_unique": {
+          "name": "email_recipient_groups_user_id_name_unique",
+          "nullsNotDistinct": false,
+          "columns": ["user_id", "name"]
+        },
+        "email_recipient_groups_id_user_id_unique": {
+          "name": "email_recipient_groups_id_user_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["id", "user_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.email_recipients": {
+      "name": "email_recipients",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "email": {
+          "name": "email",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "is_default": {
+          "name": "is_default",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "device_type": {
+          "name": "device_type",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "preferred_format": {
+          "name": "preferred_format",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "default_template_id": {
+          "name": "default_template_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "email_recipients_user_email_lower_uidx": {
+          "name": "email_recipients_user_email_lower_uidx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "lower(\"email\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "email_recipients_one_default_per_user_uidx": {
+          "name": "email_recipients_one_default_per_user_uidx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"email_recipients\".\"is_default\" = true",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "email_recipients_user_id_users_id_fk": {
+          "name": "email_recipients_user_id_users_id_fk",
+          "tableFrom": "email_recipients",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "email_recipients_default_template_id_email_templates_id_fk": {
+          "name": "email_recipients_default_template_id_email_templates_id_fk",
+          "tableFrom": "email_recipients",
+          "tableTo": "email_templates",
+          "columnsFrom": ["default_template_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "email_recipients_user_id_email_unique": {
+          "name": "email_recipients_user_id_email_unique",
+          "nullsNotDistinct": false,
+          "columns": ["user_id", "email"]
+        },
+        "email_recipients_id_user_id_unique": {
+          "name": "email_recipients_id_user_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["id", "user_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "email_recipients_device_type_chk": {
+          "name": "email_recipients_device_type_chk",
+          "value": "\"email_recipients\".\"device_type\" is null or \"email_recipients\".\"device_type\" in ('kindle', 'kobo', 'other')"
+        },
+        "email_recipients_preferred_format_chk": {
+          "name": "email_recipients_preferred_format_chk",
+          "value": "\"email_recipients\".\"preferred_format\" is null or \"email_recipients\".\"preferred_format\" in ('epub', 'pdf', 'mobi', 'azw3', 'cbz', 'cbr')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.email_preferences": {
+      "name": "email_preferences",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "default_provider_id": {
+          "name": "default_provider_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "default_recipient_id": {
+          "name": "default_recipient_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "default_template_id": {
+          "name": "default_template_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "email_preferences_user_id_users_id_fk": {
+          "name": "email_preferences_user_id_users_id_fk",
+          "tableFrom": "email_preferences",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "email_preferences_default_provider_id_email_providers_id_fk": {
+          "name": "email_preferences_default_provider_id_email_providers_id_fk",
+          "tableFrom": "email_preferences",
+          "tableTo": "email_providers",
+          "columnsFrom": ["default_provider_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "email_preferences_default_recipient_id_email_recipients_id_fk": {
+          "name": "email_preferences_default_recipient_id_email_recipients_id_fk",
+          "tableFrom": "email_preferences",
+          "tableTo": "email_recipients",
+          "columnsFrom": ["default_recipient_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "email_preferences_default_template_id_email_templates_id_fk": {
+          "name": "email_preferences_default_template_id_email_templates_id_fk",
+          "tableFrom": "email_preferences",
+          "tableTo": "email_templates",
+          "columnsFrom": ["default_template_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "email_preferences_default_recipient_owner_fk": {
+          "name": "email_preferences_default_recipient_owner_fk",
+          "tableFrom": "email_preferences",
+          "tableTo": "email_recipients",
+          "columnsFrom": ["default_recipient_id", "user_id"],
+          "columnsTo": ["id", "user_id"],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "email_preferences_user_id_unique": {
+          "name": "email_preferences_user_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["user_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.email_send_log": {
+      "name": "email_send_log",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "book_id": {
+          "name": "book_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "book_file_id": {
+          "name": "book_file_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_id": {
+          "name": "provider_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "template_id": {
+          "name": "template_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "to_email": {
+          "name": "to_email",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "to_name": {
+          "name": "to_name",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "subject": {
+          "name": "subject",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "attempt_count": {
+          "name": "attempt_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "next_retry_at": {
+          "name": "next_retry_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_message": {
+          "name": "error_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "sent_at": {
+          "name": "sent_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "email_send_log_user_created_at_idx": {
+          "name": "email_send_log_user_created_at_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "email_send_log_book_id_idx": {
+          "name": "email_send_log_book_id_idx",
+          "columns": [
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "email_send_log_book_file_id_idx": {
+          "name": "email_send_log_book_file_id_idx",
+          "columns": [
+            {
+              "expression": "book_file_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "email_send_log_created_at_idx": {
+          "name": "email_send_log_created_at_idx",
+          "columns": [
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "email_send_log_status_next_retry_idx": {
+          "name": "email_send_log_status_next_retry_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "next_retry_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "email_send_log_user_id_users_id_fk": {
+          "name": "email_send_log_user_id_users_id_fk",
+          "tableFrom": "email_send_log",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "email_send_log_book_id_books_id_fk": {
+          "name": "email_send_log_book_id_books_id_fk",
+          "tableFrom": "email_send_log",
+          "tableTo": "books",
+          "columnsFrom": ["book_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "email_send_log_book_file_id_book_files_id_fk": {
+          "name": "email_send_log_book_file_id_book_files_id_fk",
+          "tableFrom": "email_send_log",
+          "tableTo": "book_files",
+          "columnsFrom": ["book_file_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "email_send_log_provider_id_email_providers_id_fk": {
+          "name": "email_send_log_provider_id_email_providers_id_fk",
+          "tableFrom": "email_send_log",
+          "tableTo": "email_providers",
+          "columnsFrom": ["provider_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "email_send_log_template_id_email_templates_id_fk": {
+          "name": "email_send_log_template_id_email_templates_id_fk",
+          "tableFrom": "email_send_log",
+          "tableTo": "email_templates",
+          "columnsFrom": ["template_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "email_send_log_status_chk": {
+          "name": "email_send_log_status_chk",
+          "value": "\"email_send_log\".\"status\" in ('pending', 'sent', 'failed')"
+        },
+        "email_send_log_attempt_count_nonnegative_chk": {
+          "name": "email_send_log_attempt_count_nonnegative_chk",
+          "value": "\"email_send_log\".\"attempt_count\" >= 0"
+        },
+        "email_send_log_sent_after_created_chk": {
+          "name": "email_send_log_sent_after_created_chk",
+          "value": "\"email_send_log\".\"sent_at\" is null or \"email_send_log\".\"sent_at\" >= \"email_send_log\".\"created_at\""
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.notifications": {
+      "name": "notifications",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "type": {
+          "name": "type",
+          "type": "varchar(50)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "message": {
+          "name": "message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "action_url": {
+          "name": "action_url",
+          "type": "varchar(2048)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "meta": {
+          "name": "meta",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "read": {
+          "name": "read",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "group_key": {
+          "name": "group_key",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "count": {
+          "name": "count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "notifications_user_id_idx": {
+          "name": "notifications_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "notifications_user_unread_idx": {
+          "name": "notifications_user_unread_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "read",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "notifications_created_at_idx": {
+          "name": "notifications_created_at_idx",
+          "columns": [
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "notifications_user_updated_at_idx": {
+          "name": "notifications_user_updated_at_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": false,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "notifications_updated_at_idx": {
+          "name": "notifications_updated_at_idx",
+          "columns": [
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "notifications_user_unread_group_key_idx": {
+          "name": "notifications_user_unread_group_key_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "group_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"notifications\".\"read\" = false and \"notifications\".\"group_key\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "notifications_user_id_users_id_fk": {
+          "name": "notifications_user_id_users_id_fk",
+          "tableFrom": "notifications",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.dismissed_duplicate_pairs": {
+      "name": "dismissed_duplicate_pairs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "entity_type": {
+          "name": "entity_type",
+          "type": "varchar(50)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "entity_id_a": {
+          "name": "entity_id_a",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "entity_id_b": {
+          "name": "entity_id_b",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reason": {
+          "name": "reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "dismissed_by": {
+          "name": "dismissed_by",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "dismissed_at": {
+          "name": "dismissed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "dismissed_duplicate_pairs_entity_a_idx": {
+          "name": "dismissed_duplicate_pairs_entity_a_idx",
+          "columns": [
+            {
+              "expression": "entity_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "entity_id_a",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "dismissed_duplicate_pairs_entity_b_idx": {
+          "name": "dismissed_duplicate_pairs_entity_b_idx",
+          "columns": [
+            {
+              "expression": "entity_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "entity_id_b",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "dismissed_duplicate_pairs_dismissed_by_users_id_fk": {
+          "name": "dismissed_duplicate_pairs_dismissed_by_users_id_fk",
+          "tableFrom": "dismissed_duplicate_pairs",
+          "tableTo": "users",
+          "columnsFrom": ["dismissed_by"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "dismissed_duplicate_pairs_unique": {
+          "name": "dismissed_duplicate_pairs_unique",
+          "nullsNotDistinct": false,
+          "columns": ["entity_type", "entity_id_a", "entity_id_b"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.dismissed_inline_duplicate_pairs": {
+      "name": "dismissed_inline_duplicate_pairs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "entity_type": {
+          "name": "entity_type",
+          "type": "varchar(50)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "value_a": {
+          "name": "value_a",
+          "type": "varchar(500)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "value_b": {
+          "name": "value_b",
+          "type": "varchar(500)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reason": {
+          "name": "reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "dismissed_by": {
+          "name": "dismissed_by",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "dismissed_at": {
+          "name": "dismissed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "dismissed_inline_pairs_entity_a_idx": {
+          "name": "dismissed_inline_pairs_entity_a_idx",
+          "columns": [
+            {
+              "expression": "entity_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "value_a",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "dismissed_inline_pairs_entity_b_idx": {
+          "name": "dismissed_inline_pairs_entity_b_idx",
+          "columns": [
+            {
+              "expression": "entity_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "value_b",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "dismissed_inline_duplicate_pairs_dismissed_by_users_id_fk": {
+          "name": "dismissed_inline_duplicate_pairs_dismissed_by_users_id_fk",
+          "tableFrom": "dismissed_inline_duplicate_pairs",
+          "tableTo": "users",
+          "columnsFrom": ["dismissed_by"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "dismissed_inline_duplicate_pairs_unique": {
+          "name": "dismissed_inline_duplicate_pairs_unique",
+          "nullsNotDistinct": false,
+          "columns": ["entity_type", "value_a", "value_b"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.entity_duplicate_candidates": {
+      "name": "entity_duplicate_candidates",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "entity_type": {
+          "name": "entity_type",
+          "type": "varchar(50)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "entity_id_a": {
+          "name": "entity_id_a",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "entity_id_b": {
+          "name": "entity_id_b",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "sim_score": {
+          "name": "sim_score",
+          "type": "real",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "computed_at": {
+          "name": "computed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "entity_dup_candidates_type_sim_idx": {
+          "name": "entity_dup_candidates_type_sim_idx",
+          "columns": [
+            {
+              "expression": "entity_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "sim_score",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "entity_dup_candidates_entity_a_idx": {
+          "name": "entity_dup_candidates_entity_a_idx",
+          "columns": [
+            {
+              "expression": "entity_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "entity_id_a",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "entity_dup_candidates_entity_b_idx": {
+          "name": "entity_dup_candidates_entity_b_idx",
+          "columns": [
+            {
+              "expression": "entity_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "entity_id_b",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "entity_duplicate_candidates_unique": {
+          "name": "entity_duplicate_candidates_unique",
+          "nullsNotDistinct": false,
+          "columns": ["entity_type", "entity_id_a", "entity_id_b"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.entity_duplicate_scan_status": {
+      "name": "entity_duplicate_scan_status",
+      "schema": "",
+      "columns": {
+        "entity_type": {
+          "name": "entity_type",
+          "type": "varchar(50)",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "is_computing": {
+          "name": "is_computing",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "computed_at": {
+          "name": "computed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "total_pairs": {
+          "name": "total_pairs",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "threshold": {
+          "name": "threshold",
+          "type": "real",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "processed_count": {
+          "name": "processed_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "total_count": {
+          "name": "total_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_message": {
+          "name": "error_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.server_fonts": {
+      "name": "server_fonts",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "uploaded_by": {
+          "name": "uploaded_by",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "family_name": {
+          "name": "family_name",
+          "type": "varchar(200)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "original_file_name": {
+          "name": "original_file_name",
+          "type": "varchar(500)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stored_file_name": {
+          "name": "stored_file_name",
+          "type": "varchar(500)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "format": {
+          "name": "format",
+          "type": "varchar(10)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "weight": {
+          "name": "weight",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 400
+        },
+        "style": {
+          "name": "style",
+          "type": "varchar(10)",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'normal'"
+        },
+        "weight_min": {
+          "name": "weight_min",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "weight_max": {
+          "name": "weight_max",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "instances": {
+          "name": "instances",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "file_size": {
+          "name": "file_size",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "file_hash": {
+          "name": "file_hash",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "sf_hash_uidx": {
+          "name": "sf_hash_uidx",
+          "columns": [
+            {
+              "expression": "file_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "sf_family_weight_style_uidx": {
+          "name": "sf_family_weight_style_uidx",
+          "columns": [
+            {
+              "expression": "family_name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "weight",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "style",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "server_fonts_uploaded_by_users_id_fk": {
+          "name": "server_fonts_uploaded_by_users_id_fk",
+          "tableFrom": "server_fonts",
+          "tableTo": "users",
+          "columnsFrom": ["uploaded_by"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "server_fonts_format_chk": {
+          "name": "server_fonts_format_chk",
+          "value": "\"server_fonts\".\"format\" in ('ttf', 'otf', 'woff', 'woff2')"
+        },
+        "server_fonts_weight_chk": {
+          "name": "server_fonts_weight_chk",
+          "value": "\"server_fonts\".\"weight\" >= 1 and \"server_fonts\".\"weight\" <= 1000"
+        },
+        "server_fonts_style_chk": {
+          "name": "server_fonts_style_chk",
+          "value": "\"server_fonts\".\"style\" in ('normal', 'italic')"
+        },
+        "server_fonts_weight_range_chk": {
+          "name": "server_fonts_weight_range_chk",
+          "value": "(\"server_fonts\".\"weight_min\" is null) = (\"server_fonts\".\"weight_max\" is null) and (\"server_fonts\".\"weight_min\" is null or (\"server_fonts\".\"weight_min\" >= 1 and \"server_fonts\".\"weight_max\" <= 1000 and \"server_fonts\".\"weight_min\" < \"server_fonts\".\"weight_max\"))"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.user_fonts": {
+      "name": "user_fonts",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "family_name": {
+          "name": "family_name",
+          "type": "varchar(200)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "original_file_name": {
+          "name": "original_file_name",
+          "type": "varchar(500)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stored_file_name": {
+          "name": "stored_file_name",
+          "type": "varchar(500)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "format": {
+          "name": "format",
+          "type": "varchar(10)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "weight": {
+          "name": "weight",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 400
+        },
+        "style": {
+          "name": "style",
+          "type": "varchar(10)",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'normal'"
+        },
+        "weight_min": {
+          "name": "weight_min",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "weight_max": {
+          "name": "weight_max",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "instances": {
+          "name": "instances",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "file_size": {
+          "name": "file_size",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "file_hash": {
+          "name": "file_hash",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "uf_user_hash_uidx": {
+          "name": "uf_user_hash_uidx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "file_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "uf_user_family_weight_style_uidx": {
+          "name": "uf_user_family_weight_style_uidx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "family_name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "weight",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "style",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "user_fonts_user_id_users_id_fk": {
+          "name": "user_fonts_user_id_users_id_fk",
+          "tableFrom": "user_fonts",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "user_fonts_format_chk": {
+          "name": "user_fonts_format_chk",
+          "value": "\"user_fonts\".\"format\" in ('ttf', 'otf', 'woff', 'woff2')"
+        },
+        "user_fonts_weight_chk": {
+          "name": "user_fonts_weight_chk",
+          "value": "\"user_fonts\".\"weight\" >= 1 and \"user_fonts\".\"weight\" <= 1000"
+        },
+        "user_fonts_style_chk": {
+          "name": "user_fonts_style_chk",
+          "value": "\"user_fonts\".\"style\" in ('normal', 'italic')"
+        },
+        "user_fonts_weight_range_chk": {
+          "name": "user_fonts_weight_range_chk",
+          "value": "(\"user_fonts\".\"weight_min\" is null) = (\"user_fonts\".\"weight_max\" is null) and (\"user_fonts\".\"weight_min\" is null or (\"user_fonts\".\"weight_min\" >= 1 and \"user_fonts\".\"weight_max\" <= 1000 and \"user_fonts\".\"weight_min\" < \"user_fonts\".\"weight_max\"))"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.book_file_chapters": {
+      "name": "book_file_chapters",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "book_file_id": {
+          "name": "book_file_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "chapter_index": {
+          "name": "chapter_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "varchar(500)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "href": {
+          "name": "href",
+          "type": "varchar(1000)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "spine_index": {
+          "name": "spine_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "book_file_chapters_book_file_id_chapter_index_uidx": {
+          "name": "book_file_chapters_book_file_id_chapter_index_uidx",
+          "columns": [
+            {
+              "expression": "book_file_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "chapter_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "book_file_chapters_book_file_id_idx": {
+          "name": "book_file_chapters_book_file_id_idx",
+          "columns": [
+            {
+              "expression": "book_file_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "book_file_chapters_book_file_id_book_files_id_fk": {
+          "name": "book_file_chapters_book_file_id_book_files_id_fk",
+          "tableFrom": "book_file_chapters",
+          "tableTo": "book_files",
+          "columnsFrom": ["book_file_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.book_file_hash_history": {
+      "name": "book_file_hash_history",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "book_file_id": {
+          "name": "book_file_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "file_hash": {
+          "name": "file_hash",
+          "type": "varchar(32)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reason": {
+          "name": "reason",
+          "type": "varchar(30)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "book_file_hash_history_book_file_id_file_hash_idx": {
+          "name": "book_file_hash_history_book_file_id_file_hash_idx",
+          "columns": [
+            {
+              "expression": "book_file_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "file_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "book_file_hash_history_file_hash_idx": {
+          "name": "book_file_hash_history_file_hash_idx",
+          "columns": [
+            {
+              "expression": "file_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "book_file_hash_history_book_file_id_book_files_id_fk": {
+          "name": "book_file_hash_history_book_file_id_book_files_id_fk",
+          "tableFrom": "book_file_hash_history",
+          "tableTo": "book_files",
+          "columnsFrom": ["book_file_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "book_file_hash_history_reason_chk": {
+          "name": "book_file_hash_history_reason_chk",
+          "value": "\"book_file_hash_history\".\"reason\" in ('file_write', 'external_change', 'rescan')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.koreader_book_hash_links": {
+      "name": "koreader_book_hash_links",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "hash": {
+          "name": "hash",
+          "type": "varchar(32)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "book_file_id": {
+          "name": "book_file_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "koreader_title": {
+          "name": "koreader_title",
+          "type": "varchar(500)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "koreader_authors": {
+          "name": "koreader_authors",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "koreader_last_open": {
+          "name": "koreader_last_open",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "koreader_book_hash_links_user_hash_uidx": {
+          "name": "koreader_book_hash_links_user_hash_uidx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "koreader_book_hash_links_user_updated_idx": {
+          "name": "koreader_book_hash_links_user_updated_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "\"updated_at\" desc",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "koreader_book_hash_links_book_file_id_idx": {
+          "name": "koreader_book_hash_links_book_file_id_idx",
+          "columns": [
+            {
+              "expression": "book_file_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "koreader_book_hash_links_user_id_users_id_fk": {
+          "name": "koreader_book_hash_links_user_id_users_id_fk",
+          "tableFrom": "koreader_book_hash_links",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "koreader_book_hash_links_book_file_id_book_files_id_fk": {
+          "name": "koreader_book_hash_links_book_file_id_book_files_id_fk",
+          "tableFrom": "koreader_book_hash_links",
+          "tableTo": "book_files",
+          "columnsFrom": ["book_file_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "koreader_book_hash_links_hash_chk": {
+          "name": "koreader_book_hash_links_hash_chk",
+          "value": "\"koreader_book_hash_links\".\"hash\" ~ '^[0-9a-f]{32}$'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.koreader_bookmark_links": {
+      "name": "koreader_bookmark_links",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "bookmark_id": {
+          "name": "bookmark_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "device_id": {
+          "name": "device_id",
+          "type": "varchar(100)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "koreader_key": {
+          "name": "koreader_key",
+          "type": "varchar(32)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "device_datetime": {
+          "name": "device_datetime",
+          "type": "varchar(19)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "applied_at": {
+          "name": "applied_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "koreader_bookmark_links_bookmark_device_uidx": {
+          "name": "koreader_bookmark_links_bookmark_device_uidx",
+          "columns": [
+            {
+              "expression": "bookmark_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "device_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "koreader_bookmark_links_user_device_key_idx": {
+          "name": "koreader_bookmark_links_user_device_key_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "device_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "koreader_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "koreader_bookmark_links_user_device_idx": {
+          "name": "koreader_bookmark_links_user_device_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "device_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "koreader_bookmark_links_bookmark_id_idx": {
+          "name": "koreader_bookmark_links_bookmark_id_idx",
+          "columns": [
+            {
+              "expression": "bookmark_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "koreader_bookmark_links_bookmark_id_bookmarks_id_fk": {
+          "name": "koreader_bookmark_links_bookmark_id_bookmarks_id_fk",
+          "tableFrom": "koreader_bookmark_links",
+          "tableTo": "bookmarks",
+          "columnsFrom": ["bookmark_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "koreader_bookmark_links_user_id_users_id_fk": {
+          "name": "koreader_bookmark_links_user_id_users_id_fk",
+          "tableFrom": "koreader_bookmark_links",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.koreader_device_progress": {
+      "name": "koreader_device_progress",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "book_file_id": {
+          "name": "book_file_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "device": {
+          "name": "device",
+          "type": "varchar(100)",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'KOReader'"
+        },
+        "device_id": {
+          "name": "device_id",
+          "type": "varchar(100)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "percentage": {
+          "name": "percentage",
+          "type": "real",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "progress": {
+          "name": "progress",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "chapter_index": {
+          "name": "chapter_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "sync_timestamp": {
+          "name": "sync_timestamp",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "orphaned": {
+          "name": "orphaned",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "orphaned_hash": {
+          "name": "orphaned_hash",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "koreader_device_progress_book_user_device_uidx": {
+          "name": "koreader_device_progress_book_user_device_uidx",
+          "columns": [
+            {
+              "expression": "book_file_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "device",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "device_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"koreader_device_progress\".\"orphaned\" = false",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "koreader_device_progress_orphaned_hash_idx": {
+          "name": "koreader_device_progress_orphaned_hash_idx",
+          "columns": [
+            {
+              "expression": "orphaned_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"koreader_device_progress\".\"orphaned\" = true",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "koreader_device_progress_user_updated_at_idx": {
+          "name": "koreader_device_progress_user_updated_at_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "koreader_device_progress_book_file_id_idx": {
+          "name": "koreader_device_progress_book_file_id_idx",
+          "columns": [
+            {
+              "expression": "book_file_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"koreader_device_progress\".\"book_file_id\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "koreader_device_progress_book_file_id_book_files_id_fk": {
+          "name": "koreader_device_progress_book_file_id_book_files_id_fk",
+          "tableFrom": "koreader_device_progress",
+          "tableTo": "book_files",
+          "columnsFrom": ["book_file_id"],
+          "columnsTo": ["id"],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "koreader_device_progress_user_id_users_id_fk": {
+          "name": "koreader_device_progress_user_id_users_id_fk",
+          "tableFrom": "koreader_device_progress",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "koreader_device_progress_percentage_range_chk": {
+          "name": "koreader_device_progress_percentage_range_chk",
+          "value": "\"koreader_device_progress\".\"percentage\" is null or (\"koreader_device_progress\".\"percentage\" >= 0 and \"koreader_device_progress\".\"percentage\" <= 1)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.koreader_device_retirements": {
+      "name": "koreader_device_retirements",
+      "schema": "",
+      "columns": {
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "device_id": {
+          "name": "device_id",
+          "type": "varchar(100)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "retired_at": {
+          "name": "retired_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "koreader_device_retirements_user_id_idx": {
+          "name": "koreader_device_retirements_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "koreader_device_retirements_user_id_users_id_fk": {
+          "name": "koreader_device_retirements_user_id_users_id_fk",
+          "tableFrom": "koreader_device_retirements",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "koreader_device_retirements_user_id_device_id_pk": {
+          "name": "koreader_device_retirements_user_id_device_id_pk",
+          "columns": ["user_id", "device_id"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.koreader_device_settings": {
+      "name": "koreader_device_settings",
+      "schema": "",
+      "columns": {
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "device_id": {
+          "name": "device_id",
+          "type": "varchar(100)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "file_naming_pattern": {
+          "name": "file_naming_pattern",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "series_file_naming_pattern": {
+          "name": "series_file_naming_pattern",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "standalone_file_naming_pattern": {
+          "name": "standalone_file_naming_pattern",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "koreader_device_settings_user_id_idx": {
+          "name": "koreader_device_settings_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "koreader_device_settings_user_id_users_id_fk": {
+          "name": "koreader_device_settings_user_id_users_id_fk",
+          "tableFrom": "koreader_device_settings",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "koreader_device_settings_user_id_device_id_pk": {
+          "name": "koreader_device_settings_user_id_device_id_pk",
+          "columns": ["user_id", "device_id"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.koreader_device_sweeps": {
+      "name": "koreader_device_sweeps",
+      "schema": "",
+      "columns": {
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "device_id": {
+          "name": "device_id",
+          "type": "varchar(100)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "device_model": {
+          "name": "device_model",
+          "type": "varchar(100)",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'KOReader'"
+        },
+        "plugin_version": {
+          "name": "plugin_version",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_sweep_at": {
+          "name": "last_sweep_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_sweep_books_matched": {
+          "name": "last_sweep_books_matched",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "last_sweep_page_stats": {
+          "name": "last_sweep_page_stats",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "last_sweep_annotations": {
+          "name": "last_sweep_annotations",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "kds_user_id_idx": {
+          "name": "kds_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "koreader_device_sweeps_user_id_users_id_fk": {
+          "name": "koreader_device_sweeps_user_id_users_id_fk",
+          "tableFrom": "koreader_device_sweeps",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "koreader_device_sweeps_user_id_device_id_pk": {
+          "name": "koreader_device_sweeps_user_id_device_id_pk",
+          "columns": ["user_id", "device_id"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.koreader_page_stats": {
+      "name": "koreader_page_stats",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "book_file_id": {
+          "name": "book_file_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "device_id": {
+          "name": "device_id",
+          "type": "varchar(100)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "page": {
+          "name": "page",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "start_time": {
+          "name": "start_time",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "duration_seconds": {
+          "name": "duration_seconds",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "total_pages": {
+          "name": "total_pages",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "kps_user_file_device_page_start_uidx": {
+          "name": "kps_user_file_device_page_start_uidx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "book_file_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "device_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "page",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "start_time",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "kps_user_file_device_start_idx": {
+          "name": "kps_user_file_device_start_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "book_file_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "device_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "start_time",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "kps_user_id_idx": {
+          "name": "kps_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "koreader_page_stats_book_file_id_idx": {
+          "name": "koreader_page_stats_book_file_id_idx",
+          "columns": [
+            {
+              "expression": "book_file_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "koreader_page_stats_user_id_users_id_fk": {
+          "name": "koreader_page_stats_user_id_users_id_fk",
+          "tableFrom": "koreader_page_stats",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "koreader_page_stats_book_file_id_book_files_id_fk": {
+          "name": "koreader_page_stats_book_file_id_book_files_id_fk",
+          "tableFrom": "koreader_page_stats",
+          "tableTo": "book_files",
+          "columnsFrom": ["book_file_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "koreader_page_stats_duration_nonnegative_chk": {
+          "name": "koreader_page_stats_duration_nonnegative_chk",
+          "value": "\"koreader_page_stats\".\"duration_seconds\" >= 0"
+        },
+        "koreader_page_stats_page_nonnegative_chk": {
+          "name": "koreader_page_stats_page_nonnegative_chk",
+          "value": "\"koreader_page_stats\".\"page\" >= 0"
+        },
+        "koreader_page_stats_total_pages_positive_chk": {
+          "name": "koreader_page_stats_total_pages_positive_chk",
+          "value": "\"koreader_page_stats\".\"total_pages\" > 0"
+        },
+        "koreader_page_stats_start_time_positive_chk": {
+          "name": "koreader_page_stats_start_time_positive_chk",
+          "value": "\"koreader_page_stats\".\"start_time\" > 0"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.koreader_progress_reset_devices": {
+      "name": "koreader_progress_reset_devices",
+      "schema": "",
+      "columns": {
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "book_file_id": {
+          "name": "book_file_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "device_id": {
+          "name": "device_id",
+          "type": "varchar(100)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "converged_at": {
+          "name": "converged_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "koreader_progress_reset_devices_reset_fk": {
+          "name": "koreader_progress_reset_devices_reset_fk",
+          "tableFrom": "koreader_progress_reset_devices",
+          "tableTo": "koreader_progress_resets",
+          "columnsFrom": ["user_id", "book_file_id"],
+          "columnsTo": ["user_id", "book_file_id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "koreader_progress_reset_devices_user_id_book_file_id_device_id_pk": {
+          "name": "koreader_progress_reset_devices_user_id_book_file_id_device_id_pk",
+          "columns": ["user_id", "book_file_id", "device_id"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.koreader_progress_resets": {
+      "name": "koreader_progress_resets",
+      "schema": "",
+      "columns": {
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "book_file_id": {
+          "name": "book_file_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reset_at": {
+          "name": "reset_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "koreader_progress_resets_book_file_id_idx": {
+          "name": "koreader_progress_resets_book_file_id_idx",
+          "columns": [
+            {
+              "expression": "book_file_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "koreader_progress_resets_user_id_users_id_fk": {
+          "name": "koreader_progress_resets_user_id_users_id_fk",
+          "tableFrom": "koreader_progress_resets",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "koreader_progress_resets_book_file_id_book_files_id_fk": {
+          "name": "koreader_progress_resets_book_file_id_book_files_id_fk",
+          "tableFrom": "koreader_progress_resets",
+          "tableTo": "book_files",
+          "columnsFrom": ["book_file_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "koreader_progress_resets_user_id_book_file_id_pk": {
+          "name": "koreader_progress_resets_user_id_book_file_id_pk",
+          "columns": ["user_id", "book_file_id"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.koreader_unmatched_book_devices": {
+      "name": "koreader_unmatched_book_devices",
+      "schema": "",
+      "columns": {
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "hash": {
+          "name": "hash",
+          "type": "varchar(32)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "device_id": {
+          "name": "device_id",
+          "type": "varchar(100)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_seen_at": {
+          "name": "last_seen_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "koreader_unmatched_book_devices_user_device_idx": {
+          "name": "koreader_unmatched_book_devices_user_device_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "device_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "koreader_unmatched_book_devices_user_id_users_id_fk": {
+          "name": "koreader_unmatched_book_devices_user_id_users_id_fk",
+          "tableFrom": "koreader_unmatched_book_devices",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "koreader_unmatched_book_devices_user_hash_fk": {
+          "name": "koreader_unmatched_book_devices_user_hash_fk",
+          "tableFrom": "koreader_unmatched_book_devices",
+          "tableTo": "koreader_unmatched_books",
+          "columnsFrom": ["user_id", "hash"],
+          "columnsTo": ["user_id", "hash"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "koreader_unmatched_book_devices_user_id_hash_device_id_pk": {
+          "name": "koreader_unmatched_book_devices_user_id_hash_device_id_pk",
+          "columns": ["user_id", "hash", "device_id"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "koreader_unmatched_book_devices_hash_chk": {
+          "name": "koreader_unmatched_book_devices_hash_chk",
+          "value": "\"koreader_unmatched_book_devices\".\"hash\" ~ '^[0-9a-f]{32}$'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.koreader_unmatched_books": {
+      "name": "koreader_unmatched_books",
+      "schema": "",
+      "columns": {
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "hash": {
+          "name": "hash",
+          "type": "varchar(32)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "varchar(500)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "authors": {
+          "name": "authors",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_open": {
+          "name": "last_open",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source": {
+          "name": "source",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'statistics'"
+        },
+        "metadata_ambiguous": {
+          "name": "metadata_ambiguous",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "first_seen_at": {
+          "name": "first_seen_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "last_seen_at": {
+          "name": "last_seen_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "koreader_unmatched_books_user_seen_idx": {
+          "name": "koreader_unmatched_books_user_seen_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "\"last_seen_at\" desc",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "koreader_unmatched_books_user_id_users_id_fk": {
+          "name": "koreader_unmatched_books_user_id_users_id_fk",
+          "tableFrom": "koreader_unmatched_books",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "koreader_unmatched_books_user_id_hash_pk": {
+          "name": "koreader_unmatched_books_user_id_hash_pk",
+          "columns": ["user_id", "hash"]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "koreader_unmatched_books_hash_chk": {
+          "name": "koreader_unmatched_books_hash_chk",
+          "value": "\"koreader_unmatched_books\".\"hash\" ~ '^[0-9a-f]{32}$'"
+        },
+        "koreader_unmatched_books_source_chk": {
+          "name": "koreader_unmatched_books_source_chk",
+          "value": "\"koreader_unmatched_books\".\"source\" in ('current_file', 'file', 'statistics')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.koreader_user_settings": {
+      "name": "koreader_user_settings",
+      "schema": "",
+      "columns": {
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "default_file_naming_pattern": {
+          "name": "default_file_naming_pattern",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "koreader_user_settings_user_id_users_id_fk": {
+          "name": "koreader_user_settings_user_id_users_id_fk",
+          "tableFrom": "koreader_user_settings",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.koreader_users": {
+      "name": "koreader_users",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "username": {
+          "name": "username",
+          "type": "varchar(100)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "password_hash": {
+          "name": "password_hash",
+          "type": "varchar(255)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "password_md5": {
+          "name": "password_md5",
+          "type": "varchar(32)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "sync_enabled": {
+          "name": "sync_enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "koreader_users_user_id_uidx": {
+          "name": "koreader_users_user_id_uidx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "koreader_users_username_uidx": {
+          "name": "koreader_users_username_uidx",
+          "columns": [
+            {
+              "expression": "username",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "koreader_users_user_id_users_id_fk": {
+          "name": "koreader_users_user_id_users_id_fk",
+          "tableFrom": "koreader_users",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.achievements": {
+      "name": "achievements",
+      "schema": "",
+      "columns": {
+        "key": {
+          "name": "key",
+          "type": "varchar(64)",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "group_key": {
+          "name": "group_key",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tier": {
+          "name": "tier",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "category": {
+          "name": "category",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "varchar(100)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "varchar(500)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "icon_name": {
+          "name": "icon_name",
+          "type": "varchar(50)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "rarity": {
+          "name": "rarity",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "threshold": {
+          "name": "threshold",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "hidden": {
+          "name": "hidden",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "sort_order": {
+          "name": "sort_order",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "achievements_category_sort_idx": {
+          "name": "achievements_category_sort_idx",
+          "columns": [
+            {
+              "expression": "category",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "sort_order",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "achievements_group_key_idx": {
+          "name": "achievements_group_key_idx",
+          "columns": [
+            {
+              "expression": "group_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "achievements_category_chk": {
+          "name": "achievements_category_chk",
+          "value": "\"achievements\".\"category\" in ('reading', 'library', 'exploration', 'dedication', 'devices')"
+        },
+        "achievements_rarity_chk": {
+          "name": "achievements_rarity_chk",
+          "value": "\"achievements\".\"rarity\" in ('common', 'rare', 'epic', 'legendary')"
+        },
+        "achievements_tier_chk": {
+          "name": "achievements_tier_chk",
+          "value": "\"achievements\".\"tier\" is null or (\"achievements\".\"tier\" >= 1 and \"achievements\".\"tier\" <= 4)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.user_achievements": {
+      "name": "user_achievements",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "achievement_key": {
+          "name": "achievement_key",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "awarded_at": {
+          "name": "awarded_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "context_json": {
+          "name": "context_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "user_achievements_user_key_uidx": {
+          "name": "user_achievements_user_key_uidx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "achievement_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_achievements_user_id_idx": {
+          "name": "user_achievements_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_achievements_user_awarded_at_idx": {
+          "name": "user_achievements_user_awarded_at_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "awarded_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "user_achievements_user_id_users_id_fk": {
+          "name": "user_achievements_user_id_users_id_fk",
+          "tableFrom": "user_achievements",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "user_achievements_achievement_key_achievements_key_fk": {
+          "name": "user_achievements_achievement_key_achievements_key_fk",
+          "tableFrom": "user_achievements",
+          "tableTo": "achievements",
+          "columnsFrom": ["achievement_key"],
+          "columnsTo": ["key"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.hardcover_book_state": {
+      "name": "hardcover_book_state",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "book_id": {
+          "name": "book_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "hardcover_book_id": {
+          "name": "hardcover_book_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "hardcover_edition_id": {
+          "name": "hardcover_edition_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "hardcover_user_book_id": {
+          "name": "hardcover_user_book_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "hardcover_read_id": {
+          "name": "hardcover_read_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "match_method": {
+          "name": "match_method",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "match_error": {
+          "name": "match_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_synced_at": {
+          "name": "last_synced_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_synced_status": {
+          "name": "last_synced_status",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_synced_progress": {
+          "name": "last_synced_progress",
+          "type": "real",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_synced_rating": {
+          "name": "last_synced_rating",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_synced_started_at": {
+          "name": "last_synced_started_at",
+          "type": "varchar(10)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_synced_finished_at": {
+          "name": "last_synced_finished_at",
+          "type": "varchar(10)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "sync_error": {
+          "name": "sync_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "sync_override": {
+          "name": "sync_override",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "sync_excluded": {
+          "name": "sync_excluded",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "hardcover_book_state_book_id_idx": {
+          "name": "hardcover_book_state_book_id_idx",
+          "columns": [
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "hardcover_book_state_user_id_users_id_fk": {
+          "name": "hardcover_book_state_user_id_users_id_fk",
+          "tableFrom": "hardcover_book_state",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "hardcover_book_state_book_id_books_id_fk": {
+          "name": "hardcover_book_state_book_id_books_id_fk",
+          "tableFrom": "hardcover_book_state",
+          "tableTo": "books",
+          "columnsFrom": ["book_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "hardcover_book_state_user_book_uidx": {
+          "name": "hardcover_book_state_user_book_uidx",
+          "nullsNotDistinct": false,
+          "columns": ["user_id", "book_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.hardcover_user_settings": {
+      "name": "hardcover_user_settings",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "api_token": {
+          "name": "api_token",
+          "type": "varchar(2048)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "book_sync_mode": {
+          "name": "book_sync_mode",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'all_eligible'"
+        },
+        "auto_sync_on_status_change": {
+          "name": "auto_sync_on_status_change",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "auto_sync_on_progress_update": {
+          "name": "auto_sync_on_progress_update",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "auto_sync_on_rating_change": {
+          "name": "auto_sync_on_rating_change",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "privacy_setting_id": {
+          "name": "privacy_setting_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 3
+        },
+        "last_synced_at": {
+          "name": "last_synced_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "hardcover_user_settings_user_id_users_id_fk": {
+          "name": "hardcover_user_settings_user_id_users_id_fk",
+          "tableFrom": "hardcover_user_settings",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "hardcover_user_settings_user_id_unique": {
+          "name": "hardcover_user_settings_user_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["user_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.readwise_user_settings": {
+      "name": "readwise_user_settings",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "api_token": {
+          "name": "api_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "last_synced_annotation_id": {
+          "name": "last_synced_annotation_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "disabled_reason": {
+          "name": "disabled_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_synced_at": {
+          "name": "last_synced_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "readwise_user_settings_user_id_users_id_fk": {
+          "name": "readwise_user_settings_user_id_users_id_fk",
+          "tableFrom": "readwise_user_settings",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "readwise_user_settings_user_id_unique": {
+          "name": "readwise_user_settings_user_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["user_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.storygraph_book_state": {
+      "name": "storygraph_book_state",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "book_id": {
+          "name": "book_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "storygraph_book_id": {
+          "name": "storygraph_book_id",
+          "type": "varchar(64)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "match_method": {
+          "name": "match_method",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "match_error": {
+          "name": "match_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_synced_at": {
+          "name": "last_synced_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_synced_status": {
+          "name": "last_synced_status",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_synced_progress": {
+          "name": "last_synced_progress",
+          "type": "real",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "sync_error": {
+          "name": "sync_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "sync_override": {
+          "name": "sync_override",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "storygraph_book_state_book_id_idx": {
+          "name": "storygraph_book_state_book_id_idx",
+          "columns": [
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "storygraph_book_state_user_sync_override_idx": {
+          "name": "storygraph_book_state_user_sync_override_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "sync_override",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "storygraph_book_state_user_sync_error_idx": {
+          "name": "storygraph_book_state_user_sync_error_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "book_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"storygraph_book_state\".\"sync_error\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "storygraph_book_state_user_id_users_id_fk": {
+          "name": "storygraph_book_state_user_id_users_id_fk",
+          "tableFrom": "storygraph_book_state",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "storygraph_book_state_book_id_books_id_fk": {
+          "name": "storygraph_book_state_book_id_books_id_fk",
+          "tableFrom": "storygraph_book_state",
+          "tableTo": "books",
+          "columnsFrom": ["book_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "storygraph_book_state_user_book_uidx": {
+          "name": "storygraph_book_state_user_book_uidx",
+          "nullsNotDistinct": false,
+          "columns": ["user_id", "book_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.storygraph_user_settings": {
+      "name": "storygraph_user_settings",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "session_cookie": {
+          "name": "session_cookie",
+          "type": "varchar(4096)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "remember_token": {
+          "name": "remember_token",
+          "type": "varchar(4096)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "book_sync_mode": {
+          "name": "book_sync_mode",
+          "type": "varchar(20)",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'all_eligible'"
+        },
+        "auto_sync_on_status_change": {
+          "name": "auto_sync_on_status_change",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "auto_sync_on_progress_update": {
+          "name": "auto_sync_on_progress_update",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "last_synced_at": {
+          "name": "last_synced_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "storygraph_user_settings_user_id_users_id_fk": {
+          "name": "storygraph_user_settings_user_id_users_id_fk",
+          "tableFrom": "storygraph_user_settings",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "storygraph_user_settings_user_id_unique": {
+          "name": "storygraph_user_settings_user_id_unique",
+          "nullsNotDistinct": false,
+          "columns": ["user_id"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.shared_reading_insight_view_sessions": {
+      "name": "shared_reading_insight_view_sessions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "viewer_user_id": {
+          "name": "viewer_user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subject_user_id": {
+          "name": "subject_user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "sharing_level": {
+          "name": "sharing_level",
+          "type": "reading_insights_sharing_level",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "shared_insight_view_subject_created_idx": {
+          "name": "shared_insight_view_subject_created_idx",
+          "columns": [
+            {
+              "expression": "subject_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "shared_insight_view_expires_idx": {
+          "name": "shared_insight_view_expires_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "shared_reading_insight_view_sessions_viewer_user_id_users_id_fk": {
+          "name": "shared_reading_insight_view_sessions_viewer_user_id_users_id_fk",
+          "tableFrom": "shared_reading_insight_view_sessions",
+          "tableTo": "users",
+          "columnsFrom": ["viewer_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "shared_reading_insight_view_sessions_subject_user_id_users_id_fk": {
+          "name": "shared_reading_insight_view_sessions_subject_user_id_users_id_fk",
+          "tableFrom": "shared_reading_insight_view_sessions",
+          "tableTo": "users",
+          "columnsFrom": ["subject_user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.user_preferences": {
+      "name": "user_preferences",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "serial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "category": {
+          "name": "category",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "data": {
+          "name": "data",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "up_user_category_idx": {
+          "name": "up_user_category_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "category",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "user_preferences_user_id_users_id_fk": {
+          "name": "user_preferences_user_id_users_id_fk",
+          "tableFrom": "user_preferences",
+          "tableTo": "users",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    }
+  },
+  "enums": {
+    "public.content_filter_type": {
+      "name": "content_filter_type",
+      "schema": "public",
+      "values": ["include", "exclude"]
+    },
+    "public.library_access_level": {
+      "name": "library_access_level",
+      "schema": "public",
+      "values": ["viewer", "editor", "owner"]
+    },
+    "public.reading_insights_sharing_level": {
+      "name": "reading_insights_sharing_level",
+      "schema": "public",
+      "values": ["private", "summary", "detailed"]
+    },
+    "public.user_avatar_source": {
+      "name": "user_avatar_source",
+      "schema": "public",
+      "values": ["none", "external", "uploaded"]
+    },
+    "public.opds_sort_order": {
+      "name": "opds_sort_order",
+      "schema": "public",
+      "values": ["recent", "title_asc", "title_desc", "author_asc", "author_desc", "series_asc", "series_desc"]
+    },
+    "public.book_request_media_kind": {
+      "name": "book_request_media_kind",
+      "schema": "public",
+      "values": ["ebook", "audiobook", "comic"]
+    }
+  },
+  "schemas": {},
+  "sequences": {},
+  "roles": {},
+  "policies": {},
+  "views": {},
+  "_meta": {
+    "columns": {},
+    "schemas": {},
+    "tables": {}
+  }
+}
diff --git a/server/src/db/migrations/meta/_journal.json b/server/src/db/migrations/meta/_journal.json
index 8eda46bf7..9a6b0d67a 100644
--- a/server/src/db/migrations/meta/_journal.json
+++ b/server/src/db/migrations/meta/_journal.json
@@ -582,6 +582,13 @@
       "when": 1788151243360,
       "tag": "0082_add_community_rating_count_filter_indexes",
       "breakpoints": true
+    },
+    {
+      "idx": 83,
+      "version": "7",
+      "when": 1788194498208,
+      "tag": "0083_add_book_requests",
+      "breakpoints": true
     }
   ]
 }
diff --git a/server/src/db/schema/auth.ts b/server/src/db/schema/auth.ts
index 02d24712b..fa1ab9cff 100644
--- a/server/src/db/schema/auth.ts
+++ b/server/src/db/schema/auth.ts
@@ -44,6 +44,12 @@ export const users = pgTable(
     provisioningMethod: varchar('provisioning_method', { length: 20 }).notNull().default('local'),
     lastLoginAt: timestamp('last_login_at', { withTimezone: true }),
     lastAuthenticatedAt: timestamp('last_authenticated_at', { withTimezone: true }),
+    /**
+     * Lets a book that fulfilled this user's own request through their content filters. Off by
+     * default and settable only by an administrator, because for anyone without filters it is a
+     * no-op, and everyone it does affect is somebody an operator deliberately restricted.
+     */
+    seeOwnRequestedBooks: boolean('see_own_requested_books').notNull().default(false),
     readingInsightsSharingLevel: readingInsightsSharingLevelEnum('reading_insights_sharing_level').notNull().default('private'),
     readingInsightsConsentedAt: timestamp('reading_insights_consented_at', { withTimezone: true }),
     createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
diff --git a/server/src/db/schema/book-dock.ts b/server/src/db/schema/book-dock.ts
index c8273683e..bec757244 100644
--- a/server/src/db/schema/book-dock.ts
+++ b/server/src/db/schema/book-dock.ts
@@ -1,5 +1,5 @@
 import { sql } from 'drizzle-orm';
-import { bigint, check, index, integer, jsonb, pgTable, serial, text, timestamp, varchar } from 'drizzle-orm/pg-core';
+import { bigint, boolean, check, index, integer, jsonb, pgTable, serial, text, timestamp, varchar } from 'drizzle-orm/pg-core';
 import type { BookDockMetadata } from '@bookorbit/types';
 
 import { libraries, libraryFolders } from './libraries';
@@ -13,6 +13,19 @@ export const bookDockFiles = pgTable(
     absolutePath: text('absolute_path').notNull().unique(),
     fileSize: bigint('file_size', { mode: 'number' }),
     format: varchar('format', { length: 20 }),
+    /**
+     * Set when this row owns a directory of files rather than a single loose one. The row's own
+     * `absolutePath`, `format` and `fileSize` keep describing the unit's **primary** file, because
+     * metadata and cover extraction on a 31-track audiobook should read exactly one of them.
+     *
+     * Null is today's loose single file, which is why existing rows need no migration. Non-null
+     * also means the watcher must not descend into that directory: the row claimed it before it
+     * existed on disk, precisely so the watcher cannot win the race.
+     *
+     * Always exactly one level below the dock root, which is what keeps the watcher's claim check
+     * an equality lookup rather than an ancestor walk.
+     */
+    unitDirectory: text('unit_directory').unique(),
     status: varchar('status', { length: 20 }).notNull().default('pending'),
     embeddedMetadata: jsonb('embedded_metadata').$type<BookDockMetadata>(),
     selectedMetadata: jsonb('selected_metadata').$type<BookDockMetadata>(),
@@ -25,6 +38,12 @@ export const bookDockFiles = pgTable(
     errorMessage: text('error_message'),
     metadataEditedAt: timestamp('metadata_edited_at', { withTimezone: true }),
     uploadedBy: integer('uploaded_by').references(() => users.id, { onDelete: 'set null' }),
+    /**
+     * Another module owns finalization for this row and will call it explicitly once its own
+     * checks pass. Generic auto-finalize skips it so the two paths never race for the same file.
+     * The dock deliberately does not learn which module, only that it is not its call to make.
+     */
+    autoFinalizeSuppressed: boolean('auto_finalize_suppressed').notNull().default(false),
     createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp('updated_at', { withTimezone: true })
       .notNull()
@@ -42,3 +61,34 @@ export const bookDockFiles = pgTable(
 
 export type BookDockFileRow = typeof bookDockFiles.$inferSelect;
 export type NewBookDockFileRow = typeof bookDockFiles.$inferInsert;
+
+/**
+ * The files a dock unit is made of, in playback or format order. Holds **every** file including
+ * the primary, so the primary's path appears here and on the anchor row too. That duplication is
+ * the cheaper half of the trade: placement, rollback, discard and delete iterate one list rather
+ * than a union, and the anchor stays a plain "which file do I read metadata from" pointer.
+ */
+export const bookDockUnitFiles = pgTable(
+  'book_dock_unit_files',
+  {
+    id: serial('id').primaryKey(),
+    dockFileId: integer('dock_file_id')
+      .notNull()
+      .references(() => bookDockFiles.id, { onDelete: 'cascade' }),
+    absolutePath: text('absolute_path').notNull().unique(),
+    fileName: varchar('file_name', { length: 500 }).notNull(),
+    fileSize: bigint('file_size', { mode: 'number' }),
+    format: varchar('format', { length: 20 }),
+    role: varchar('role', { length: 20 }).notNull().default('content'),
+    /** Content files only. Natural order within the unit, so track 10 follows track 9. */
+    sortOrder: integer('sort_order'),
+    createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+  },
+  (t) => [
+    index('book_dock_unit_files_dock_file_id_sort_order_idx').on(t.dockFileId, t.sortOrder),
+    check('book_dock_unit_files_role_chk', sql`${t.role} in ('content', 'cover', 'metadata', 'supplement')`),
+  ],
+);
+
+export type BookDockUnitFileRow = typeof bookDockUnitFiles.$inferSelect;
+export type NewBookDockUnitFileRow = typeof bookDockUnitFiles.$inferInsert;
diff --git a/server/src/db/schema/book-requests.schema.test.ts b/server/src/db/schema/book-requests.schema.test.ts
new file mode 100644
index 000000000..56e37d0f8
--- /dev/null
+++ b/server/src/db/schema/book-requests.schema.test.ts
@@ -0,0 +1,55 @@
+import { PgDialect, getTableConfig } from 'drizzle-orm/pg-core';
+import { ACTIVE_BOOK_REQUEST_STATUSES, BOOK_REQUEST_MEDIA_KINDS, BOOK_REQUEST_STATUSES } from '@bookorbit/types';
+
+import { bookRequests } from './book-requests';
+
+const dialect = new PgDialect();
+
+function toSql(value: Parameters<PgDialect['sqlToQuery']>[0]): string {
+  return dialect.sqlToQuery(value).sql;
+}
+
+/**
+ * The CHECK body and the partial index predicate are hand-written literal SQL, because both need
+ * literals and `sql.raw()` cannot run at import time here (see the note in `book-requests.ts`).
+ * These tests are what stop that hand-written SQL drifting away from the shared constants.
+ */
+describe('book_requests status SQL matches the shared constants', () => {
+  const config = getTableConfig(bookRequests);
+
+  it('accepts exactly the statuses declared in @bookorbit/types', () => {
+    const check = config.checks.find((c) => c.name === 'book_requests_status_chk');
+    expect(check).toBeDefined();
+
+    const quoted = [...toSql(check!.value).matchAll(/'([a-z_]+)'/g)].map((match) => match[1]);
+    expect(quoted.sort()).toEqual([...BOOK_REQUEST_STATUSES].sort());
+  });
+
+  it('scopes the dedupe unique index to exactly the active statuses', () => {
+    const index = config.indexes.find((i) => i.config.name === 'book_requests_active_dedupe_key_uidx');
+    expect(index).toBeDefined();
+    expect(index!.config.unique).toBe(true);
+
+    const predicate = index!.config.where;
+    expect(predicate).toBeDefined();
+
+    const quoted = [...toSql(predicate!).matchAll(/'([a-z_]+)'/g)].map((match) => match[1]);
+    expect(quoted.sort()).toEqual([...ACTIVE_BOOK_REQUEST_STATUSES].sort());
+  });
+
+  it('keeps every active status inside the full status set', () => {
+    for (const status of ACTIVE_BOOK_REQUEST_STATUSES) {
+      expect(BOOK_REQUEST_STATUSES).toContain(status);
+    }
+  });
+
+  it('leaves settled statuses out of the active set, so a book can be requested again', () => {
+    for (const status of ['rejected', 'cancelled', 'available', 'failed'] as const) {
+      expect(ACTIVE_BOOK_REQUEST_STATUSES).not.toContain(status);
+    }
+  });
+
+  it('declares the media kind enum from the shared constant', () => {
+    expect(config.columns.find((c) => c.name === 'media_kind')?.enumValues).toEqual([...BOOK_REQUEST_MEDIA_KINDS]);
+  });
+});
diff --git a/server/src/db/schema/book-requests.ts b/server/src/db/schema/book-requests.ts
new file mode 100644
index 000000000..06ac370f8
--- /dev/null
+++ b/server/src/db/schema/book-requests.ts
@@ -0,0 +1,217 @@
+import { sql } from 'drizzle-orm';
+import {
+  boolean,
+  check,
+  index,
+  integer,
+  jsonb,
+  pgEnum,
+  pgTable,
+  primaryKey,
+  serial,
+  text,
+  timestamp,
+  uniqueIndex,
+  varchar,
+} from 'drizzle-orm/pg-core';
+import { BOOK_REQUEST_MEDIA_KINDS } from '@bookorbit/types';
+import type { BookRequestMetadataSource } from '@bookorbit/types';
+
+import { books } from './books';
+import { bookDockFiles } from './book-dock';
+import { libraries, libraryFolders } from './libraries';
+import { users } from './auth';
+
+export const bookRequestMediaKindEnum = pgEnum('book_request_media_kind', BOOK_REQUEST_MEDIA_KINDS);
+
+/**
+ * Status lists are spelled out rather than interpolated from the shared constants. A CHECK body
+ * and an index predicate need literal SQL, and `sql.raw()` would run at import time - which some
+ * repository tests cannot survive, because they mock `drizzle-orm` down to the few helpers they
+ * use. `book-requests.schema.test.ts` asserts both lists still match `@bookorbit/types`.
+ */
+
+export const bookRequests = pgTable(
+  'book_requests',
+  {
+    id: serial('id').primaryKey(),
+    userId: integer('user_id')
+      .notNull()
+      .references(() => users.id, { onDelete: 'cascade' }),
+    mediaKind: bookRequestMediaKindEnum('media_kind').notNull(),
+    status: varchar('status', { length: 20 }).notNull().default('pending'),
+
+    title: varchar('title', { length: 500 }).notNull(),
+    subtitle: varchar('subtitle', { length: 500 }),
+    authors: jsonb('authors').$type<string[]>().notNull().default([]),
+    seriesName: varchar('series_name', { length: 500 }),
+    seriesIndex: integer('series_index'),
+    isbn10: varchar('isbn10', { length: 20 }),
+    isbn13: varchar('isbn13', { length: 20 }),
+    publishedYear: integer('published_year'),
+    language: varchar('language', { length: 20 }),
+    coverUrl: text('cover_url'),
+    providerKey: varchar('provider_key', { length: 50 }),
+    providerId: varchar('provider_id', { length: 255 }),
+    metadataSources: jsonb('metadata_sources').$type<BookRequestMetadataSource[]>().notNull().default([]),
+
+    preferredFormats: jsonb('preferred_formats').$type<string[]>().notNull().default([]),
+    note: text('note'),
+
+    targetLibraryId: integer('target_library_id').references(() => libraries.id, { onDelete: 'set null' }),
+    targetFolderId: integer('target_folder_id').references(() => libraryFolders.id, { onDelete: 'set null' }),
+
+    /**
+     * The account that filed this on the requester's behalf, when one did.
+     *
+     * Null on every request somebody made themselves, which is nearly all of them. Set only when an
+     * integration holding `manage_book_requests` named a different requester, so the row itself can
+     * answer why somebody has a request they do not remember making.
+     *
+     * Not left to the audit log, which records the same fact against a retention window: a request
+     * outlives its audit row, and the answer has to still be there when it is asked.
+     *
+     * Set null on delete rather than cascade: retiring the integration account must not delete the
+     * requests it filed for other people.
+     */
+    createdByUserId: integer('created_by_user_id').references(() => users.id, { onDelete: 'set null' }),
+
+    decidedByUserId: integer('decided_by_user_id').references(() => users.id, { onDelete: 'set null' }),
+    decidedAt: timestamp('decided_at', { withTimezone: true }),
+    decisionNote: text('decision_note'),
+
+    matchedBookId: integer('matched_book_id').references(() => books.id, { onDelete: 'set null' }),
+    bookDockFileId: integer('book_dock_file_id').references(() => bookDockFiles.id, { onDelete: 'set null' }),
+    statusReason: text('status_reason'),
+    /**
+     * The classified form of `statusReason`, so the UI can translate it. Null wherever a failure
+     * was never classified, which is every path except automation handing a request back.
+     */
+    failureCode: varchar('failure_code', { length: 50 }),
+    failureMeta: jsonb('failure_meta').$type<Record<string, string | number>>(),
+
+    /**
+     * Created by somebody fulfilling it themselves. Badged in the queue and never waiting on a
+     * decision, so it reads very differently from an ordinary request.
+     */
+    selfServe: boolean('self_serve').notNull().default(false),
+
+    /**
+     * Who may drive fulfilment, when that is somebody other than the requester.
+     *
+     * One live request per work, so a self-fulfiller whose own submission collides with somebody
+     * else's undriven request has to be able to take that row on rather than be subscribed to work
+     * they cannot act on. Null on every request nobody has claimed, and on self-serve rows created
+     * before this column existed, where the requester is the fulfiller by construction.
+     *
+     * Set null on delete rather than cascade: losing the fulfiller must not take the requester's
+     * request with it, and clearing the column hands it back to them and to the moderators.
+     */
+    fulfillerUserId: integer('fulfiller_user_id').references(() => users.id, { onDelete: 'set null' }),
+
+    dedupeKey: varchar('dedupe_key', { length: 500 }).notNull(),
+
+    createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp('updated_at', { withTimezone: true })
+      .notNull()
+      .defaultNow()
+      .$onUpdateFn(() => new Date()),
+  },
+  (t) => [
+    index('book_requests_user_status_idx').on(t.userId, t.status),
+    index('book_requests_status_created_at_idx').on(t.status, t.createdAt),
+    index('book_requests_target_library_id_idx').on(t.targetLibraryId),
+    // The two orders the queue can be sorted into. `created_at` alone rather than only alongside
+    // status, because the default list has no status filter on it.
+    index('book_requests_created_at_idx').on(t.createdAt),
+    index('book_requests_title_idx').on(t.title),
+    // Drives the content-filter exemption, which asks "did this user request this book" once per
+    // candidate row while a restricted reader browses. Partial because only fulfilled requests
+    // carry a matched book, so at library scale the index stays a fraction of the table.
+    index('book_requests_matched_book_user_idx')
+      .on(t.matchedBookId, t.userId)
+      .where(sql`${t.matchedBookId} is not null`),
+    // Partial on purpose. The sweeper asks for self-serve rows of a given status and age every ten
+    // minutes, which is selective enough to scan a long way at library scale without it, and the
+    // predicate keeps every ordinary request out of the index entirely.
+    index('book_requests_self_serve_idx')
+      .on(t.selfServe, t.status, t.createdAt)
+      .where(sql`${t.selfServe}`),
+    // One live claim per work. A second requester is attached as a subscriber instead, which is
+    // what keeps two people wanting the same book from becoming two grabs of the same torrent.
+    uniqueIndex('book_requests_active_dedupe_key_uidx')
+      .on(t.dedupeKey)
+      .where(sql`${t.status} in ('pending', 'approved', 'searching', 'grabbed', 'downloading', 'importing', 'needs_review')`),
+    check(
+      'book_requests_status_chk',
+      sql`${t.status} in ('pending', 'approved', 'rejected', 'cancelled', 'searching', 'grabbed', 'downloading', 'importing', 'needs_review', 'available', 'failed')`,
+    ),
+    check('book_requests_series_index_nonnegative_chk', sql`${t.seriesIndex} is null or ${t.seriesIndex} >= 0`),
+  ],
+);
+
+/**
+ * Every key a request's work could have hashed to, not only the one it was filed under.
+ *
+ * A row stores one `dedupeKey`, the most specific one available, and the unique index enforces one
+ * live claim on it. That is enough when two people reach a book the same way, and not enough when
+ * they do not: a request keyed `isbn13:...` never collides with a free-text one keyed
+ * `work:title:author:ebook`, so the same book gets requested twice and grabbed twice.
+ *
+ * These aliases improve *detection*, and deliberately do not try to become the constraint. A
+ * partial unique index cannot reference another table's status column, so the hard guard stays on
+ * `book_requests.dedupe_key` and this narrows the window rather than closing it. Free-text
+ * identity is weak by nature; the form also shows the requester what it found before they commit.
+ */
+export const bookRequestDedupeAliases = pgTable(
+  'book_request_dedupe_aliases',
+  {
+    requestId: integer('request_id')
+      .notNull()
+      .references(() => bookRequests.id, { onDelete: 'cascade' }),
+    dedupeKey: varchar('dedupe_key', { length: 500 }).notNull(),
+  },
+  (t) => [
+    primaryKey({ columns: [t.requestId, t.dedupeKey] }),
+    // The lookup direction: given a handful of candidate keys, which live request already holds one.
+    index('book_request_dedupe_aliases_key_idx').on(t.dedupeKey),
+  ],
+);
+
+export type BookRequestDedupeAliasRow = typeof bookRequestDedupeAliases.$inferSelect;
+
+export const bookRequestSubscribers = pgTable(
+  'book_request_subscribers',
+  {
+    requestId: integer('request_id')
+      .notNull()
+      .references(() => bookRequests.id, { onDelete: 'cascade' }),
+    userId: integer('user_id')
+      .notNull()
+      .references(() => users.id, { onDelete: 'cascade' }),
+    createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+  },
+  (t) => [primaryKey({ columns: [t.requestId, t.userId] }), index('book_request_subscribers_user_id_idx').on(t.userId)],
+);
+
+/**
+ * "Stop showing me this." Personal rather than a column on the request, because a request has a
+ * requester, a set of subscribers and an approver queue looking at the same row, and one of them
+ * tidying their own list must not take it off anybody else's.
+ */
+export const bookRequestDismissals = pgTable(
+  'book_request_dismissals',
+  {
+    requestId: integer('request_id')
+      .notNull()
+      .references(() => bookRequests.id, { onDelete: 'cascade' }),
+    userId: integer('user_id')
+      .notNull()
+      .references(() => users.id, { onDelete: 'cascade' }),
+    createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+  },
+  (t) => [primaryKey({ columns: [t.requestId, t.userId] }), index('book_request_dismissals_user_id_idx').on(t.userId)],
+);
+
+export type BookRequestRow = typeof bookRequests.$inferSelect;
+export type NewBookRequestRow = typeof bookRequests.$inferInsert;
diff --git a/server/src/db/schema/download-clients.schema.test.ts b/server/src/db/schema/download-clients.schema.test.ts
new file mode 100644
index 000000000..120522621
--- /dev/null
+++ b/server/src/db/schema/download-clients.schema.test.ts
@@ -0,0 +1,52 @@
+import { PgDialect, getTableConfig } from 'drizzle-orm/pg-core';
+import { BOOK_REQUEST_DOWNLOAD_SOURCES, BOOK_REQUEST_DOWNLOAD_STATUSES, DOWNLOAD_CLIENT_TYPES } from '@bookorbit/types';
+
+import { bookRequestDownloads, downloadClients } from './download-clients';
+
+const dialect = new PgDialect();
+
+function toSql(value: Parameters<PgDialect['sqlToQuery']>[0]): string {
+  return dialect.sqlToQuery(value).sql;
+}
+
+function quotedLiterals(sql: string): string[] {
+  return [...sql.matchAll(/'([a-z_]+)'/g)].map((match) => match[1]);
+}
+
+/**
+ * Same reasoning as `book-requests.schema.test.ts`: the CHECK bodies and the partial index
+ * predicate are hand-written literal SQL, and these tests are what stop them drifting away from
+ * the shared constants.
+ */
+describe('download client schema SQL matches the shared constants', () => {
+  const clientConfig = getTableConfig(downloadClients);
+  const downloadConfig = getTableConfig(bookRequestDownloads);
+
+  it('accepts exactly the adapter types declared in @bookorbit/types', () => {
+    const check = clientConfig.checks.find((c) => c.name === 'download_clients_adapter_type_chk');
+    expect(check).toBeDefined();
+    expect(quotedLiterals(toSql(check!.value)).sort()).toEqual([...DOWNLOAD_CLIENT_TYPES].sort());
+  });
+
+  it('accepts exactly the download statuses declared in @bookorbit/types', () => {
+    const check = downloadConfig.checks.find((c) => c.name === 'book_request_downloads_status_chk');
+    expect(check).toBeDefined();
+    expect(quotedLiterals(toSql(check!.value)).sort()).toEqual([...BOOK_REQUEST_DOWNLOAD_STATUSES].sort());
+  });
+
+  it('accepts exactly the grab sources declared in @bookorbit/types', () => {
+    const check = downloadConfig.checks.find((c) => c.name === 'book_request_downloads_source_chk');
+    expect(check).toBeDefined();
+    expect(quotedLiterals(toSql(check!.value)).sort()).toEqual([...BOOK_REQUEST_DOWNLOAD_SOURCES].sort());
+  });
+
+  it('scopes the one-live-attempt-per-hash index to every status whose bytes are still needed', () => {
+    const index = downloadConfig.indexes.find((i) => i.config.name === 'book_request_downloads_active_hash_uidx');
+    expect(index).toBeDefined();
+    expect(index!.config.unique).toBe(true);
+
+    // `needs_review` is in: those bytes are still on disk waiting for a person, and a second grab
+    // of the same release URL would stage over them and then delete them on its way out.
+    expect(quotedLiterals(toSql(index!.config.where!)).sort()).toEqual(['completed', 'downloading', 'importing', 'needs_review', 'queued']);
+  });
+});
diff --git a/server/src/db/schema/download-clients.ts b/server/src/db/schema/download-clients.ts
new file mode 100644
index 000000000..4b4be4af9
--- /dev/null
+++ b/server/src/db/schema/download-clients.ts
@@ -0,0 +1,182 @@
+import { sql } from 'drizzle-orm';
+import { bigint, boolean, check, index, integer, jsonb, pgTable, serial, text, timestamp, uniqueIndex, varchar } from 'drizzle-orm/pg-core';
+
+import type { IndexerColor, ReleaseUnitChoice } from '@bookorbit/types';
+
+import { bookDockFiles } from './book-dock';
+import { bookRequests } from './book-requests';
+import { requestIndexers } from './request-indexers';
+
+/**
+ * Status and type lists are spelled out rather than interpolated from the shared constants, for
+ * the same reason `book-requests.ts` spells its own out: a CHECK body needs literal SQL, and
+ * `sql.raw()` would run at import time. `download-clients.schema.test.ts` asserts they still
+ * match `@bookorbit/types`.
+ */
+
+export const downloadClients = pgTable(
+  'download_clients',
+  {
+    id: serial('id').primaryKey(),
+    name: varchar('name', { length: 100 }).notNull(),
+    color: varchar('color', { length: 16 }).$type<IndexerColor>(),
+    adapterType: varchar('adapter_type', { length: 30 }).notNull(),
+    enabled: boolean('enabled').notNull().default(true),
+    priority: integer('priority').notNull().default(1),
+
+    baseUrl: text('base_url').notNull(),
+    username: varchar('username', { length: 255 }),
+    /** AES-256-GCM blob. Never returned to a client, and never logged. */
+    credentialsEnc: text('credentials_enc'),
+
+    /** Tags our torrents in the client so BookOrbit only ever touches its own. */
+    category: varchar('category', { length: 100 }).notNull().default('bookorbit'),
+    useHardlinks: boolean('use_hardlinks').notNull().default(true),
+    /** Per-row SSRF opt-in: clients usually live on the LAN, indexers do not. */
+    allowPrivateAddress: boolean('allow_private_address').notNull().default(true),
+    settings: jsonb('settings').$type<Record<string, unknown>>(),
+
+    lastTestedAt: timestamp('last_tested_at', { withTimezone: true }),
+    lastTestOk: boolean('last_test_ok'),
+    lastErrorMessage: text('last_error_message'),
+
+    createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp('updated_at', { withTimezone: true })
+      .notNull()
+      .defaultNow()
+      .$onUpdateFn(() => new Date()),
+  },
+  (t) => [
+    uniqueIndex('download_clients_name_lower_uidx').on(sql`lower(${t.name})`),
+    index('download_clients_enabled_priority_idx').on(t.enabled, t.priority),
+    check('download_clients_adapter_type_chk', sql`${t.adapterType} in ('qbittorrent', 'transmission', 'deluge')`),
+
+    check('download_clients_priority_range_chk', sql`${t.priority} >= 1 and ${t.priority} <= 100`),
+  ],
+);
+
+/**
+ * Longest-prefix translation from what the client reports to what BookOrbit can open. Mandatory
+ * for any deployment where the two containers mount the same storage at different paths.
+ */
+export const downloadClientPathMappings = pgTable(
+  'download_client_path_mappings',
+  {
+    id: serial('id').primaryKey(),
+    downloadClientId: integer('download_client_id')
+      .notNull()
+      .references(() => downloadClients.id, { onDelete: 'cascade' }),
+    remotePath: varchar('remote_path', { length: 4096 }).notNull(),
+    localPath: varchar('local_path', { length: 4096 }).notNull(),
+    createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+  },
+  (t) => [uniqueIndex('download_client_path_mappings_client_remote_uidx').on(t.downloadClientId, t.remotePath)],
+);
+
+/**
+ * One row per grab attempt, so "retry with a different release" is a new row rather than a
+ * mutation that loses what was tried before.
+ */
+export const bookRequestDownloads = pgTable(
+  'book_request_downloads',
+  {
+    id: serial('id').primaryKey(),
+    requestId: integer('request_id')
+      .notNull()
+      .references(() => bookRequests.id, { onDelete: 'cascade' }),
+    /**
+     * Null for a direct file, which BookOrbit fetches itself rather than handing to a client, and
+     * null again once a client a torrent was handed to is deleted. `source` is what tells those
+     * two apart: `direct_url` is ours to poll and clean up, anything else is an orphaned attempt.
+     */
+    downloadClientId: integer('download_client_id').references(() => downloadClients.id, { onDelete: 'set null' }),
+
+    /** Where the release came from. Set null on delete: the attempt outlives the indexer row. */
+    indexerId: integer('indexer_id').references(() => requestIndexers.id, { onDelete: 'set null' }),
+
+    source: varchar('source', { length: 20 }).notNull(),
+    /** Grabbed by the automation rather than by a person, which is what makes it retryable. */
+    automated: boolean('automated').notNull().default(false),
+    releaseTitle: varchar('release_title', { length: 500 }).notNull(),
+    releaseGuid: text('release_guid'),
+    releaseSizeBytes: bigint('release_size_bytes', { mode: 'number' }),
+    releaseSeeders: integer('release_seeders'),
+    releaseFormat: varchar('release_format', { length: 20 }),
+    freeleech: boolean('freeleech').notNull().default(false),
+
+    /**
+     * Null for an attempt that was refused before anything was handed over: a tracker that would
+     * not serve the .torrent leaves a record of having been asked, and nothing to poll.
+     */
+    clientHash: varchar('client_hash', { length: 64 }),
+    status: varchar('status', { length: 20 }).notNull().default('queued'),
+    progressPercent: integer('progress_percent').notNull().default(0),
+    downloadedBytes: bigint('downloaded_bytes', { mode: 'number' }).notNull().default(0),
+    totalBytes: bigint('total_bytes', { mode: 'number' }),
+
+    /** Internal resume metadata for BookOrbit's built-in direct downloader. Never returned by an API. */
+    directUrl: text('direct_url'),
+    directFileName: varchar('direct_file_name', { length: 500 }),
+    directEtag: varchar('direct_etag', { length: 1024 }),
+    directLastModified: varchar('direct_last_modified', { length: 200 }),
+
+    /** What the client reported, in its own namespace, and what that mapped to locally. */
+    contentPath: text('content_path'),
+    localPath: text('local_path'),
+    bookDockFileId: integer('book_dock_file_id').references(() => bookDockFiles.id, { onDelete: 'set null' }),
+
+    /**
+     * The books this release turned out to hold, kept only while the attempt waits for someone to
+     * choose between them. Stored rather than recomputed because recomputing would mean walking
+     * the download again, and re-extracting it when the release arrived as an archive.
+     */
+    releaseUnits: jsonb('release_units').$type<ReleaseUnitChoice[]>(),
+
+    errorMessage: text('error_message'),
+    grabbedAt: timestamp('grabbed_at', { withTimezone: true }),
+    /** Last tick that saw bytes move. The stall watchdog reads this, not `updatedAt`. */
+    lastProgressAt: timestamp('last_progress_at', { withTimezone: true }),
+    completedAt: timestamp('completed_at', { withTimezone: true }),
+    importedAt: timestamp('imported_at', { withTimezone: true }),
+
+    createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp('updated_at', { withTimezone: true })
+      .notNull()
+      .defaultNow()
+      .$onUpdateFn(() => new Date()),
+  },
+  (t) => [
+    index('book_request_downloads_status_idx').on(t.status),
+    // Newest attempt first within a request, which is the order both the card's latest attempt
+    // and the attempt list are read in. `created_at` served neither: two attempts inserted in one
+    // transaction share a timestamp, and the id is what puts them in order.
+    index('book_request_downloads_request_latest_idx').on(t.requestId, t.id.desc()),
+    index('book_request_downloads_book_dock_file_id_idx').on(t.bookDockFileId),
+    // One live attempt per infohash per client: re-grabbing a torrent the client is already
+    // working on would produce two rows racing to import the same file. Coalesced because the
+    // built-in downloader has no client row, and two direct grabs of one URL would otherwise
+    // both be let through to write the same staging file.
+    //
+    // `needs_review` counts as live. Its bytes are still on disk and still needed: direct staging
+    // is keyed by a digest of the URL, so a second request grabbing the same release - an omnibus
+    // that matches two different work-level requests - writes into the same directory, and its
+    // failure cleanup or its removal then deletes the files the held attempt's import is waiting
+    // to read.
+    uniqueIndex('book_request_downloads_active_hash_uidx')
+      .on(sql`coalesce(${t.downloadClientId}, 0)`, t.clientHash)
+
+      .where(sql`${t.status} in ('queued', 'downloading', 'completed', 'importing', 'needs_review')`),
+    check('book_request_downloads_source_chk', sql`${t.source} in ('magnet', 'torrent_file', 'direct_url')`),
+    check(
+      'book_request_downloads_status_chk',
+      sql`${t.status} in ('queued', 'downloading', 'completed', 'importing', 'needs_review', 'imported', 'failed')`,
+    ),
+    check('book_request_downloads_progress_range_chk', sql`${t.progressPercent} >= 0 and ${t.progressPercent} <= 100`),
+  ],
+);
+
+export type DownloadClientRow = typeof downloadClients.$inferSelect;
+export type NewDownloadClientRow = typeof downloadClients.$inferInsert;
+export type DownloadClientPathMappingRow = typeof downloadClientPathMappings.$inferSelect;
+export type BookRequestDownloadRow = typeof bookRequestDownloads.$inferSelect;
+export type NewBookRequestDownloadRow = typeof bookRequestDownloads.$inferInsert;
diff --git a/server/src/db/schema/index.ts b/server/src/db/schema/index.ts
index b583f9acd..80ea7152a 100644
--- a/server/src/db/schema/index.ts
+++ b/server/src/db/schema/index.ts
@@ -19,6 +19,9 @@ export * from './oidc';
 export * from './opds';
 export * from './kobo';
 export * from './book-dock';
+export * from './book-requests';
+export * from './download-clients';
+export * from './request-indexers';
 export * from './file-write';
 export * from './email-templates';
 export * from './email-providers';
diff --git a/server/src/db/schema/request-indexers.schema.test.ts b/server/src/db/schema/request-indexers.schema.test.ts
new file mode 100644
index 000000000..093ae04b3
--- /dev/null
+++ b/server/src/db/schema/request-indexers.schema.test.ts
@@ -0,0 +1,46 @@
+import { PgDialect, getTableConfig } from 'drizzle-orm/pg-core';
+import { INDEXER_ADAPTER_TYPES } from '@bookorbit/types';
+
+import { requestIndexers } from './request-indexers';
+
+const dialect = new PgDialect();
+
+function toSql(value: Parameters<PgDialect['sqlToQuery']>[0]): string {
+  return dialect.sqlToQuery(value).sql;
+}
+
+/**
+ * The CHECK body is hand-written literal SQL. It is a slug pattern rather than a list, so what
+ * this test guards is that every adapter type the code declares actually satisfies it, and that
+ * the pattern still refuses anything that is not a slug.
+ */
+describe('request indexer schema SQL matches the shared constants', () => {
+  const config = getTableConfig(requestIndexers);
+  const check = config.checks.find((c) => c.name === 'request_indexers_adapter_type_chk');
+  const pattern = /'(\^[^']+)'/.exec(toSql(check!.value))?.[1];
+  const slug = new RegExp(pattern!);
+
+  it('declares the constraint as a slug pattern', () => {
+    expect(check).toBeDefined();
+    expect(pattern).toBeDefined();
+  });
+
+  it('accepts every adapter type declared in @bookorbit/types', () => {
+    for (const type of INDEXER_ADAPTER_TYPES) expect(slug.test(type)).toBe(true);
+  });
+
+  /**
+   * A row whose adapter was removed from the build has to survive the upgrade. Deleting it would
+   * throw away an encrypted credential the operator may still want, and the settings page can
+   * only explain the row if the row is still there.
+   */
+  it('keeps a row whose adapter type is no longer built in', () => {
+    expect(slug.test('mam')).toBe(true);
+  });
+
+  it('rejects anything that is not a slug', () => {
+    for (const bad of ['', 'Torznab', 'tor znab', "tor'znab", '-leading', 'a'.repeat(31)]) {
+      expect(slug.test(bad)).toBe(false);
+    }
+  });
+});
diff --git a/server/src/db/schema/request-indexers.ts b/server/src/db/schema/request-indexers.ts
new file mode 100644
index 000000000..b2fe4a3ce
--- /dev/null
+++ b/server/src/db/schema/request-indexers.ts
@@ -0,0 +1,97 @@
+import { sql } from 'drizzle-orm';
+import { boolean, check, index, integer, jsonb, pgTable, serial, text, timestamp, uniqueIndex, varchar } from 'drizzle-orm/pg-core';
+import type { BookRequestMediaKind, IndexerCategoryMap, IndexerColor, IndexerSettings, NetworkProfile } from '@bookorbit/types';
+
+/**
+ * Configured indexer instances. The adapter *types* live in code; no tracker is bundled, and a
+ * row carries the operator's own credentials.
+ */
+export const requestIndexers = pgTable(
+  'request_indexers',
+  {
+    id: serial('id').primaryKey(),
+    name: varchar('name', { length: 100 }).notNull(),
+    /**
+     * The operator's own colour for this source, as a slug from `INDEXER_COLORS` rather than a
+     * colour value: the picker resolves it to a token tuned per theme, and a stored hex could not
+     * be. Null is the ordinary state, and reads as the neutral chip the picker showed before
+     * colours existed.
+     */
+    color: varchar('color', { length: 16 }).$type<IndexerColor>(),
+    adapterType: varchar('adapter_type', { length: 30 }).notNull(),
+    enabled: boolean('enabled').notNull().default(true),
+    baseUrl: text('base_url').notNull(),
+    /** AES-256-GCM blob: a torznab API key or a tracker session id. Never returned, never logged. */
+    credentialsEnc: text('credentials_enc'),
+    /**
+     * Off by default, unlike a download client: a public tracker has no business resolving to a
+     * private address. A self-hosted torznab proxy on the LAN is the one common exception, so it
+     * is an explicit per-row opt-in with the implication stated in the UI.
+     */
+    allowPrivateAddress: boolean('allow_private_address').notNull().default(false),
+
+    /** Which of this indexer's own categories to search per requested medium. */
+    categories: jsonb('categories').$type<IndexerCategoryMap>(),
+    /**
+     * Media the operator has taken this source out of. An opt-out, so a row written before a
+     * medium existed is not excluded from it, and so the default state is the one an operator who
+     * has never opened this expects. Narrowing only: a source whose adapter does not carry a
+     * medium is already left out of that search, and listing it here changes nothing.
+     */
+    disabledMediaKinds: jsonb('disabled_media_kinds').$type<BookRequestMediaKind[]>().notNull().default([]),
+    /**
+     * Whether this source is to be searched by title and author even when the request states an
+     * ISBN. An opt-out for the same reason the line above is: indexing the identifier is the better
+     * default, and this exists for a catalogue that holds ISBNs against the wrong rows, where an
+     * exact search returns a confidently wrong book. Meaningless for an adapter that never searches
+     * one, and stored anyway so the answer survives a change of adapter.
+     */
+    isbnSearchDisabled: boolean('isbn_search_disabled').notNull().default(false),
+    /** Adapter-specific knobs that do not deserve a column of their own. */
+    settings: jsonb('settings').$type<IndexerSettings>(),
+    /**
+     * How to reach this source, where the default path does not work: its own resolvers, or a
+     * proxy to egress through. Operator configuration; the containment policy is unchanged, and
+     * still applies to whatever address the configured resolver returns.
+     */
+    networkProfile: jsonb('network_profile').$type<NetworkProfile>(),
+
+    lastTestedAt: timestamp('last_tested_at', { withTimezone: true }),
+    lastTestOk: boolean('last_test_ok'),
+    lastErrorMessage: text('last_error_message'),
+
+    /**
+     * How the last real search against this source went, as opposed to the last time an operator
+     * pressed Test. The two answer different questions: a caps call can succeed against a tracker
+     * that has been refusing every search since Tuesday, and the picker's live failure list is
+     * gone the moment the drawer closes.
+     */
+    lastSearchAt: timestamp('last_search_at', { withTimezone: true }),
+    lastSearchOk: boolean('last_search_ok'),
+    lastSearchError: text('last_search_error'),
+    /**
+     * Reset to zero by any successful search. A source that has failed the last several searches
+     * in a row is a different fact from one that failed once, and it is the only one worth
+     * putting a badge on a settings row for.
+     */
+    searchFailureStreak: integer('search_failure_streak').notNull().default(0),
+
+    createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp('updated_at', { withTimezone: true })
+      .notNull()
+      .defaultNow()
+      .$onUpdateFn(() => new Date()),
+  },
+  (t) => [
+    uniqueIndex('request_indexers_name_lower_uidx').on(sql`lower(${t.name})`),
+    index('request_indexers_enabled_idx').on(t.enabled),
+    // A slug, not a list. Two reasons: a row whose adapter was removed from the build has to
+    // survive so the operator can see and replace it rather than losing a stored credential, and
+    // externally loaded adapters name themselves. `IndexerRegistry.require()` is what actually
+    // rejects an unknown type, loudly, at search and grab time.
+    check('request_indexers_adapter_type_chk', sql`${t.adapterType} ~ '^[a-z0-9][a-z0-9-]{0,29}$'`),
+  ],
+);
+
+export type RequestIndexerRow = typeof requestIndexers.$inferSelect;
+export type NewRequestIndexerRow = typeof requestIndexers.$inferInsert;
diff --git a/server/src/modules/app-settings/app-settings.service.ts b/server/src/modules/app-settings/app-settings.service.ts
index 3aa42a2ee..94543d722 100644
--- a/server/src/modules/app-settings/app-settings.service.ts
+++ b/server/src/modules/app-settings/app-settings.service.ts
@@ -2,6 +2,10 @@ import { BadRequestException, Inject, Injectable, Logger, NotFoundException } fr
 import { ConfigService, type ConfigType } from '@nestjs/config';
 
 import {
+  type BookRequestImportFormats,
+  BOOK_REQUEST_AUTOMATION_SETTING_KEYS,
+  BOOK_REQUEST_IMPORT_FORMATS,
+  DEFAULT_BOOK_REQUEST_AUTOMATION_SETTINGS,
   type DefaultLibraryAccessConfig,
   DEFAULT_DOWNLOAD_PATTERN,
   DEFAULT_UPLOAD_PATTERN_BOOK_PER_FILE,
@@ -64,6 +68,12 @@ export class AppSettingsService {
     return row?.value ?? null;
   }
 
+  /** One round trip for a group of related settings, rather than a query per key. */
+  async getValues(keys: string[]): Promise<Map<string, string>> {
+    const rows = await this.repo.findMany(keys);
+    return new Map(rows.map((row) => [row.key, row.value]));
+  }
+
   async setValue(key: string, value: string): Promise<void> {
     await this.repo.upsert(key, value);
     this.clearRuntimeSettingCache(key);
@@ -143,6 +153,20 @@ export class AppSettingsService {
     return mergeOidcConfig(DEFAULT_OIDC_CONFIG, stored);
   }
 
+  /**
+   * How many formats of one book to keep when a release carried several.
+   *
+   * Read here rather than through the book-request module's own settings service because the dock
+   * is where placement happens, and a folder dropped in by hand has no request behind it at all.
+   * Falls back to the shipped default, so a hand-edited row cannot stall a finalize.
+   */
+  async getBookRequestImportFormats(): Promise<BookRequestImportFormats> {
+    const row = await this.repo.findByKey(BOOK_REQUEST_AUTOMATION_SETTING_KEYS.IMPORT_FORMATS);
+    return BOOK_REQUEST_IMPORT_FORMATS.includes(row?.value as BookRequestImportFormats)
+      ? (row!.value as BookRequestImportFormats)
+      : DEFAULT_BOOK_REQUEST_AUTOMATION_SETTINGS.importFormats;
+  }
+
   async getUploadPattern(): Promise<string> {
     const row = await this.repo.findByKey(APP_SETTING_KEYS.UPLOAD_FILE_PATTERN);
     return row?.value ?? DEFAULT_UPLOAD_PATTERN_BOOK_PER_FILE;
diff --git a/server/src/modules/auth/auth.service.test.ts b/server/src/modules/auth/auth.service.test.ts
index 092681fa5..3eca292c3 100644
--- a/server/src/modules/auth/auth.service.test.ts
+++ b/server/src/modules/auth/auth.service.test.ts
@@ -1138,6 +1138,60 @@ describe('AuthService', () => {
     });
   });
 
+  /**
+   * The resolution a caller acting on somebody's behalf gets. Every rule `validateUser` applies
+   * except the token version, which belongs to a token the caller does not hold; the point of the
+   * shared helper is that a way in that is closed to a login stays closed to a delegated call.
+   */
+  describe('findActingUser', () => {
+    it('returns null when the user does not exist', async () => {
+      const { service, userService } = makeService();
+      userService.findByIdWithPermissions.mockResolvedValue(null);
+
+      await expect(service.findActingUser(1)).resolves.toBeNull();
+    });
+
+    it('returns null when the user is deactivated', async () => {
+      const { service, userService } = makeService();
+      userService.findByIdWithPermissions.mockResolvedValue(makeFullUser({ active: false }));
+
+      await expect(service.findActingUser(1)).resolves.toBeNull();
+    });
+
+    it('returns null for a shared user whose magic links were all revoked', async () => {
+      const { service, userService, magicLinkRepo } = makeService();
+      userService.findByIdWithPermissions.mockResolvedValue(makeFullUser({ provisioningMethod: 'shared' }));
+      magicLinkRepo.hasActiveByUserId.mockResolvedValue(false);
+
+      await expect(service.findActingUser(1)).resolves.toBeNull();
+    });
+
+    it('returns a shared user who still has a live magic link', async () => {
+      const { service, userService, magicLinkRepo } = makeService();
+      const user = makeFullUser({ provisioningMethod: 'shared' });
+      userService.findByIdWithPermissions.mockResolvedValue(user);
+      magicLinkRepo.hasActiveByUserId.mockResolvedValue(true);
+
+      await expect(service.findActingUser(1)).resolves.toEqual(user);
+    });
+
+    it('never asks about magic links for an ordinary account', async () => {
+      const { service, userService, magicLinkRepo } = makeService();
+      userService.findByIdWithPermissions.mockResolvedValue(makeFullUser({ provisioningMethod: 'local' }));
+
+      await service.findActingUser(1);
+      expect(magicLinkRepo.hasActiveByUserId).not.toHaveBeenCalled();
+    });
+
+    it('ignores the token version, which belongs to a token this caller does not hold', async () => {
+      const { service, userService } = makeService();
+      const user = makeFullUser({ tokenVersion: 9 });
+      userService.findByIdWithPermissions.mockResolvedValue(user);
+
+      await expect(service.findActingUser(1)).resolves.toEqual(user);
+    });
+  });
+
   describe('forgotPassword', () => {
     it('throws ServiceUnavailableException when system mail is not configured', async () => {
       const { service, systemMailService } = makeService();
diff --git a/server/src/modules/auth/auth.service.ts b/server/src/modules/auth/auth.service.ts
index cbfb4faa7..e0eb862ca 100644
--- a/server/src/modules/auth/auth.service.ts
+++ b/server/src/modules/auth/auth.service.ts
@@ -497,16 +497,36 @@ export class AuthService {
   async validateUser(userId: number, tokenVersion: number) {
     const user = await this.userService.findByIdWithPermissions(userId);
     if (!user || !user.active) throw new UnauthorizedException();
+    // Before the shared-link lookup, so a stale token is refused without a second query.
     if (user.tokenVersion !== tokenVersion) throw new UnauthorizedException();
-
-    if (user.provisioningMethod === 'shared') {
-      const hasActive = await this.magicLinkRepo.hasActiveByUserId(userId);
-      if (!hasActive) throw new UnauthorizedException();
-    }
+    if (!(await this.canActNow(user))) throw new UnauthorizedException();
 
     return user;
   }
 
+  /**
+   * The user as an authenticated request would have resolved them, for a caller acting on their
+   * behalf rather than as them.
+   *
+   * Everything `validateUser` checks except the token version, which belongs to a token this
+   * caller does not hold. Null rather than a throw, because the refusal a delegated call should
+   * give is not the one a bad token gives, and only the caller knows which it is making.
+   */
+  async findActingUser(userId: number): Promise<RequestUser | null> {
+    const user = await this.userService.findByIdWithPermissions(userId);
+    if (!user || !user.active) return null;
+    return (await this.canActNow(user)) ? user : null;
+  }
+
+  /**
+   * A shared account exists only for as long as a live magic link points at it, so a revoked link
+   * has to close every door and not just the login form.
+   */
+  private async canActNow(user: RequestUser): Promise<boolean> {
+    if (user.provisioningMethod !== 'shared') return true;
+    return this.magicLinkRepo.hasActiveByUserId(user.id);
+  }
+
   async revokeAllUserSessions(userId: number) {
     await this.db.transaction(async (tx) => {
       await tx
diff --git a/server/src/modules/book-dock/book-dock-finalize.service.test.ts b/server/src/modules/book-dock/book-dock-finalize.service.test.ts
index b7c713de1..bfea0f3dd 100644
--- a/server/src/modules/book-dock/book-dock-finalize.service.test.ts
+++ b/server/src/modules/book-dock/book-dock-finalize.service.test.ts
@@ -5,6 +5,7 @@ vi.mock('fs/promises', () => ({
   readFile: vi.fn(),
   stat: vi.fn(),
   unlink: vi.fn(),
+  rmdir: vi.fn().mockResolvedValue(undefined),
 }));
 
 import { BadRequestException, NotFoundException } from '@nestjs/common';
@@ -37,6 +38,7 @@ function makeService() {
     findSelectionBatch: vi.fn(),
     findAllIds: vi.fn(),
     findExistingBooksByAbsolutePaths: vi.fn().mockResolvedValue([]),
+    findUnitFiles: vi.fn().mockResolvedValue([]),
     deleteById: vi.fn(),
     deleteByIds: vi.fn(),
   };
@@ -48,6 +50,7 @@ function makeService() {
     getUploadPattern: vi.fn().mockResolvedValue(null),
     getUploadPatternBookPerFolder: vi.fn().mockResolvedValue(null),
     isCrossPlatformPathSanitizationEnabled: vi.fn().mockResolvedValue(false),
+    getBookRequestImportFormats: vi.fn().mockResolvedValue('all'),
   };
   const metadataService = {
     downloadAndSaveCover: vi.fn().mockResolvedValue(false),
@@ -71,7 +74,8 @@ function makeService() {
     moveToPath: vi.fn().mockResolvedValue(undefined),
   };
   const processor = {
-    createBookRecord: vi.fn().mockResolvedValue({ bookId: 101 }),
+    createUnitBookRecords: vi.fn().mockResolvedValue({ bookIds: [101], createdBookIds: [101], attachedFileIds: [] }),
+    deleteUnitBookRecords: vi.fn().mockResolvedValue(undefined),
   };
   const events = {
     on: vi.fn(),
@@ -148,6 +152,7 @@ function makeRow(overrides?: Partial<Record<string, unknown>>) {
     fetchedMetadataSources: null,
     errorMessage: null,
     metadataEditedAt: null,
+    autoFinalizeSuppressed: false,
     createdAt: new Date(),
     updatedAt: new Date(),
     ...overrides,
@@ -189,6 +194,29 @@ describe('BookDockFinalizeService', () => {
       expect(repo.findById).not.toHaveBeenCalled();
     });
 
+    /**
+     * A row another module owns. Racing it would either file the wrong book into the right
+     * library or file it before that module's own verification ran, and both fail silently.
+     */
+    it('skips a row whose finalization another module owns', async () => {
+      const { service, repo, appSettings } = makeService();
+      const row = makeRow({ autoFinalizeSuppressed: true });
+
+      appSettings.getAutoFinalizeSettings.mockResolvedValue({
+        enabled: true,
+        threshold: 85,
+        libraryId: 5,
+        folderId: 9,
+        metadataMode: 'safe_merge',
+      });
+      repo.findById.mockResolvedValue(row);
+      const finalizeSpy = vi.spyOn(service as never, 'finalizeFile');
+
+      await service.triggerAutoFinalize(row.id);
+
+      expect(finalizeSpy).not.toHaveBeenCalled();
+    });
+
     it('merges embedded and fetched metadata when auto-finalizing and selected metadata is empty', async () => {
       const { service, repo, appSettings } = makeService();
       const fetched = { title: 'Fetched Title', authors: ['Fetched Author'] } as BookDockMetadata;
@@ -553,7 +581,7 @@ describe('BookDockFinalizeService', () => {
       repo.findExistingBooksByAbsolutePaths.mockResolvedValue([{ absolutePath: '/library/stale.epub', bookId: 77, libraryId: 5 }]);
       mockAccess.mockRejectedValueOnce(Object.assign(new Error('not found'), { code: 'ENOENT' }));
       mockStat.mockResolvedValueOnce({ size: 100 } as never);
-      processor.createBookRecord.mockResolvedValueOnce({ bookId: 77 });
+      processor.createUnitBookRecords.mockResolvedValueOnce({ bookIds: [77], createdBookIds: [77], attachedFileIds: [] });
 
       const result = await (service as any).finalizeFile(
         makeRow({ targetLibraryId: 5, targetFolderId: 9 }),
@@ -575,7 +603,7 @@ describe('BookDockFinalizeService', () => {
       vi.spyOn(service as never, 'resolveDestination').mockResolvedValue('/library/new/book.epub' as never);
       mockAccess.mockRejectedValueOnce(Object.assign(new Error('not found'), { code: 'ENOENT' }));
       mockStat.mockResolvedValueOnce({ size: 321 } as never);
-      processor.createBookRecord.mockRejectedValueOnce(new Error('create failed'));
+      processor.createUnitBookRecords.mockRejectedValueOnce(new Error('create failed'));
 
       await expect(
         (service as any).finalizeFile(makeRow({ targetLibraryId: 5, targetFolderId: 9 }), undefined, undefined, new Map(), 1, true),
@@ -596,7 +624,7 @@ describe('BookDockFinalizeService', () => {
       vi.spyOn(service as never, 'resolveDestination').mockResolvedValue('/library/new/book.epub' as never);
       mockAccess.mockRejectedValueOnce(Object.assign(new Error('not found'), { code: 'ENOENT' }));
       mockStat.mockResolvedValueOnce({ size: 321 } as never);
-      processor.createBookRecord.mockResolvedValueOnce({ bookId: 808 });
+      processor.createUnitBookRecords.mockResolvedValueOnce({ bookIds: [808], createdBookIds: [808], attachedFileIds: [] });
       const constraintError = new Error('Failed query: update "book_metadata" set ...');
       (constraintError as Error & { cause?: unknown }).cause = {
         code: '23514',
@@ -633,7 +661,7 @@ describe('BookDockFinalizeService', () => {
       vi.spyOn(service as never, 'cleanupBookDockRecord').mockResolvedValue(undefined as never);
       mockAccess.mockRejectedValueOnce(Object.assign(new Error('not found'), { code: 'ENOENT' }));
       mockStat.mockResolvedValueOnce({ size: 100 } as never);
-      processor.createBookRecord.mockResolvedValueOnce({ bookId: 555 });
+      processor.createUnitBookRecords.mockResolvedValueOnce({ bookIds: [555], createdBookIds: [555], attachedFileIds: [] });
 
       await expect(
         (service as any).finalizeFile(makeRow({ targetLibraryId: 5, targetFolderId: 9 }), undefined, undefined, new Map(), 1, true),
@@ -644,7 +672,17 @@ describe('BookDockFinalizeService', () => {
         success: true,
         bookId: 555,
       });
-      expect(processor.createBookRecord).toHaveBeenCalledWith(5, 9, '/library/new', '/library/new/book.epub', 'new/book.epub', 'epub', 100);
+      expect(processor.createUnitBookRecords).toHaveBeenCalledWith(5, 9, [
+        {
+          folderPath: '/library/new',
+          absolutePath: '/library/new/book.epub',
+          relPath: 'new/book.epub',
+          format: 'epub',
+          sizeBytes: 100,
+          role: 'content',
+          sortOrder: 0,
+        },
+      ]);
     });
 
     it('files a book_per_file book under the pattern folders instead of the library root', async () => {
@@ -689,12 +727,22 @@ describe('BookDockFinalizeService', () => {
       vi.spyOn(service as never, 'cleanupBookDockRecord').mockResolvedValue(undefined as never);
       mockAccess.mockRejectedValueOnce(Object.assign(new Error('not found'), { code: 'ENOENT' }));
       mockStat.mockResolvedValueOnce({ size: 100 } as never);
-      processor.createBookRecord.mockResolvedValueOnce({ bookId: 556 });
+      processor.createUnitBookRecords.mockResolvedValueOnce({ bookIds: [556], createdBookIds: [556], attachedFileIds: [] });
 
       await expect(
         (service as any).finalizeFile(makeRow({ targetLibraryId: 5, targetFolderId: 9 }), undefined, undefined, new Map(), 1, true),
       ).resolves.toMatchObject({ success: true, bookId: 556 });
-      expect(processor.createBookRecord).toHaveBeenCalledWith(5, 9, '/library/new/book.epub', '/library/new/book.epub', 'new/book.epub', 'epub', 100);
+      expect(processor.createUnitBookRecords).toHaveBeenCalledWith(5, 9, [
+        {
+          folderPath: '/library/new/book.epub',
+          absolutePath: '/library/new/book.epub',
+          relPath: 'new/book.epub',
+          format: 'epub',
+          sizeBytes: 100,
+          role: 'content',
+          sortOrder: 0,
+        },
+      ]);
     });
 
     describe('organization modes', () => {
@@ -713,7 +761,7 @@ describe('BookDockFinalizeService', () => {
         vi.spyOn(service as never, 'cleanupBookDockRecord').mockResolvedValue(undefined as never);
         mockAccess.mockRejectedValueOnce(Object.assign(new Error('not found'), { code: 'ENOENT' }));
         mockStat.mockResolvedValueOnce({ size: 1024 } as never);
-        processor.createBookRecord.mockResolvedValueOnce({ bookId: 42 });
+        processor.createUnitBookRecords.mockResolvedValueOnce({ bookIds: [42], createdBookIds: [42], attachedFileIds: [] });
 
         const overrideMap = new Map([[7, { libraryId: 5, folderId: 9 }]]);
         const result = await (service as any).finalizeFile(
@@ -727,15 +775,17 @@ describe('BookDockFinalizeService', () => {
 
         expect(result).toMatchObject({ success: true, bookId: 42 });
         // book_per_folder: folderPath = dirname(destPath) = /library/Author/Dune
-        expect(processor.createBookRecord).toHaveBeenCalledWith(
-          5,
-          9,
-          '/library/Author/Dune',
-          '/library/Author/Dune/Dune.pdf',
-          'Author/Dune/Dune.pdf',
-          'pdf',
-          1024,
-        );
+        expect(processor.createUnitBookRecords).toHaveBeenCalledWith(5, 9, [
+          {
+            folderPath: '/library/Author/Dune',
+            absolutePath: '/library/Author/Dune/Dune.pdf',
+            relPath: 'Author/Dune/Dune.pdf',
+            format: 'pdf',
+            sizeBytes: 1024,
+            role: 'content',
+            sortOrder: 0,
+          },
+        ]);
       });
 
       it('creates a separate book record in book_per_file mode', async () => {
@@ -752,7 +802,7 @@ describe('BookDockFinalizeService', () => {
         vi.spyOn(service as never, 'cleanupBookDockRecord').mockResolvedValue(undefined as never);
         mockAccess.mockRejectedValueOnce(Object.assign(new Error('not found'), { code: 'ENOENT' }));
         mockStat.mockResolvedValueOnce({ size: 2048 } as never);
-        processor.createBookRecord.mockResolvedValueOnce({ bookId: 300 });
+        processor.createUnitBookRecords.mockResolvedValueOnce({ bookIds: [300], createdBookIds: [300], attachedFileIds: [] });
 
         const overrideMap = new Map([[8, { libraryId: 6, folderId: 10 }]]);
         const result = await (service as any).finalizeFile(
@@ -762,11 +812,22 @@ describe('BookDockFinalizeService', () => {
           overrideMap,
           1,
           true,
+          { role: 'content', sortOrder: 0 },
         );
 
         expect(result).toMatchObject({ success: true, bookId: 300 });
         // book_per_file: folderPath = destPath itself (each file is its own book)
-        expect(processor.createBookRecord).toHaveBeenCalledWith(6, 10, '/library2/Dune.pdf', '/library2/Dune.pdf', 'Dune.pdf', 'pdf', 2048);
+        expect(processor.createUnitBookRecords).toHaveBeenCalledWith(6, 10, [
+          {
+            folderPath: '/library2/Dune.pdf',
+            absolutePath: '/library2/Dune.pdf',
+            relPath: 'Dune.pdf',
+            format: 'pdf',
+            sizeBytes: 2048,
+            role: 'content',
+            sortOrder: 0,
+          },
+        ]);
       });
     });
   });
@@ -786,7 +847,7 @@ describe('BookDockFinalizeService', () => {
       vi.spyOn(service as never, 'cleanupBookDockRecord').mockResolvedValue(undefined as never);
       mockAccess.mockRejectedValueOnce(Object.assign(new Error('not found'), { code: 'ENOENT' }));
       mockStat.mockResolvedValueOnce({ size: 993 } as never);
-      processor.createBookRecord.mockResolvedValueOnce({ bookId: 500 });
+      processor.createUnitBookRecords.mockResolvedValueOnce({ bookIds: [500], createdBookIds: [500], attachedFileIds: [] });
 
       const overrideMap = new Map([[1, { libraryId: 5, folderId: 9, targetFileName: '1_alt' }]]);
       const result = await (service as any).finalizeFile(
@@ -800,15 +861,17 @@ describe('BookDockFinalizeService', () => {
 
       expect(result).toMatchObject({ success: true, bookId: 500 });
       // basename replaced: 1.epub → 1_alt.epub, directory unchanged
-      expect(processor.createBookRecord).toHaveBeenCalledWith(
-        5,
-        9,
-        '/library/Unknown Author/1',
-        '/library/Unknown Author/1/1_alt.epub',
-        'Unknown Author/1/1_alt.epub',
-        'epub',
-        993,
-      );
+      expect(processor.createUnitBookRecords).toHaveBeenCalledWith(5, 9, [
+        {
+          folderPath: '/library/Unknown Author/1',
+          absolutePath: '/library/Unknown Author/1/1_alt.epub',
+          relPath: 'Unknown Author/1/1_alt.epub',
+          format: 'epub',
+          sizeBytes: 993,
+          role: 'content',
+          sortOrder: 0,
+        },
+      ]);
     });
 
     it('classifies an occupied indexed renamed destination as a duplicate', async () => {
@@ -832,6 +895,7 @@ describe('BookDockFinalizeService', () => {
         overrideMap,
         1,
         true,
+        { role: 'content', sortOrder: 0 },
       );
 
       expect(result).toMatchObject({
@@ -909,7 +973,7 @@ describe('BookDockFinalizeService', () => {
       vi.spyOn(service as never, 'cleanupBookDockRecord').mockResolvedValue(undefined as never);
       mockAccess.mockRejectedValueOnce(Object.assign(new Error('not found'), { code: 'ENOENT' }));
       mockStat.mockResolvedValueOnce({ size: 200 } as never);
-      processor.createBookRecord.mockResolvedValueOnce({ bookId: 600 });
+      processor.createUnitBookRecords.mockResolvedValueOnce({ bookIds: [600], createdBookIds: [600], attachedFileIds: [] });
 
       // User types "Title (alt).epub" - should NOT produce "Title (alt).epub.epub"
       const overrideMap = new Map([[1, { libraryId: 5, folderId: 9, targetFileName: 'Title (alt).epub' }]]);
@@ -923,15 +987,17 @@ describe('BookDockFinalizeService', () => {
       );
 
       expect(result).toMatchObject({ success: true });
-      expect(processor.createBookRecord).toHaveBeenCalledWith(
-        5,
-        9,
-        '/library/Author/Title',
-        '/library/Author/Title/Title (alt).epub',
-        'Author/Title/Title (alt).epub',
-        'epub',
-        200,
-      );
+      expect(processor.createUnitBookRecords).toHaveBeenCalledWith(5, 9, [
+        {
+          folderPath: '/library/Author/Title',
+          absolutePath: '/library/Author/Title/Title (alt).epub',
+          relPath: 'Author/Title/Title (alt).epub',
+          format: 'epub',
+          sizeBytes: 200,
+          role: 'content',
+          sortOrder: 0,
+        },
+      ]);
     });
 
     it('rejects targetFileName that would escape the destination directory', async () => {
@@ -956,6 +1022,7 @@ describe('BookDockFinalizeService', () => {
         overrideMap,
         1,
         true,
+        { role: 'content', sortOrder: 0 },
       );
 
       expect(result).toEqual(
@@ -1547,6 +1614,350 @@ describe('BookDockFinalizeService', () => {
     expect(metadataService.saveExtractedCoverBytes).toHaveBeenCalledWith(21, Buffer.from('cover-bytes'));
   });
 
+  describe('multi-file units', () => {
+    const UNIT_DIR = '/dock/request-7-Neuromancer';
+
+    function unitRow(overrides: Record<string, unknown> = {}) {
+      return makeRow({
+        id: 42,
+        fileName: 'track-01.mp3',
+        absolutePath: `${UNIT_DIR}/track-01.mp3`,
+        unitDirectory: UNIT_DIR,
+        format: 'mp3',
+        targetLibraryId: 5,
+        targetFolderId: 9,
+        embeddedMetadata: null,
+        ...overrides,
+      });
+    }
+
+    const AUDIO_UNIT_FILES = [
+      {
+        id: 1,
+        dockFileId: 42,
+        absolutePath: `${UNIT_DIR}/track-01.mp3`,
+        fileName: 'track-01.mp3',
+        fileSize: 10,
+        format: 'mp3',
+        role: 'content',
+        sortOrder: 0,
+      },
+      {
+        id: 2,
+        dockFileId: 42,
+        absolutePath: `${UNIT_DIR}/track-02.mp3`,
+        fileName: 'track-02.mp3',
+        fileSize: 10,
+        format: 'mp3',
+        role: 'content',
+        sortOrder: 1,
+      },
+      {
+        id: 3,
+        dockFileId: 42,
+        absolutePath: `${UNIT_DIR}/cover.jpg`,
+        fileName: 'cover.jpg',
+        fileSize: 5,
+        format: 'jpg',
+        role: 'cover',
+        sortOrder: null,
+      },
+    ];
+
+    function arrange(
+      harness: ReturnType<typeof makeService>,
+      options: { organizationMode?: string; formatPriority?: string[]; destPath?: string; importFormats?: string } = {},
+    ) {
+      const { service } = harness;
+      harness.appSettings.getBookRequestImportFormats.mockResolvedValue(options.importFormats ?? 'all');
+      vi.spyOn(service as never, 'findLibraryOrFail').mockResolvedValue({
+        id: 5,
+        name: 'Loose',
+        allowedFormats: [],
+        fileNamingPattern: null,
+        formatPriority: options.formatPriority ?? [],
+        organizationMode: options.organizationMode ?? 'book_per_folder',
+      } as never);
+      vi.spyOn(service as never, 'findFolderOrFail').mockResolvedValue({ id: 9, libraryId: 5, path: '/library' } as never);
+      vi.spyOn(service as never, 'resolveDestination').mockResolvedValue((options.destPath ?? '/library/Neuromancer/track-01.mp3') as never);
+      vi.spyOn(service as never, 'applyMetadata').mockResolvedValue(undefined as never);
+      vi.spyOn(service as never, 'cleanupBookDockRecord').mockResolvedValue(undefined as never);
+      mockAccess.mockRejectedValue(Object.assign(new Error('not found'), { code: 'ENOENT' }));
+      mockStat.mockResolvedValue({ size: 10 } as never);
+    }
+
+    function finalize(harness: ReturnType<typeof makeService>, row: ReturnType<typeof unitRow>) {
+      return (harness.service as any).finalizeFile(row, undefined, undefined, new Map(), 1, true);
+    }
+
+    /**
+     * Every file into one folder, and one book out of it, in a single write: the primary goes first
+     * because the book row that carries `primaryFileId` is the one created for it.
+     */
+    it('places every file of a unit into one folder and builds a single book from them', async () => {
+      const harness = makeService();
+      harness.repo.findUnitFiles.mockResolvedValue(AUDIO_UNIT_FILES);
+      arrange(harness);
+      harness.processor.createUnitBookRecords.mockResolvedValue({ bookIds: [77], createdBookIds: [77], attachedFileIds: [] });
+
+      const result = await finalize(harness, unitRow());
+
+      expect(result).toMatchObject({ success: true, bookId: 77 });
+      expect(harness.storage.moveToPath).toHaveBeenCalledTimes(3);
+      expect(harness.processor.createUnitBookRecords).toHaveBeenCalledTimes(1);
+
+      const [, , files] = harness.processor.createUnitBookRecords.mock.calls[0];
+      expect(new Set(files.map((file: { folderPath: string }) => file.folderPath)).size).toBe(1);
+      expect(files[0].absolutePath).toContain('track-01.mp3');
+      expect(files.map((file: { role: string; sortOrder: number | null }) => ({ role: file.role, sortOrder: file.sortOrder }))).toEqual([
+        { role: 'content', sortOrder: 0 },
+        { role: 'content', sortOrder: 1 },
+        { role: 'cover', sortOrder: null },
+      ]);
+    });
+
+    /**
+     * The books commit before `applyMetadata` runs, and that runs against services which cannot
+     * join the transaction. A ghost book plus a `book_files` row pointing at a path that has just
+     * been moved back to the dock is the worst outcome this feature can produce.
+     */
+    it('takes back the book rows it created when the metadata pass fails', async () => {
+      const harness = makeService();
+      harness.repo.findUnitFiles.mockResolvedValue(AUDIO_UNIT_FILES);
+      arrange(harness);
+      const written = { bookIds: [77], createdBookIds: [77], attachedFileIds: [9] };
+      harness.processor.createUnitBookRecords.mockResolvedValue(written);
+      vi.spyOn(harness.service as never, 'applyMetadata').mockRejectedValue(new Error('metadata exploded') as never);
+
+      const result = await finalize(harness, unitRow());
+
+      expect(result.success).toBe(false);
+      expect(harness.processor.deleteUnitBookRecords).toHaveBeenCalledWith(written);
+      // And the files go back to the dock, so nothing is left half-filed on either side.
+      expect(harness.storage.moveToPath.mock.calls.slice(3)).toHaveLength(3);
+    });
+
+    /** A rollback that throws must not replace the error that caused it. */
+    it('reports the original failure even when the rollback itself fails', async () => {
+      const harness = makeService();
+      harness.repo.findUnitFiles.mockResolvedValue(AUDIO_UNIT_FILES);
+      arrange(harness);
+      harness.processor.createUnitBookRecords.mockResolvedValue({ bookIds: [77], createdBookIds: [77], attachedFileIds: [] });
+      harness.processor.deleteUnitBookRecords.mockRejectedValue(new Error('rollback exploded'));
+      vi.spyOn(harness.service as never, 'applyMetadata').mockRejectedValue(new Error('metadata exploded') as never);
+
+      const result = await finalize(harness, unitRow());
+
+      expect(result).toMatchObject({ success: false, message: 'metadata exploded' });
+    });
+
+    /**
+     * A disc-foldered unit holds two files called `track01.mp3`. Filing them both by basename put
+     * the second on top of the first, and filed the book under `CD 1` rather than under the book.
+     */
+    it('keeps the disc folders of a unit rather than flattening them onto each other', async () => {
+      const harness = makeService();
+      harness.repo.findUnitFiles.mockResolvedValue([
+        {
+          id: 1,
+          dockFileId: 42,
+          absolutePath: `${UNIT_DIR}/CD 1/track01.mp3`,
+          fileName: 'track01.mp3',
+          fileSize: 10,
+          format: 'mp3',
+          role: 'content',
+          sortOrder: 0,
+        },
+        {
+          id: 2,
+          dockFileId: 42,
+          absolutePath: `${UNIT_DIR}/CD 2/track01.mp3`,
+          fileName: 'track01.mp3',
+          fileSize: 10,
+          format: 'mp3',
+          role: 'content',
+          sortOrder: 1,
+        },
+      ]);
+      arrange(harness);
+      harness.processor.createUnitBookRecords.mockResolvedValue({ bookIds: [80], createdBookIds: [80], attachedFileIds: [] });
+
+      const result = await finalize(harness, unitRow({ absolutePath: `${UNIT_DIR}/CD 1/track01.mp3` }));
+
+      expect(result.success).toBe(true);
+      expect(harness.storage.moveToPath.mock.calls.map((call: string[]) => call[1])).toEqual([
+        '/library/Neuromancer/CD 1/track01.mp3',
+        '/library/Neuromancer/CD 2/track01.mp3',
+      ]);
+      // And the book is the unit's own folder, not the disc the primary happened to sit in.
+      const [, , files] = harness.processor.createUnitBookRecords.mock.calls[0];
+      expect(new Set(files.map((file: { folderPath: string }) => file.folderPath))).toEqual(new Set(['/library/Neuromancer']));
+    });
+
+    /** Twenty of thirty-one files moved and then EXDEV must not leave a half-placed folder. */
+    it('puts back every file it moved when one of them fails', async () => {
+      const harness = makeService();
+      harness.repo.findUnitFiles.mockResolvedValue(AUDIO_UNIT_FILES);
+      arrange(harness);
+      harness.storage.moveToPath.mockResolvedValueOnce(undefined).mockResolvedValueOnce(undefined).mockRejectedValueOnce(new Error('EXDEV'));
+
+      const result = await finalize(harness, unitRow());
+
+      expect(result.success).toBe(false);
+      expect(harness.storage.moveToPath.mock.calls.slice(3)).toEqual([
+        [expect.stringContaining('track-01.mp3'), `${UNIT_DIR}/track-01.mp3`],
+        [expect.stringContaining('track-02.mp3'), `${UNIT_DIR}/track-02.mp3`],
+      ]);
+    });
+
+    /** A folder in a book_per_file library is split apart by the next scan: data loss, not taste. */
+    it('holds a multipart audiobook rather than placing a folder into a book_per_file library', async () => {
+      const harness = makeService();
+      harness.repo.findUnitFiles.mockResolvedValue(AUDIO_UNIT_FILES);
+      arrange(harness, { organizationMode: 'book_per_file' });
+
+      const result = await finalize(harness, unitRow());
+
+      expect(result.success).toBe(false);
+      expect(result.message).toContain('one book per file');
+      expect(harness.storage.moveToPath).not.toHaveBeenCalled();
+    });
+
+    const MULTI_FORMAT_FILES = [
+      {
+        id: 1,
+        dockFileId: 42,
+        absolutePath: '/dock/request-7-Dune/Dune.epub',
+        fileName: 'Dune.epub',
+        fileSize: 10,
+        format: 'epub',
+        role: 'content',
+        sortOrder: 0,
+      },
+      {
+        id: 2,
+        dockFileId: 42,
+        absolutePath: '/dock/request-7-Dune/Dune.pdf',
+        fileName: 'Dune.pdf',
+        fileSize: 10,
+        format: 'pdf',
+        role: 'content',
+        sortOrder: 1,
+      },
+      {
+        id: 3,
+        dockFileId: 42,
+        absolutePath: '/dock/request-7-Dune/cover.jpg',
+        fileName: 'cover.jpg',
+        fileSize: 5,
+        format: 'jpg',
+        role: 'cover',
+        sortOrder: null,
+      },
+    ];
+
+    function multiFormatRow() {
+      return unitRow({ fileName: 'Dune.epub', absolutePath: '/dock/request-7-Dune/Dune.epub', format: 'epub' });
+    }
+
+    it('keeps every format of one book when the setting says all available', async () => {
+      const harness = makeService();
+      harness.repo.findUnitFiles.mockResolvedValue(MULTI_FORMAT_FILES);
+      arrange(harness, { destPath: '/library/Dune/Dune.epub', importFormats: 'all' });
+      harness.processor.createUnitBookRecords.mockResolvedValue({ bookIds: [78], createdBookIds: [78], attachedFileIds: [] });
+
+      const result = await finalize(harness, multiFormatRow());
+
+      expect(result.success).toBe(true);
+      expect(harness.storage.moveToPath).toHaveBeenCalledTimes(3);
+    });
+
+    it('keeps only the library preferred format when the setting says preferred only', async () => {
+      const harness = makeService();
+      harness.repo.findUnitFiles.mockResolvedValue(MULTI_FORMAT_FILES);
+      arrange(harness, { formatPriority: ['pdf', 'epub'], destPath: '/library/Dune/Dune.epub', importFormats: 'preferred' });
+      harness.processor.createUnitBookRecords.mockResolvedValue({ bookIds: [78], createdBookIds: [78], attachedFileIds: [] });
+
+      const result = await finalize(harness, multiFormatRow());
+
+      expect(result.success).toBe(true);
+      // The chosen format and the artwork that came with it; the format that lost is dropped.
+      expect(harness.storage.moveToPath.mock.calls.map((call: string[]) => call[0])).toEqual([
+        '/dock/request-7-Dune/Dune.pdf',
+        '/dock/request-7-Dune/cover.jpg',
+      ]);
+    });
+
+    /**
+     * One book per file is exactly what that mode means, and what its own next scan would produce.
+     * Both books get the metadata: a second book with the same title and none of it is worse than
+     * not importing it.
+     */
+    it('makes one book per format in a book_per_file library when keeping all formats', async () => {
+      const harness = makeService();
+      harness.repo.findUnitFiles.mockResolvedValue(MULTI_FORMAT_FILES);
+      arrange(harness, { organizationMode: 'book_per_file', destPath: '/library/Dune.epub', importFormats: 'all' });
+      harness.processor.createUnitBookRecords.mockResolvedValue({ bookIds: [81, 82], createdBookIds: [81, 82], attachedFileIds: [] });
+      const applyMetadata = vi.spyOn(harness.service as never, 'applyMetadata').mockResolvedValue(undefined as never);
+
+      const result = await finalize(harness, multiFormatRow());
+
+      expect(result).toMatchObject({ success: true, bookId: 81 });
+      // The cover has nowhere to live in a loose-file library, exactly as the scanner treats it.
+      expect(harness.storage.moveToPath).toHaveBeenCalledTimes(2);
+      const [, , looseFiles] = harness.processor.createUnitBookRecords.mock.calls[0];
+      expect(looseFiles.map((file: { folderPath: string }) => file.folderPath)).toEqual(['/library/Dune.epub', '/library/Dune.pdf']);
+      expect(applyMetadata.mock.calls.map((call: unknown[]) => call[0])).toEqual([81, 82]);
+    });
+
+    /**
+     * A pattern with no path separator resolves to a bare filename, and `dirname()` of that is the
+     * library folder root. Without a floor every unit would land there and merge into one book.
+     */
+    it('never places a unit directly in the library folder root', async () => {
+      const harness = makeService();
+      harness.repo.findUnitFiles.mockResolvedValue(AUDIO_UNIT_FILES);
+      arrange(harness, { destPath: '/library/track-01.mp3' });
+      harness.processor.createUnitBookRecords.mockResolvedValue({ bookIds: [79], createdBookIds: [79], attachedFileIds: [] });
+
+      const result = await finalize(harness, unitRow());
+
+      expect(result.success).toBe(true);
+      for (const call of harness.storage.moveToPath.mock.calls) {
+        expect(call[1]).toContain('/library/track-01/');
+      }
+    });
+  });
+
+  /**
+   * A whole failed SELECT, table and column names included, once reached the request drawer of the
+   * person who asked for the book. The cause belongs in the log, not in their status line.
+   */
+  it('does not put a database error into the message a requester reads', async () => {
+    const harness = makeService();
+    const row = makeRow({ targetLibraryId: 5, targetFolderId: 9, unitDirectory: '/dock/request-7-Dune' });
+    const failure = Object.assign(new Error('Failed query: select "id" from "book_dock_unit_files" where ...'), {
+      cause: Object.assign(new Error('syntax error at or near "asc"'), { code: '42601' }),
+    });
+    harness.repo.findUnitFiles.mockRejectedValue(failure);
+    vi.spyOn(harness.service as never, 'findLibraryOrFail').mockResolvedValue({
+      id: 5,
+      name: 'Books',
+      allowedFormats: [],
+      fileNamingPattern: null,
+      formatPriority: [],
+      organizationMode: 'book_per_folder',
+    } as never);
+    vi.spyOn(harness.service as never, 'findFolderOrFail').mockResolvedValue({ id: 9, libraryId: 5, path: '/library' } as never);
+
+    const result = await (harness.service as any).finalizeFile(row, undefined, undefined, new Map(), 1, true);
+
+    expect(result.success).toBe(false);
+    expect(result.message).toBe('Filing this book failed inside BookOrbit. Check the server log for the cause.');
+    expect(result.message).not.toContain('select');
+    expect(result.message).not.toContain('book_dock_unit_files');
+  });
+
   it('cleanupBookDockRecord deletes cover files and bucket row id', async () => {
     const { service, repo } = makeService();
     mockUnlink.mockResolvedValue(undefined);
diff --git a/server/src/modules/book-dock/book-dock-finalize.service.ts b/server/src/modules/book-dock/book-dock-finalize.service.ts
index 25206b182..b33c6b693 100644
--- a/server/src/modules/book-dock/book-dock-finalize.service.ts
+++ b/server/src/modules/book-dock/book-dock-finalize.service.ts
@@ -10,8 +10,8 @@ import {
   OnModuleInit,
   Optional,
 } from '@nestjs/common';
-import { basename, dirname, extname, join, resolve } from 'path';
-import { access as fsAccess, readFile, stat, unlink } from 'fs/promises';
+import { basename, dirname, extname, isAbsolute, join, relative, resolve, sep } from 'path';
+import { access as fsAccess, readFile, rmdir, stat, unlink } from 'fs/promises';
 import { eq, inArray } from 'drizzle-orm';
 import { NodePgDatabase } from 'drizzle-orm/node-postgres';
 
@@ -28,7 +28,17 @@ import type {
   ComicMetadataFields,
   MetadataSeriesMembership,
 } from '@bookorbit/types';
-import { MetadataProviderKey, NotificationType, Permission, parseSeriesIndex, resolveUploadPath } from '@bookorbit/types';
+import {
+  DEFAULT_FORMAT_PRIORITY,
+  isAudioFormat,
+  MetadataProviderKey,
+  NotificationType,
+  parseSeriesIndex,
+  Permission,
+  resolveUploadPath,
+} from '@bookorbit/types';
+import type { BookRequestImportFormats } from '@bookorbit/types';
+import type { FileRole } from '../scanner/lib/classify';
 import { BookReadService } from '../book/book-read.service';
 import { NotificationService } from '../notification/notification.service';
 import { SeriesIdentityService } from '../../common/services/series-identity.service';
@@ -44,7 +54,7 @@ import { AppSettingsService } from '../app-settings/app-settings.service';
 import { LibraryService } from '../library/library.service';
 import { MetadataService } from '../metadata/metadata.service';
 import { MetadataScoreService } from '../metadata-score/metadata-score.service';
-import { UploadProcessorService } from '../upload/upload-processor.service';
+import { UploadProcessorService, type UnitBookFileInput, type UnitBookRecords } from '../upload/upload-processor.service';
 import { UploadStorageService } from '../upload/upload-storage.service';
 import { UploadValidatorService } from '../upload/upload-validator.service';
 import { BookDockRepository } from './book-dock.repository';
@@ -53,7 +63,7 @@ import { BookDockGateway } from './book-dock.gateway';
 import { normalizeBookDockMetadata } from './book-dock-metadata.utils';
 import { BookDockProcessingStateService } from './book-dock-processing-state.service';
 import { BookDockWorkQueue } from './book-dock-work-queue';
-import type { BookDockFileRow } from '../../db/schema';
+import type { BookDockFileRow, BookDockUnitFileRow } from '../../db/schema';
 
 type Db = NodePgDatabase<typeof schema>;
 type LibraryRow = typeof libraries.$inferSelect;
@@ -74,6 +84,7 @@ const MAX_PUBLISHED_YEAR = 2200;
 const PUBLISHED_YEAR_RANGE_CONSTRAINT = 'book_metadata_published_year_range_chk';
 const INVALID_PUBLISHED_YEAR_MESSAGE = `Invalid metadata: published year must be between ${MIN_PUBLISHED_YEAR} and ${MAX_PUBLISHED_YEAR}.`;
 const INVALID_METADATA_MESSAGE = 'Invalid metadata values for this file. Review metadata fields and try again.';
+const INTERNAL_FAILURE_MESSAGE = 'Filing this book failed inside BookOrbit. Check the server log for the cause.';
 const METADATA_PROVIDER_KEYS = new Set<MetadataProviderKey>(Object.values(MetadataProviderKey));
 
 type NormalizedFinalizeMetadata = {
@@ -111,6 +122,14 @@ type NormalizedFinalizeMetadata = {
   comicMetadata: ComicMetadataFields | undefined;
 };
 
+type PlacedUnitFile = {
+  sourcePath: string;
+  destPath: string;
+  format: string | null;
+  role: FileRole;
+  sortOrder: number | null;
+};
+
 type FinalizeCandidateAnalysis = {
   fileId: number;
   fileName: string;
@@ -123,8 +142,77 @@ type FinalizeCandidateAnalysis = {
   folder?: LibraryFolderRow;
   format?: string;
   destPath?: string;
+  /** Every file this row places, primary first. One entry for an ordinary single-file row. */
+  placement?: PlacedUnitFile[];
+  /**
+   * The folder every file of the unit shares, which is what `books.folderPath` has to be. Not the
+   * primary's own directory: a disc-foldered unit puts the primary inside `CD 1`, and taking the
+   * dirname there would file the book under the disc rather than under the book.
+   */
+  bookFolderPath?: string;
 };
 
+/**
+ * What of a unit actually gets placed, given the target library and the instance's format setting.
+ *
+ * Two separate rules meet here. A `book_per_file` library cannot hold a multi-file book at all:
+ * `folderPath` is the file's own path, and `findLooseFileCandidates` emits one candidate per
+ * primary file while intentionally discarding covers and sidecars, so placing a folder there is
+ * not a preference but data loss on the next scan. The format setting is the operator's own
+ * choice about editions, and applies in both modes.
+ *
+ * Multipart audio is never reduced by either: its parts are one book, not competing editions, so
+ * where it cannot be represented it holds for a human rather than importing a third of a book.
+ */
+function reduceUnitForLibrary(
+  unitFiles: BookDockUnitFileRow[],
+  library: LibraryRow,
+  importFormats: BookRequestImportFormats,
+): { files: BookDockUnitFileRow[]; hold?: string } {
+  if (unitFiles.length === 0) return { files: unitFiles };
+
+  const content = unitFiles.filter((file) => file.role === 'content');
+  const looseFileLibrary = library.organizationMode === 'book_per_file';
+  // Sidecars have nowhere to live in a loose-file library, which is exactly what the scanner does
+  // with them there too.
+  const kept = looseFileLibrary ? content : unitFiles;
+  if (content.length <= 1) return { files: kept };
+
+  const multipartAudio = content.every((file) => file.format !== null && isAudioFormat(file.format));
+  if (multipartAudio) {
+    if (!looseFileLibrary) return { files: kept };
+    return {
+      files: content,
+      hold: `This is one audiobook in ${content.length} parts, and "${library.name}" stores one book per file. Choose a library that stores one book per folder.`,
+    };
+  }
+
+  if (importFormats === 'all') return { files: kept };
+
+  const priority = library.formatPriority?.length ? library.formatPriority : [...DEFAULT_FORMAT_PRIORITY];
+  const best = [...content].sort((a, b) => formatRank(a.format, priority) - formatRank(b.format, priority))[0]!;
+  // The chosen format keeps the artwork and sidecars that came with the unit; the other formats go.
+  return { files: looseFileLibrary ? [best] : [best, ...unitFiles.filter((file) => file.role !== 'content')] };
+}
+
+function formatRank(format: string | null, priority: string[]): number {
+  if (!format) return Number.MAX_SAFE_INTEGER;
+  const index = priority.indexOf(format.toLowerCase());
+  return index === -1 ? Number.MAX_SAFE_INTEGER : index;
+}
+
+/**
+ * The folder a unit lands in. Normally the directory of the pattern result, but a pattern with no
+ * path separator resolves to a bare filename whose `dirname()` is the library folder root - which
+ * would drop every unit there and merge unrelated books into one. So a directoryless result falls
+ * back to a folder named for the file, matching what `book_per_folder` does by default.
+ */
+function unitDestinationFolder(destPath: string, folderPath: string): string {
+  const parent = dirname(destPath);
+  if (resolve(parent) !== resolve(folderPath)) return parent;
+  return join(folderPath, basename(destPath, extname(destPath)));
+}
+
 @Injectable()
 export class BookDockFinalizeService implements OnModuleInit, OnApplicationBootstrap, OnModuleDestroy {
   private readonly logger = new Logger(BookDockFinalizeService.name);
@@ -287,30 +375,44 @@ export class BookDockFinalizeService implements OnModuleInit, OnApplicationBoots
       const analysis = await this.classifyDestination(preparedAnalysis, existingDestinations);
       if (analysis.status !== 'ready') return this.analysisToFileResult(analysis);
 
-      const { destPath, folder, library, format } = analysis;
-      if (!destPath || !folder || !library || !format) {
+      const { destPath, folder, library, format, placement } = analysis;
+      if (!destPath || !folder || !library || !format || !placement) {
         return { fileId: row.id, fileName: row.fileName, success: false, message: 'Finalization target could not be resolved' };
       }
 
-      await this.storage.moveToPath(row.absolutePath, destPath);
+      // Every file of the unit, or the single file that is the whole unit. Moved one at a time and
+      // remembered as they land, so a failure part-way can put back exactly what was moved.
+      const moved: Array<{ from: string; to: string }> = [];
+      try {
+        for (const file of placement) {
+          await this.storage.moveToPath(file.sourcePath, file.destPath);
+          moved.push({ from: file.destPath, to: file.sourcePath });
+        }
+      } catch (err) {
+        await this.undoMoves(moved);
+        throw err;
+      }
+
       const persistedDestPath = (await resolveExistingPathSpelling(destPath, folder.path)) ?? destPath;
 
       let bookId: number;
+      let written: UnitBookRecords | null = null;
       try {
-        const { size } = await stat(persistedDestPath);
-        const bookFolderPath = library.organizationMode === 'book_per_file' ? persistedDestPath : dirname(persistedDestPath);
-        ({ bookId } = await this.processor.createBookRecord(
-          library.id,
-          folder.id,
-          bookFolderPath,
-          persistedDestPath,
-          persistedDestPath.substring(folder.path.length + 1),
-          format,
-          size,
-        ));
-        await this.applyMetadata(bookId, row);
+        // The primary is first and the siblings after, because the book row that carries
+        // `primaryFileId` is the one created for the first file. Ordering here is the whole
+        // mechanism by which a 31-track audiobook points at track one rather than at whichever
+        // row happened to insert first.
+        written = await this.createUnitBookRecord(library, folder, placement, persistedDestPath, format, preparedAnalysis.bookFolderPath);
+        bookId = written.bookIds[0]!;
+        // Several ids only in a loose-file library, where each format is its own book. They are the
+        // same work, so they get the same metadata rather than one of them getting all of it.
+        for (const created of written.bookIds) await this.applyMetadata(created, row);
       } catch (err) {
-        await this.storage.moveToPath(destPath, row.absolutePath).catch(() => {});
+        // The books committed before the failure, and metadata runs against services that cannot
+        // join that transaction, so the compensation is explicit: take back exactly what this unit
+        // wrote, then put the files back where they came from.
+        if (written) await this.undoUnitBookRecords(written, row.id);
+        await this.undoMoves(moved);
         throw err;
       }
 
@@ -476,6 +578,12 @@ export class BookDockFinalizeService implements OnModuleInit, OnApplicationBoots
       const format = row.format ?? extname(row.fileName).toLowerCase().slice(1);
       this.validator.validateFormat(row.fileName, library.allowedFormats);
 
+      const unitFiles = row.unitDirectory ? await this.repo.findUnitFiles(row.id) : [];
+      const reduced = reduceUnitForLibrary(unitFiles, library, await this.appSettings.getBookRequestImportFormats());
+      if (reduced.hold) {
+        return { fileId: row.id, fileName: row.fileName, row, status: 'unsupported_layout', message: reduced.hold };
+      }
+
       const patternDestPath = await this.resolveDestination(library, folder.path, row, format);
       let destPath = patternDestPath;
       if (override?.targetFileName) {
@@ -488,9 +596,14 @@ export class BookDockFinalizeService implements OnModuleInit, OnApplicationBoots
         destPath = candidate;
       }
 
+      const { files: placement, bookFolderPath } = this.resolvePlacement(row, reduced.files, destPath, folder.path, library);
+      // The primary's own destination follows the placement, which for a unit means it sits inside
+      // the unit folder rather than at the path the naming pattern produced directly.
+      destPath = placement[0]!.destPath;
+
       const newName = destPath.substring(folder.path.length + 1);
 
-      return { fileId: row.id, fileName: row.fileName, row, status: 'ready', newName, library, folder, format, destPath };
+      return { fileId: row.id, fileName: row.fileName, row, status: 'ready', newName, library, folder, format, destPath, placement, bookFolderPath };
     } catch (error) {
       return {
         fileId: row.id,
@@ -524,12 +637,154 @@ export class BookDockFinalizeService implements OnModuleInit, OnApplicationBoots
     return { analyses, existingDestinations };
   }
 
+  /**
+   * Where each file of the unit lands. A single-file row keeps today's rename-by-pattern exactly,
+   * so nothing about an ordinary upload changes. A unit takes the **directory** of the pattern
+   * result and keeps the original file names inside it: the scanner recovers track order from
+   * those names, and renaming tracks by pattern would need an index token for no gain.
+   */
+  private resolvePlacement(
+    row: BookDockFileRow,
+    unitFiles: BookDockUnitFileRow[],
+    destPath: string,
+    folderPath: string,
+    library: LibraryRow,
+  ): { files: PlacedUnitFile[]; bookFolderPath: string } {
+    if (unitFiles.length === 0) {
+      return {
+        files: [{ sourcePath: row.absolutePath, destPath, format: row.format, role: 'content', sortOrder: 0 }],
+        bookFolderPath: library.organizationMode === 'book_per_file' ? destPath : dirname(destPath),
+      };
+    }
+
+    const primaryIndex = unitFiles.findIndex((file) => file.absolutePath === row.absolutePath);
+    // Primary first: `createBookRecord` sets `primaryFileId` only on the call that creates the book.
+    const ordered = primaryIndex > 0 ? [unitFiles[primaryIndex]!, ...unitFiles.filter((_, index) => index !== primaryIndex)] : unitFiles;
+
+    // A loose-file library has no folder to put a unit in: what survives the reduction lands flat,
+    // each file taking the pattern's own name with its own extension, so the formats stay siblings
+    // rather than one of them keeping a name that belongs to another.
+    if (library.organizationMode === 'book_per_file') {
+      const stem = basename(destPath, extname(destPath));
+      return {
+        files: ordered.map((file, index) => ({
+          sourcePath: file.absolutePath,
+          destPath: index === 0 ? destPath : join(dirname(destPath), this.validator.sanitizeFilename(`${stem}${extname(file.fileName)}`)),
+          format: file.format,
+          role: (file.role as FileRole) ?? 'content',
+          sortOrder: file.sortOrder,
+        })),
+        bookFolderPath: destPath,
+      };
+    }
+
+    const destinationFolder = unitDestinationFolder(destPath, folderPath);
+    return {
+      files: ordered.map((file) => ({
+        sourcePath: file.absolutePath,
+        // The path *within* the unit, not the bare file name: a two-disc audiobook holds two files
+        // called `track01.mp3`, and flattening them makes the second overwrite the first.
+        destPath: join(destinationFolder, this.unitRelativeName(row, file)),
+        format: file.format,
+        role: (file.role as FileRole) ?? 'content',
+        sortOrder: file.sortOrder,
+      })),
+      bookFolderPath: destinationFolder,
+    };
+  }
+
+  /** Each segment sanitized on its own, so the subdirectory survives rather than the separator. */
+  private unitRelativeName(row: BookDockFileRow, file: BookDockUnitFileRow): string {
+    if (!row.unitDirectory) return this.validator.sanitizeFilename(file.fileName);
+    const within = relative(row.unitDirectory, file.absolutePath);
+    if (!within || within.startsWith('..') || isAbsolute(within)) return this.validator.sanitizeFilename(file.fileName);
+    return within
+      .split(sep)
+      .map((segment) => this.validator.sanitizeFilename(segment))
+      .join(sep);
+  }
+
+  /** Undoes a part-placed unit. Never throws: it runs while another error is on its way up. */
+  private async undoMoves(moved: Array<{ from: string; to: string }>): Promise<void> {
+    for (const move of moved) {
+      await this.storage.moveToPath(move.from, move.to).catch(() => {});
+    }
+  }
+
+  /**
+   * Turns a placed unit into book rows. In `book_per_folder` every file shares one `folderPath`,
+   * so `createBookRecord` folds them into a single book. In `book_per_file` each file *is* its own
+   * folderPath, so several formats become several books - which is that mode's normal state, and
+   * what its next scan would produce anyway.
+   *
+   * Returns every book created, primary first, so the caller can give each one the metadata: two
+   * extra books with the same title and none of its metadata would be worse than not importing
+   * them at all.
+   */
+  private async createUnitBookRecord(
+    library: LibraryRow,
+    folder: LibraryFolderRow,
+    placement: PlacedUnitFile[],
+    persistedPrimaryPath: string,
+    primaryFormat: string,
+    bookFolderPath: string | undefined,
+  ): Promise<UnitBookRecords> {
+    if (placement.length === 0) throw new Error('Finalization placed no files');
+
+    const loose = library.organizationMode === 'book_per_file';
+    const sharedFolderPath = bookFolderPath ?? dirname(persistedPrimaryPath);
+    const files: UnitBookFileInput[] = [];
+
+    for (const [index, file] of placement.entries()) {
+      const absolutePath = index === 0 ? persistedPrimaryPath : file.destPath;
+      const format = index === 0 ? primaryFormat : (file.format ?? extname(absolutePath).toLowerCase().slice(1));
+      const { size } = await stat(absolutePath);
+      files.push({
+        folderPath: loose ? absolutePath : sharedFolderPath,
+        absolutePath,
+        relPath: absolutePath.substring(folder.path.length + 1),
+        format,
+        sizeBytes: size,
+        role: file.role,
+        sortOrder: file.sortOrder,
+      });
+    }
+
+    return this.processor.createUnitBookRecords(library.id, folder.id, files);
+  }
+
+  /** Never throws: it runs while the error that caused it is already on its way up. */
+  private async undoUnitBookRecords(written: UnitBookRecords, dockFileId: number): Promise<void> {
+    try {
+      await this.processor.deleteUnitBookRecords(written);
+    } catch (err) {
+      this.logger.error(
+        `[book_dock.finalize_rollback] [fail] dockFileId=${dockFileId} bookIds=${written.createdBookIds.join(',')} error="${sanitizeLogValue(
+          err instanceof Error ? err.message : String(err),
+        )}" - could not take back the book rows this unit created`,
+      );
+    }
+  }
+
   private async classifyDestination(
     analysis: FinalizeCandidateAnalysis,
     existingDestinations: Map<string, number>,
   ): Promise<FinalizeCandidateAnalysis> {
     if (analysis.status !== 'ready' || !analysis.destPath || !analysis.library) return analysis;
 
+    // Every target path of a unit, not only the primary's: a folder that collides on track 7 is
+    // just as unplaceable as one that collides on track 1.
+    for (const file of analysis.placement ?? []) {
+      if (file.destPath === analysis.destPath) continue;
+      const taken = await fsAccess(file.destPath).then(
+        () => true,
+        () => false,
+      );
+      if (taken) {
+        return { ...analysis, status: 'destination_conflict', message: 'A file with this name already exists at the target location' };
+      }
+    }
+
     try {
       await fsAccess(analysis.destPath);
     } catch (error) {
@@ -639,6 +894,9 @@ export class BookDockFinalizeService implements OnModuleInit, OnApplicationBoots
 
     const row = await this.repo.findById(fileId);
     if (!row) return;
+    // Another module put this row here and runs its own checks before filing it. Racing it would
+    // either file the wrong book into the right library or file it before those checks ran.
+    if (row.autoFinalizeSuppressed) return;
     if (!shouldAutoFinalize(row, settings.metadataMode, settings.threshold)) return;
 
     const autoFinalizeMetadata = resolveAutoFinalizeMetadata(settings.metadataMode, row.embeddedMetadata, row.fetchedMetadata, row.selectedMetadata);
@@ -668,6 +926,35 @@ export class BookDockFinalizeService implements OnModuleInit, OnApplicationBoots
     }
   }
 
+  /**
+   * Finalize one row on behalf of the module that owns it, after that module's own verification
+   * has passed. Deliberately not the public `finalize()`: that one is a user-initiated batch and
+   * announces itself with a "finalization completed" notification, which is not what a request
+   * landing in a library should say.
+   *
+   * Metadata is merged the same way the standard path merges it, rather than following the Book
+   * Dock's auto-finalize metadata mode: that mode is an operator preference about unattended dock
+   * files, and it does not govern a file another module vouched for.
+   */
+  async finalizeManagedFile(fileId: number, override: { libraryId?: number; folderId?: number }): Promise<BookDockFinalizeFileResult> {
+    const row = await this.repo.findById(fileId);
+    if (!row) {
+      return { fileId, fileName: `book-dock-file-${fileId}`, success: false, message: 'Book Dock file not found' };
+    }
+
+    const merged = mergeBookDockMetadata(row.embeddedMetadata, row.fetchedMetadata, row.selectedMetadata);
+    const rowForFinalize = merged ? { ...row, selectedMetadata: merged } : row;
+
+    const overrideMap = new Map<number, FinalizeOverrideEntry>();
+    if (override.libraryId !== undefined || override.folderId !== undefined) {
+      overrideMap.set(fileId, { libraryId: override.libraryId, folderId: override.folderId });
+    }
+
+    const result = await this.finalizeFile(rowForFinalize, undefined, undefined, overrideMap, 0, true);
+    if (result.success) this.emitChange();
+    return result;
+  }
+
   private enqueueAutoFinalize(fileId: number): void {
     if (this.processingState.getCachedPaused()) this.autoFinalizeQueue.pause();
     this.autoFinalizeQueue.enqueue(fileId);
@@ -701,6 +988,7 @@ export class BookDockFinalizeService implements OnModuleInit, OnApplicationBoots
       if (rows.length === 0) break;
 
       for (const row of rows) {
+        if (row.autoFinalizeSuppressed) continue;
         if (shouldAutoFinalize(row, settings.metadataMode, settings.threshold) && this.autoFinalizeQueue.enqueue(row.id)) {
           queued++;
         }
@@ -900,10 +1188,18 @@ export class BookDockFinalizeService implements OnModuleInit, OnApplicationBoots
       const thumbPath = row.coverPath.replace(/\.\w+$/, '_thumb.jpg');
       await safeUnlink(thumbPath);
     }
+    // The unit's files have all been moved into the library by now, so what is left is the empty
+    // directory they came out of. The child rows go with the anchor via the cascade.
+    if (row.unitDirectory) await removeEmptyDirectory(row.unitDirectory);
     await this.repo.deleteById(row.id);
   }
 
+  /** Discarding a unit throws away every file in it. Discarding track 1 of 31 is not a thing. */
   private async cleanupDiscardedBookDockFile(row: BookDockFileRow): Promise<void> {
+    if (row.unitDirectory) {
+      for (const file of await this.repo.findUnitFiles(row.id)) await safeUnlink(file.absolutePath);
+      await removeEmptyDirectory(row.unitDirectory);
+    }
     await safeUnlink(row.absolutePath);
     if (row.coverPath) {
       await safeUnlink(row.coverPath);
@@ -937,6 +1233,14 @@ async function safeUnlink(path: string): Promise<void> {
   }
 }
 
+/**
+ * Deliberately non-recursive. A directory that still holds files is one the dock did not fully
+ * account for, and leaving it for a human to look at is far better than deleting what is in it.
+ */
+async function removeEmptyDirectory(path: string): Promise<void> {
+  await rmdir(path).catch(() => {});
+}
+
 function createFinalizePreviewSummary(): BookDockFinalizePreviewResult {
   return {
     total: 0,
@@ -1198,12 +1502,29 @@ function resolveFinalizeErrorMessage(error: unknown): string {
   if (isBookMetadataConstraintViolation(error)) {
     return INVALID_METADATA_MESSAGE;
   }
+  // A database error is not a sentence for a requester to read. One shipped verbatim - a whole
+  // failed SELECT, table and column names included - into the request drawer of the person who
+  // asked for the book. The detail belongs in the log, which already has the original error.
+  if (isDatabaseError(error)) {
+    return INTERNAL_FAILURE_MESSAGE;
+  }
   if (error instanceof Error && error.message) {
     return error.message;
   }
   return 'Finalization failed';
 }
 
+/**
+ * A `pg` error carries a five-character SQLSTATE. Drizzle wraps it in a `DrizzleQueryError` whose
+ * own message is the failed query, so the chain is walked rather than the outermost error read.
+ */
+function isDatabaseError(error: unknown): boolean {
+  for (const entry of iterateErrorChain(error)) {
+    if (/^[0-9A-Z]{5}$/.test(asString(entry.code))) return true;
+  }
+  return false;
+}
+
 function isPublishedYearConstraintViolation(error: unknown): boolean {
   for (const entry of iterateErrorChain(error)) {
     if (entry.code === '23514') {
diff --git a/server/src/modules/book-dock/book-dock-ingest.service.test.ts b/server/src/modules/book-dock/book-dock-ingest.service.test.ts
index e425fb053..4fa9c20f8 100644
--- a/server/src/modules/book-dock/book-dock-ingest.service.test.ts
+++ b/server/src/modules/book-dock/book-dock-ingest.service.test.ts
@@ -3,6 +3,7 @@ import { Readable } from 'stream';
 import { mkdir, realpath, stat } from 'fs/promises';
 
 import { BookDockIngestService } from './book-dock-ingest.service';
+import { buildSingleBookCandidate } from '../scanner/lib/walk';
 
 vi.mock('fs/promises', () => ({
   mkdir: vi.fn().mockResolvedValue(undefined),
@@ -10,6 +11,13 @@ vi.mock('fs/promises', () => ({
   stat: vi.fn(),
 }));
 
+// Only the folder read is mocked; the interpreter is left real, because what this covers is
+// exactly whether its grouping is applied to the folder's files.
+vi.mock('../scanner/lib/walk', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('../scanner/lib/walk')>()),
+  buildSingleBookCandidate: vi.fn(),
+}));
+
 const mockedStat = vi.mocked(stat);
 
 function makeService(bookDockPath = '/books/book-dock') {
@@ -22,6 +30,7 @@ function makeService(bookDockPath = '/books/book-dock') {
 
   const repo = {
     create: vi.fn(),
+    createUnit: vi.fn().mockImplementation((data: Record<string, unknown>) => Promise.resolve({ id: 900, ...data })),
     findById: vi.fn(),
     findByAbsolutePath: vi.fn().mockResolvedValue(null),
     findSelectionBatch: vi.fn(),
@@ -288,6 +297,77 @@ describe('BookDockIngestService', () => {
     });
   });
 
+  describe('ingestUnitDirectory', () => {
+    function candidateFile(absolutePath: string, format: string, role = 'content') {
+      return { absolutePath, relPath: absolutePath, ino: 1n, sizeBytes: 10, mtime: new Date(), format, role };
+    }
+
+    /**
+     * The bug this replaced: `walkAndIngest` created one row per file, so a 31-track audiobook
+     * became 31 books, each resolving its destination from its own chapter-named ID3 tags.
+     */
+    it('makes one unit out of a multipart audiobook folder, anchored on track one', async () => {
+      const { service, repo } = makeService();
+      vi.mocked(buildSingleBookCandidate).mockResolvedValue({
+        folderPath: '/books/book-dock/Neuromancer',
+        files: [
+          candidateFile('/books/book-dock/Neuromancer/Chapter 1.mp3', 'mp3'),
+          candidateFile('/books/book-dock/Neuromancer/Chapter 2.mp3', 'mp3'),
+          candidateFile('/books/book-dock/Neuromancer/cover.jpg', 'jpg', 'cover'),
+        ],
+      } as never);
+
+      await expect(service.ingestUnitDirectory('/books/book-dock/Neuromancer')).resolves.toBe(1);
+
+      expect(repo.createUnit).toHaveBeenCalledTimes(1);
+      const [anchor, files] = repo.createUnit.mock.calls[0];
+      expect(anchor).toMatchObject({ fileName: 'Chapter 1.mp3', unitDirectory: '/books/book-dock/Neuromancer', format: 'mp3' });
+      expect(files.map((file: { fileName: string; sortOrder: number | null }) => [file.fileName, file.sortOrder])).toEqual([
+        ['Chapter 1.mp3', 0],
+        ['Chapter 2.mp3', 1],
+        ['cover.jpg', null],
+      ]);
+    });
+
+    /**
+     * `buildSingleBookCandidate` returns one candidate for any folder, so without the interpreter
+     * a dropped comic run would become a single book of sixty files.
+     */
+    it('makes one unit per issue out of a dropped comic run', async () => {
+      const { service, repo } = makeService();
+      vi.mocked(buildSingleBookCandidate).mockResolvedValue({
+        folderPath: '/books/book-dock/Saga',
+        files: [candidateFile('/books/book-dock/Saga/Saga 001.cbz', 'cbz'), candidateFile('/books/book-dock/Saga/Saga 002.cbz', 'cbz')],
+      } as never);
+
+      await expect(service.ingestUnitDirectory('/books/book-dock/Saga')).resolves.toBe(2);
+
+      // None of them owns the folder: claiming it would hide the others from the watcher, and
+      // deleting one would take the whole folder with it.
+      for (const [anchor] of repo.createUnit.mock.calls) expect(anchor.unitDirectory).toBeNull();
+    });
+
+    it('ignores a folder with no supported book file', async () => {
+      const { service, repo } = makeService();
+      vi.mocked(buildSingleBookCandidate).mockResolvedValue(null as never);
+
+      await expect(service.ingestUnitDirectory('/books/book-dock/empty')).resolves.toBe(0);
+      expect(repo.createUnit).not.toHaveBeenCalled();
+    });
+
+    it('skips a unit whose primary file already has a row', async () => {
+      const { service, repo } = makeService();
+      repo.findByAbsolutePath.mockResolvedValue({ id: 3 });
+      vi.mocked(buildSingleBookCandidate).mockResolvedValue({
+        folderPath: '/books/book-dock/Dune',
+        files: [candidateFile('/books/book-dock/Dune/Dune.epub', 'epub')],
+      } as never);
+
+      await expect(service.ingestUnitDirectory('/books/book-dock/Dune')).resolves.toBe(0);
+      expect(repo.createUnit).not.toHaveBeenCalled();
+    });
+  });
+
   describe('retryFetch', () => {
     it('ignores missing, non-error, or formatless rows', async () => {
       const { service, repo } = makeService();
diff --git a/server/src/modules/book-dock/book-dock-ingest.service.ts b/server/src/modules/book-dock/book-dock-ingest.service.ts
index 9902ba977..cbfb141f6 100644
--- a/server/src/modules/book-dock/book-dock-ingest.service.ts
+++ b/server/src/modules/book-dock/book-dock-ingest.service.ts
@@ -1,6 +1,6 @@
 import { BadRequestException, Injectable, Logger, OnApplicationBootstrap, OnModuleDestroy } from '@nestjs/common';
 import { ConfigService } from '@nestjs/config';
-import { basename, extname, join } from 'path';
+import { basename, extname, join, relative, sep } from 'path';
 import { mkdir, realpath, stat } from 'fs/promises';
 import { Readable } from 'stream';
 
@@ -11,6 +11,8 @@ import { SUPPORTED_BOOK_FORMATS, UploadValidatorService } from '../upload/upload
 import { UploadStorageService } from '../upload/upload-storage.service';
 import { AppSettingsService } from '../app-settings/app-settings.service';
 import { MetadataFetchPipeline } from '../metadata-fetch/metadata-fetch-pipeline';
+import { interpretRelease } from '../scanner/lib/release-plan';
+import { buildSingleBookCandidate } from '../scanner/lib/walk';
 import { BookDockRepository } from './book-dock.repository';
 import { BookDockMetadataService } from './book-dock-metadata.service';
 import { BookDockEventsService, BOOK_DOCK_FILE_INGESTED } from './book-dock-events.service';
@@ -165,6 +167,76 @@ export class BookDockIngestService implements OnApplicationBootstrap, OnModuleDe
     return row.id;
   }
 
+  /**
+   * A folder dropped into the dock, read as books rather than as loose files. Returns how many
+   * units it created.
+   *
+   * The folder is read once with the scanner's own `buildSingleBookCandidate`, which already
+   * handles disc subdirectories, natural sort, roles and covers. Its file list then goes through
+   * the release interpreter for **grouping**, because `buildSingleBookCandidate` returns exactly
+   * one candidate for any folder whatever it holds: a dropped 60-issue comic run would otherwise
+   * become one book of 60 files, and the dock would disagree with the request pipeline about the
+   * same folder.
+   */
+  async ingestUnitDirectory(unitDirectory: string): Promise<number> {
+    const candidate = await buildSingleBookCandidate(unitDirectory, unitDirectory, [], (message) =>
+      this.logger.debug(`[book_dock.ingest_unit] ${sanitizeLogValue(message)}`),
+    );
+    if (!candidate) return 0;
+
+    const byPath = new Map(candidate.files.map((file) => [file.absolutePath, file]));
+    const plan = interpretRelease(
+      candidate.files.map((file) => ({ path: relative(unitDirectory, file.absolutePath).split(sep).join('/'), sizeBytes: file.sizeBytes })),
+      { rootName: basename(unitDirectory) },
+    );
+
+    let created = 0;
+    for (const unit of plan.units) {
+      const primaryPath = join(unitDirectory, unit.primaryPath);
+      if (await this.repo.findByAbsolutePath(primaryPath)) continue;
+
+      const primary = byPath.get(primaryPath);
+      if (!primary?.format || !SUPPORTED_BOOK_FORMATS.has(primary.format)) continue;
+
+      // One unit per folder is the ordinary case, and it owns the folder outright. Several units
+      // share it, so none of them may claim it: claiming would make the others invisible to the
+      // watcher, and deleting one would take the whole folder with it.
+      const owned = plan.units.length === 1;
+
+      const row = await this.repo.createUnit(
+        {
+          fileName: basename(primaryPath),
+          absolutePath: primaryPath,
+          fileSize: primary.sizeBytes,
+          format: primary.format,
+          unitDirectory: owned ? unitDirectory : null,
+          status: 'pending',
+        },
+        unit.files.map((file) => {
+          const stat = byPath.get(join(unitDirectory, file.path));
+          return {
+            absolutePath: join(unitDirectory, file.path),
+            fileName: basename(file.path),
+            fileSize: stat?.sizeBytes ?? file.sizeBytes,
+            format: file.format,
+            role: file.role,
+            sortOrder: file.sortOrder,
+          };
+        }),
+      );
+
+      this.extractMetadataAsync(row.id, primary.format, metadataQueuePriority(row));
+      created++;
+    }
+
+    if (created > 0) {
+      this.logger.log(
+        `[book_dock.ingest_unit] [end] path="${sanitizeLogValue(unitDirectory)}" units=${created} files=${candidate.files.length} - folder ingested as units`,
+      );
+    }
+    return created;
+  }
+
   private extractMetadataAsync(fileId: number, format: string, priority?: BookDockWorkPriority): boolean {
     if (!isSupportedFormat(format)) return false;
     if (this.processingState.getCachedPaused()) this.metadataQueue.pause();
diff --git a/server/src/modules/book-dock/book-dock-unit-files.sql.test.ts b/server/src/modules/book-dock/book-dock-unit-files.sql.test.ts
new file mode 100644
index 000000000..4b886e29c
--- /dev/null
+++ b/server/src/modules/book-dock/book-dock-unit-files.sql.test.ts
@@ -0,0 +1,28 @@
+import { drizzle } from 'drizzle-orm/node-postgres';
+import { describe, expect, it } from 'vitest';
+
+import { bookDockUnitFiles } from '../../db/schema';
+import { UNIT_FILE_ORDER } from './book-dock.repository';
+
+/**
+ * `book-dock.repository.test.ts` mocks `drizzle-orm` down to plain objects, so it cannot see the
+ * SQL that comes out the other end. This builds the real clause and reads the string.
+ *
+ * It exists because of a bug that shipped: `asc(sql\`x nulls last\`)` renders as
+ * `x nulls last asc`, which Postgres rejects outright, so every finalize of a multi-file unit died
+ * with a syntax error that reached the requester as "Held for review: Failed query".
+ */
+const db = drizzle({} as never);
+
+describe('book_dock_unit_files ordering', () => {
+  it('puts the direction before the null placement, the only order Postgres accepts', () => {
+    const rendered = db
+      .select()
+      .from(bookDockUnitFiles)
+      .orderBy(...UNIT_FILE_ORDER)
+      .toSQL().sql;
+
+    expect(rendered).toContain('"sort_order" asc nulls last');
+    expect(rendered).not.toContain('nulls last asc');
+  });
+});
diff --git a/server/src/modules/book-dock/book-dock-watcher.service.test.ts b/server/src/modules/book-dock/book-dock-watcher.service.test.ts
index c235a5155..c76ded77b 100644
--- a/server/src/modules/book-dock/book-dock-watcher.service.test.ts
+++ b/server/src/modules/book-dock/book-dock-watcher.service.test.ts
@@ -4,12 +4,16 @@ vi.mock('../scanner/lib/classify', () => ({
 
 vi.mock('../scanner/lib/stability', () => ({
   waitForStability: vi.fn(),
+  waitForDirectoryStability: vi.fn().mockResolvedValue(undefined),
 }));
 
 vi.mock('fs/promises', () => ({
   mkdir: vi.fn(),
   readdir: vi.fn(),
   realpath: vi.fn().mockImplementation((p: string) => Promise.resolve(p)),
+  // A path under the dock root is a loose file unless a test says otherwise, which is what
+  // `isUnitDirectory` asks about.
+  stat: vi.fn().mockResolvedValue({ isDirectory: () => false }),
   unlink: vi.fn(),
 }));
 
@@ -17,11 +21,11 @@ vi.mock('chokidar', () => ({
   watch: vi.fn(),
 }));
 
-import { mkdir, readdir, realpath, unlink } from 'fs/promises';
+import { mkdir, readdir, realpath, stat, unlink } from 'fs/promises';
 import { watch } from 'chokidar';
 
 import { isPrimaryFormat } from '../scanner/lib/classify';
-import { waitForStability } from '../scanner/lib/stability';
+import { waitForDirectoryStability, waitForStability } from '../scanner/lib/stability';
 import { BookDockWatcherService } from './book-dock-watcher.service';
 
 function makeService(bookDockPath = '/data/book-dock') {
@@ -30,9 +34,11 @@ function makeService(bookDockPath = '/data/book-dock') {
   };
   const ingestService = {
     ingestFromWatchedFolder: vi.fn(),
+    ingestUnitDirectory: vi.fn().mockResolvedValue(0),
   };
   const repo = {
     findByAbsolutePath: vi.fn(),
+    findByUnitDirectory: vi.fn().mockResolvedValue(undefined),
     deleteById: vi.fn(),
     countsByStatus: vi.fn().mockResolvedValue({ pending: 1, ready: 2, error: 0, total: 3 }),
   };
@@ -154,7 +160,11 @@ describe('BookDockWatcherService', () => {
     expect(ingestService.ingestFromWatchedFolder).not.toHaveBeenCalled();
   });
 
-  it('walkAndIngest skips covers folder and ingests supported files recursively', async () => {
+  /**
+   * The recursion this replaced turned a dropped folder of 31 tracks into 31 independent rows,
+   * each resolving its own destination from its own chapter-named tags.
+   */
+  it('walkAndIngest skips covers, ingests loose files, and hands folders over whole', async () => {
     const { service, ingestService } = makeService();
     vi.mocked(isPrimaryFormat).mockImplementation((path: string) => path.endsWith('.epub') || path.endsWith('.pdf'));
     vi.mocked(readdir).mockImplementation((dir: string) => {
@@ -177,8 +187,65 @@ describe('BookDockWatcherService', () => {
     await (service as any).walkAndIngest('/data/book-dock');
 
     expect(ingestService.ingestFromWatchedFolder).toHaveBeenCalledWith('/data/book-dock/root.epub');
-    expect(ingestService.ingestFromWatchedFolder).toHaveBeenCalledWith('/data/book-dock/nested/inner.pdf');
-    expect(ingestService.ingestFromWatchedFolder).not.toHaveBeenCalledWith('/data/book-dock/nested/note.txt');
+    expect(ingestService.ingestFromWatchedFolder).not.toHaveBeenCalledWith('/data/book-dock/nested/inner.pdf');
+    expect(ingestService.ingestUnitDirectory).toHaveBeenCalledWith('/data/book-dock/nested');
+    expect(ingestService.ingestUnitDirectory).not.toHaveBeenCalledWith('/data/book-dock/covers');
+  });
+
+  it('leaves a directory alone once a unit row has claimed it', async () => {
+    const { service, ingestService, repo } = makeService();
+    repo.findByUnitDirectory.mockResolvedValue({ id: 4 });
+
+    await (service as any).ingestUnitDirectory('/data/book-dock/request-7-audiobook');
+
+    expect(ingestService.ingestUnitDirectory).not.toHaveBeenCalled();
+  });
+
+  /** A dropped folder fires one `add` per file inside it, never a usable `addDir`. */
+  it('routes a file event inside a folder to that folder as a unit', async () => {
+    const { service, ingestService } = makeService();
+
+    await (service as any).process('create', '/data/book-dock/Neuromancer/Chapter 3.mp3');
+
+    expect(ingestService.ingestUnitDirectory).toHaveBeenCalledWith('/data/book-dock/Neuromancer');
+    expect(ingestService.ingestFromWatchedFolder).not.toHaveBeenCalled();
+  });
+
+  /**
+   * A folder still being copied is not yet a book: interpreting it now reads a partial snapshot,
+   * and the row it creates claims the directory so the tracks that follow are never looked at.
+   */
+  it('waits for a dropped folder to stop growing before interpreting it', async () => {
+    const { service, ingestService } = makeService();
+    const order: string[] = [];
+    vi.mocked(waitForDirectoryStability).mockImplementationOnce(() => {
+      order.push('wait');
+      return Promise.resolve();
+    });
+    ingestService.ingestUnitDirectory.mockImplementation(() => {
+      order.push('ingest');
+      return Promise.resolve(1);
+    });
+
+    await (service as any).ingestUnitDirectory('/data/book-dock/Neuromancer');
+
+    expect(waitForDirectoryStability).toHaveBeenCalledWith('/data/book-dock/Neuromancer');
+    expect(order).toEqual(['wait', 'ingest']);
+  });
+
+  /**
+   * The other way a unit arrives: chokidar's `addDir` for the folder itself, which is a directory
+   * one level below the root rather than a file. Only `stat` tells the two apart.
+   */
+  it('routes an event for the folder itself to the unit path', async () => {
+    const { service, ingestService } = makeService();
+    vi.mocked(stat).mockResolvedValueOnce({ isDirectory: () => true } as never);
+
+    await (service as any).process('create', '/data/book-dock/Neuromancer');
+
+    expect(stat).toHaveBeenCalledWith('/data/book-dock/Neuromancer');
+    expect(ingestService.ingestUnitDirectory).toHaveBeenCalledWith('/data/book-dock/Neuromancer');
+    expect(ingestService.ingestFromWatchedFolder).not.toHaveBeenCalled();
   });
 
   it('onModuleDestroy clears timers and unsubscribes active watcher', async () => {
diff --git a/server/src/modules/book-dock/book-dock-watcher.service.ts b/server/src/modules/book-dock/book-dock-watcher.service.ts
index 995e4f4b8..1b991c7fc 100644
--- a/server/src/modules/book-dock/book-dock-watcher.service.ts
+++ b/server/src/modules/book-dock/book-dock-watcher.service.ts
@@ -2,11 +2,11 @@ import { Injectable, Logger, OnApplicationBootstrap, OnModuleDestroy } from '@ne
 import { ConfigService } from '@nestjs/config';
 import { watch, type FSWatcher } from 'chokidar';
 import { Dirent } from 'fs';
-import { mkdir, readdir, realpath, unlink } from 'fs/promises';
-import { join } from 'path';
+import { mkdir, readdir, realpath, stat, unlink } from 'fs/promises';
+import { join, sep } from 'path';
 
 import { isPrimaryFormat } from '../scanner/lib/classify';
-import { waitForStability } from '../scanner/lib/stability';
+import { waitForDirectoryStability, waitForStability } from '../scanner/lib/stability';
 import { BookDockIngestService } from './book-dock-ingest.service';
 import { BookDockRepository } from './book-dock.repository';
 import { BookDockGateway } from './book-dock.gateway';
@@ -93,19 +93,37 @@ export class BookDockWatcherService implements OnApplicationBootstrap, OnModuleD
     return rel.startsWith(COVERS_DIR + '/') || rel === COVERS_DIR;
   }
 
+  /**
+   * Debounced on the **unit directory** rather than on the file, because a dropped folder fires one
+   * `add` per file inside it. Keyed per file, a 31-track folder produced 31 timers and the first
+   * one interpreted the directory 500 ms after the first track landed; the claim check then
+   * silently dropped the other thirty events. One key means the timer resets on every arrival and
+   * fires once, after the last one.
+   */
   private schedule(type: EventType, path: string): void {
-    const existing = this.pendingTimers.get(path);
+    const key = (type === 'create' ? this.unitDirectoryFor(path) : null) ?? path;
+    const existing = this.pendingTimers.get(key);
     if (existing) clearTimeout(existing.timer);
     const timer = setTimeout(() => {
-      this.pendingTimers.delete(path);
-      this.process(type, path).catch((err) => this.logger.error(`Failed to process ${type} for ${path}: ${(err as Error).message}`));
+      this.pendingTimers.delete(key);
+      this.process(type, key).catch((err) => this.logger.error(`Failed to process ${type} for ${key}: ${(err as Error).message}`));
     }, DEBOUNCE_MS);
-    this.pendingTimers.set(path, { timer, type });
+    this.pendingTimers.set(key, { timer, type });
   }
 
   private async process(type: EventType, path: string): Promise<void> {
     if (type === 'create') {
       if (await this.processingState.isPaused()) return;
+
+      // A directory below the dock root is a unit, and a unit is ingested whole rather than as a
+      // stream of loose files. `schedule` has already collapsed a file event onto its unit
+      // directory, so what arrives here for a dropped folder is the folder itself.
+      const unitDirectory = this.unitDirectoryFor(path) ?? ((await this.isUnitDirectory(path)) ? path : null);
+      if (unitDirectory !== null) {
+        await this.ingestUnitDirectory(unitDirectory);
+        return;
+      }
+
       if (!isPrimaryFormat(path)) return;
       await waitForStability(path);
       if (await this.processingState.isPaused()) return;
@@ -124,6 +142,57 @@ export class BookDockWatcherService implements OnApplicationBootstrap, OnModuleD
     }
   }
 
+  /**
+   * The directory one level below the dock root that owns this path, or null when the path is a
+   * loose file sitting at the root.
+   *
+   * Units are always exactly one level down, which is what keeps this an equality lookup on a
+   * unique column rather than an ancestor walk over an unbounded path.
+   */
+  private unitDirectoryFor(path: string): string | null {
+    if (!path.startsWith(this.bookDockPath + sep)) return null;
+    const [first, ...rest] = path.substring(this.bookDockPath.length + 1).split(sep);
+    if (!first || rest.length === 0) return null;
+    if (first === COVERS_DIR) return null;
+    return join(this.bookDockPath, first);
+  }
+
+  /**
+   * Ingests a dropped folder as one or more units. Before this, `walkAndIngest` created an
+   * independent row per file, so a 31-track audiobook became 31 books whose destinations were each
+   * resolved from their own chapter-named ID3 tags. No error, just quietly wrong.
+   */
+  private async ingestUnitDirectory(unitDirectory: string): Promise<void> {
+    // Claimed means the importer created the row before the directory existed, precisely so this
+    // check cannot lose the race to chokidar's first event.
+    if (await this.repo.findByUnitDirectory(unitDirectory)) return;
+    if (await this.processingState.isPaused()) return;
+
+    // A folder still being copied is a folder that is not yet a book. Interpreting it now reads a
+    // partial snapshot, and the row it creates then claims the directory so the tracks that arrive
+    // afterwards are never looked at again.
+    await waitForDirectoryStability(unitDirectory);
+
+    // Re-checked because the wait is long enough for the importer to have claimed the directory,
+    // or for an operator to have paused processing, in the meantime.
+    if (await this.repo.findByUnitDirectory(unitDirectory)) return;
+    if (await this.processingState.isPaused()) return;
+
+    const created = await this.ingestService.ingestUnitDirectory(unitDirectory);
+    if (created > 0) this.emitChange();
+  }
+
+  /** A path one level below the dock root that is a directory, i.e. an `addDir` for a unit. */
+  private async isUnitDirectory(path: string): Promise<boolean> {
+    if (!path.startsWith(this.bookDockPath + sep)) return false;
+    const rest = path.substring(this.bookDockPath.length + 1);
+    if (rest.length === 0 || rest.includes(sep) || rest === COVERS_DIR) return false;
+    return stat(path).then(
+      (info) => info.isDirectory(),
+      () => false,
+    );
+  }
+
   private async walkAndIngest(dir: string): Promise<void> {
     if (await this.processingState.isPaused()) return;
 
@@ -139,7 +208,7 @@ export class BookDockWatcherService implements OnApplicationBootstrap, OnModuleD
       const full = join(dir, entry.name);
       if (entry.isDirectory()) {
         if (entry.name === COVERS_DIR && dir === this.bookDockPath) continue;
-        await this.walkAndIngest(full);
+        await this.ingestUnitDirectory(full);
       } else if (entry.isFile() && isPrimaryFormat(full)) {
         await this.ingestService.ingestFromWatchedFolder(full);
       }
diff --git a/server/src/modules/book-dock/book-dock.gateway.ts b/server/src/modules/book-dock/book-dock.gateway.ts
index 930f479fa..0ab136e06 100644
--- a/server/src/modules/book-dock/book-dock.gateway.ts
+++ b/server/src/modules/book-dock/book-dock.gateway.ts
@@ -5,8 +5,9 @@ import { Server, Socket } from 'socket.io';
 
 import { AuthService } from '../auth/auth.service';
 import { rejectSocketConnection } from '../../common/utils/ws-auth.utils';
+import { wsCorsOrigin } from '../../common/utils/ws-cors.utils';
 
-@WebSocketGateway({ namespace: '/book-dock', cors: { origin: process.env.CLIENT_URL ?? 'http://localhost:5173' } })
+@WebSocketGateway({ namespace: '/book-dock', cors: { origin: wsCorsOrigin() } })
 export class BookDockGateway implements OnGatewayConnection, OnGatewayDisconnect {
   @WebSocketServer() server: Server;
   private readonly logger = new Logger(BookDockGateway.name);
diff --git a/server/src/modules/book-dock/book-dock.module.ts b/server/src/modules/book-dock/book-dock.module.ts
index a8650782c..8d6d41021 100644
--- a/server/src/modules/book-dock/book-dock.module.ts
+++ b/server/src/modules/book-dock/book-dock.module.ts
@@ -54,6 +54,6 @@ import { BookDockRepository } from './book-dock.repository';
     BookDockWatcherService,
     BookDockGateway,
   ],
-  exports: [BookDockService, BookDockRepository],
+  exports: [BookDockService, BookDockRepository, BookDockEventsService, BookDockFinalizeService, BookDockIngestService],
 })
 export class BookDockModule {}
diff --git a/server/src/modules/book-dock/book-dock.repository.ts b/server/src/modules/book-dock/book-dock.repository.ts
index 2a578ff10..e70e2a8e5 100644
--- a/server/src/modules/book-dock/book-dock.repository.ts
+++ b/server/src/modules/book-dock/book-dock.repository.ts
@@ -5,7 +5,16 @@ import { NodePgDatabase } from 'drizzle-orm/node-postgres';
 import { DB } from '../../db';
 import { accentInsensitiveIlike } from '../../common/utils/accent-insensitive-search.utils';
 import * as schema from '../../db/schema';
-import { bookDockFiles, bookFiles, books, type NewBookDockFileRow, type BookDockFileRow } from '../../db/schema';
+import {
+  bookDockFiles,
+  bookDockUnitFiles,
+  bookFiles,
+  books,
+  type BookDockFileRow,
+  type BookDockUnitFileRow,
+  type NewBookDockFileRow,
+  type NewBookDockUnitFileRow,
+} from '../../db/schema';
 
 type Db = NodePgDatabase<typeof schema>;
 
@@ -17,6 +26,15 @@ const SORT_COLUMNS = {
   fileSize: bookDockFiles.fileSize,
 } as const;
 
+/**
+ * Sidecars carry no sort order, so they sort after the content files rather than before them.
+ *
+ * The direction sits inside the fragment on purpose: wrapping it as `asc(sql\`... nulls last\`)`
+ * renders `sort_order nulls last asc`, which Postgres rejects outright. Exported so the SQL it
+ * produces can be read in a test rather than assumed.
+ */
+export const UNIT_FILE_ORDER = [sql`${bookDockUnitFiles.sortOrder} asc nulls last`, asc(bookDockUnitFiles.id)] as const;
+
 /** Below this, a provider match is treated as a guess the user should confirm. */
 export const NEEDS_REVIEW_CONFIDENCE_BELOW = 70;
 
@@ -120,6 +138,57 @@ export class BookDockRepository {
     return row;
   }
 
+  /**
+   * The anchor row and its children in one transaction. A unit that exists in the list without
+   * knowing which files it is made of would be finalized as a single file, which is the exact
+   * truncation this whole feature exists to stop.
+   */
+  async createUnit(data: NewBookDockFileRow, files: Array<Omit<NewBookDockUnitFileRow, 'dockFileId'>>): Promise<BookDockFileRow> {
+    return this.db.transaction(async (tx) => {
+      const [row] = await tx.insert(bookDockFiles).values(data).returning();
+      if (files.length > 0) {
+        await tx.insert(bookDockUnitFiles).values(files.map((file) => ({ ...file, dockFileId: row.id })));
+      }
+      return row;
+    });
+  }
+
+  async findUnitFiles(dockFileId: number): Promise<BookDockUnitFileRow[]> {
+    return this.db
+      .select()
+      .from(bookDockUnitFiles)
+      .where(eq(bookDockUnitFiles.dockFileId, dockFileId))
+      .orderBy(...UNIT_FILE_ORDER);
+  }
+
+  /** One query for a page of rows, so rendering a list of units is not an N+1. */
+  async findUnitFilesByDockFileIds(dockFileIds: number[]): Promise<Map<number, BookDockUnitFileRow[]>> {
+    const byDockFile = new Map<number, BookDockUnitFileRow[]>();
+    if (dockFileIds.length === 0) return byDockFile;
+
+    const rows = await this.db
+      .select()
+      .from(bookDockUnitFiles)
+      .where(inArray(bookDockUnitFiles.dockFileId, dockFileIds))
+      .orderBy(...UNIT_FILE_ORDER);
+
+    for (const row of rows) {
+      const existing = byDockFile.get(row.dockFileId);
+      if (existing) existing.push(row);
+      else byDockFile.set(row.dockFileId, [row]);
+    }
+    return byDockFile;
+  }
+
+  /**
+   * Whether a directory is already owned by a unit row. The watcher asks this of the first path
+   * segment below the dock root, which is why it can be an equality lookup on a unique column.
+   */
+  async findByUnitDirectory(unitDirectory: string): Promise<BookDockFileRow | undefined> {
+    const [row] = await this.db.select().from(bookDockFiles).where(eq(bookDockFiles.unitDirectory, unitDirectory)).limit(1);
+    return row;
+  }
+
   async update(id: number, data: Partial<NewBookDockFileRow>): Promise<BookDockFileRow | undefined> {
     const [row] = await this.db.update(bookDockFiles).set(data).where(eq(bookDockFiles.id, id)).returning();
     return row;
diff --git a/server/src/modules/book-dock/book-dock.service.test.ts b/server/src/modules/book-dock/book-dock.service.test.ts
index 3551e696e..6da29e4be 100644
--- a/server/src/modules/book-dock/book-dock.service.test.ts
+++ b/server/src/modules/book-dock/book-dock.service.test.ts
@@ -4,6 +4,7 @@ import { BookDockService } from './book-dock.service';
 
 vi.mock('fs/promises', () => ({
   unlink: vi.fn(),
+  rmdir: vi.fn().mockResolvedValue(undefined),
 }));
 
 import { unlink } from 'fs/promises';
@@ -46,6 +47,8 @@ function makeService() {
     setTargetsByIds: vi.fn(),
     countsByStatus: vi.fn(),
     getStatistics: vi.fn(),
+    findUnitFiles: vi.fn().mockResolvedValue([]),
+    findUnitFilesByDockFileIds: vi.fn().mockResolvedValue(new Map()),
   };
   const ingestService = {
     retryFetch: vi.fn(),
diff --git a/server/src/modules/book-dock/book-dock.service.ts b/server/src/modules/book-dock/book-dock.service.ts
index e23e40522..f337fb153 100644
--- a/server/src/modules/book-dock/book-dock.service.ts
+++ b/server/src/modules/book-dock/book-dock.service.ts
@@ -1,9 +1,9 @@
 import { BadRequestException, ForbiddenException, Inject, Injectable, Logger, NotFoundException } from '@nestjs/common';
-import { unlink } from 'fs/promises';
+import { rmdir, unlink } from 'fs/promises';
 import { eq, inArray } from 'drizzle-orm';
 import { NodePgDatabase } from 'drizzle-orm/node-postgres';
 
-import type { BookDockFile, BookDockFilesPage, BookDockMetadata, BookDockSummary } from '@bookorbit/types';
+import type { BookDockFile, BookDockFilesPage, BookDockMetadata, BookDockSummary, BookDockUnitFile } from '@bookorbit/types';
 import { DB } from '../../db';
 import * as schema from '../../db/schema';
 import { libraries, libraryFolders } from '../../db/schema';
@@ -15,7 +15,7 @@ import { BookDockGateway } from './book-dock.gateway';
 import { normalizeBookDockMetadata, normalizeBookDockMetadataSources } from './book-dock-metadata.utils';
 import { BookDockProcessingStateService } from './book-dock-processing-state.service';
 import { BookDockWatcherService } from './book-dock-watcher.service';
-import type { BookDockFileRow } from '../../db/schema';
+import type { BookDockFileRow, BookDockUnitFileRow } from '../../db/schema';
 
 type Db = NodePgDatabase<typeof schema>;
 const BULK_SELECTION_BATCH_SIZE = 500;
@@ -37,8 +37,12 @@ export class BookDockService {
 
   async listFiles(query: ListOptions): Promise<BookDockFilesPage> {
     const { items, total } = await this.repo.findAll(query);
+    // One query for the whole page rather than one per unit row, which at a page of 100 units
+    // would be 100 round trips for a list nobody has even expanded yet.
+    const unitFiles = await this.repo.findUnitFilesByDockFileIds(items.filter((row) => row.unitDirectory).map((row) => row.id));
+
     return {
-      items: items.map(toDto),
+      items: items.map((row) => toDto(row, unitFiles.get(row.id) ?? [])),
       total,
       page: query.page,
       size: query.limit,
@@ -47,7 +51,7 @@ export class BookDockService {
 
   async getFile(id: number, userId: number, canManageAll: boolean): Promise<BookDockFile> {
     const row = await this.findFileForUser(id, userId, canManageAll);
-    return toDto(row);
+    return toDto(row, row.unitDirectory ? await this.repo.findUnitFiles(row.id) : []);
   }
 
   async getCoverPath(id: number, userId: number, canManageAll: boolean): Promise<string> {
@@ -400,7 +404,13 @@ export class BookDockService {
     }
   }
 
+  /** A unit is N files plus the directory holding them, and deleting it takes all of them. */
   private async cleanupFiles(row: BookDockFileRow): Promise<void> {
+    if (row.unitDirectory) {
+      for (const file of await this.repo.findUnitFiles(row.id)) await safeUnlink(file.absolutePath);
+      // Non-recursive: anything still in there is unaccounted for, and worth leaving for a human.
+      await rmdir(row.unitDirectory).catch(() => {});
+    }
     await safeUnlink(row.absolutePath);
     if (row.coverPath) {
       await safeUnlink(row.coverPath);
@@ -536,7 +546,7 @@ export class BookDockService {
   }
 }
 
-function toDto(row: BookDockFileRow): BookDockFile {
+function toDto(row: BookDockFileRow, unitFiles: BookDockUnitFileRow[] = []): BookDockFile {
   return {
     id: row.id,
     fileName: row.fileName,
@@ -554,6 +564,13 @@ function toDto(row: BookDockFileRow): BookDockFile {
     metadataEditedAt: row.metadataEditedAt?.toISOString() ?? null,
     createdAt: row.createdAt.toISOString(),
     updatedAt: row.updatedAt.toISOString(),
+    unitFiles: unitFiles.map((file) => ({
+      fileName: file.fileName,
+      fileSize: file.fileSize === null ? null : Number(file.fileSize),
+      format: file.format,
+      role: file.role as BookDockUnitFile['role'],
+      sortOrder: file.sortOrder,
+    })),
   };
 }
 
diff --git a/server/src/modules/book-metadata-fetch/book-metadata-fetch.gateway.ts b/server/src/modules/book-metadata-fetch/book-metadata-fetch.gateway.ts
index 97000efca..e33a7e111 100644
--- a/server/src/modules/book-metadata-fetch/book-metadata-fetch.gateway.ts
+++ b/server/src/modules/book-metadata-fetch/book-metadata-fetch.gateway.ts
@@ -10,10 +10,11 @@ import { BookMetadataFetchQueueRepository } from './book-metadata-fetch-queue.re
 import { BookMetadataFetchConfigService } from './book-metadata-fetch-config.service';
 import { BookMetadataFetchSessionService } from './book-metadata-fetch-session.service';
 import { rejectSocketConnection } from '../../common/utils/ws-auth.utils';
+import { wsCorsOrigin } from '../../common/utils/ws-cors.utils';
 
 export const BOOK_METADATA_FETCH_STATUS_EVENT = 'book-metadata-fetch:status';
 
-@WebSocketGateway({ namespace: '/book-metadata-fetch', cors: { origin: process.env.CLIENT_URL ?? 'http://localhost:5173' } })
+@WebSocketGateway({ namespace: '/book-metadata-fetch', cors: { origin: wsCorsOrigin() } })
 export class BookMetadataFetchGateway implements OnGatewayConnection, OnGatewayDisconnect {
   @WebSocketServer() server: Server;
   private readonly logger = new Logger(BookMetadataFetchGateway.name);
diff --git a/server/src/modules/book-request/book-request-admin.controller.ts b/server/src/modules/book-request/book-request-admin.controller.ts
new file mode 100644
index 000000000..b544e410c
--- /dev/null
+++ b/server/src/modules/book-request/book-request-admin.controller.ts
@@ -0,0 +1,303 @@
+import {
+  Body,
+  Controller,
+  DefaultValuePipe,
+  Delete,
+  Get,
+  HttpCode,
+  HttpStatus,
+  Param,
+  ParseBoolPipe,
+  ParseIntPipe,
+  Post,
+  Query,
+} from '@nestjs/common';
+import { AuditAction, AuditResource, Permission } from '@bookorbit/types';
+
+import { Auditable } from '../../common/decorators/auditable.decorator';
+import { CurrentUser } from '../../common/decorators/current-user.decorator';
+import { RequirePermission } from '../../common/decorators/require-permission.decorator';
+import type { RequestUser } from '../../common/types/request-user';
+import { BookRequestService } from './book-request.service';
+import { DownloadClientConfigService } from './download-clients/download-client-config.service';
+import { RequestFulfillmentService } from './fulfillment/request-fulfillment.service';
+import { RequestImportService } from './fulfillment/request-import.service';
+import { RequestSeedService } from './fulfillment/request-seed.service';
+import { RequestVerificationService } from './fulfillment/request-verification.service';
+import { BulkBookRequestsDto, BulkRejectBookRequestsDto } from './dto/bulk-book-requests.dto';
+import { DecideBookRequestDto } from './dto/decide-book-request.dto';
+import { GrabBookRequestDto } from './dto/grab-book-request.dto';
+import { InspectBookRequestReleaseDto } from './dto/inspect-book-request-release.dto';
+import { FulfillBookRequestDto } from './dto/fulfill-book-request.dto';
+import { ListAllBookRequestsDto } from './dto/list-book-requests.dto';
+import { ListRequesterOptionsDto } from './dto/list-requester-options.dto';
+import { SelectReleaseUnitDto } from './dto/select-release-unit.dto';
+import { RemoveDownloadDto } from './dto/remove-download.dto';
+import { SearchBookRequestReleasesDto } from './dto/search-book-request-releases.dto';
+
+/**
+ * Moderating the queue is a different level of trust from requesting, so this whole controller
+ * sits behind `ManageBookRequests` rather than `BookRequestAccess`.
+ */
+@Controller('admin/book-requests')
+@RequirePermission(Permission.ManageBookRequests)
+export class BookRequestAdminController {
+  constructor(
+    private readonly service: BookRequestService,
+    private readonly fulfillment: RequestFulfillmentService,
+    private readonly downloadClients: DownloadClientConfigService,
+    private readonly seed: RequestSeedService,
+    private readonly imports: RequestImportService,
+    private readonly verification: RequestVerificationService,
+  ) {}
+
+  @Get()
+  listAll(@Query() query: ListAllBookRequestsDto, @CurrentUser() user: RequestUser) {
+    return this.service.listAll(query, user);
+  }
+
+  @Get('requesters')
+  listRequesters(@Query() query: ListRequesterOptionsDto) {
+    return this.service.listRequesterOptions(query);
+  }
+
+  /**
+   * Just enough for the grab dialog to offer a choice. Managing the rows themselves needs
+   * `ManageAppSettings`, so an approver without it would otherwise see a dialog it could not use
+   * for an endpoint that would have accepted the grab.
+   */
+  @Get('download-clients')
+  listDownloadClients() {
+    return this.downloadClients.findEnabledSummaries('torrent');
+  }
+
+  /**
+   * The ranked release list, merged across every enabled indexer and scored against the request.
+   * A repeat open is served from a short-lived cache; `refresh` is the way past it, so reopening
+   * the picker does not re-hit a private tracker.
+   */
+  @Get(':id/releases')
+  listReleases(@Param('id', ParseIntPipe) id: number, @Query('refresh', new DefaultValuePipe(false), ParseBoolPipe) refresh: boolean) {
+    return this.fulfillment.listReleases(id, { refresh });
+  }
+
+  @Post(':id/releases/search')
+  @HttpCode(HttpStatus.OK)
+  searchReleases(@Param('id', ParseIntPipe) id: number, @Body() dto: SearchBookRequestReleasesDto) {
+    return this.fulfillment.listReleases(id, { refresh: true, overrides: dto });
+  }
+
+  /** Fetches only the selected release's metadata and never exposes its credentialed URL. */
+  @Post(':id/releases/inspect')
+  @HttpCode(HttpStatus.OK)
+  inspectRelease(@Param('id', ParseIntPipe) id: number, @Body() dto: InspectBookRequestReleaseDto) {
+    return this.fulfillment.inspectRelease(id, dto);
+  }
+
+  /**
+   * Bulk approval. Declared before `:id/approve` for readability only; the two never collide,
+   * since one path has a segment the other does not.
+   */
+  @Post('approve')
+  @HttpCode(HttpStatus.OK)
+  @Auditable({
+    action: AuditAction.BookRequestApprove,
+    resource: AuditResource.BookRequest,
+    getMeta: (_req, body) => {
+      const result = body as { updated?: unknown[]; failed?: unknown[] } | null;
+      return { approved: result?.updated?.length ?? 0, failed: result?.failed?.length ?? 0 };
+    },
+    description: 'Approved a selection of book requests',
+  })
+  approveMany(@Body() dto: BulkBookRequestsDto, @CurrentUser() user: RequestUser) {
+    return this.service.approveMany(dto, user);
+  }
+
+  @Post(':id/approve')
+  @HttpCode(HttpStatus.OK)
+  @Auditable({
+    action: AuditAction.BookRequestApprove,
+    resource: AuditResource.BookRequest,
+    getResourceId: (req) => Number(req.params.id),
+    description: 'Approved a book request',
+  })
+  approve(@Param('id', ParseIntPipe) id: number, @Body() dto: DecideBookRequestDto, @CurrentUser() user: RequestUser) {
+    return this.service.approve(id, dto, user);
+  }
+
+  /**
+   * Bulk rejection, with the one note that applies to the whole selection. Declared before
+   * `:id/reject` for the same reason `approve` is: readability, since the two never collide.
+   */
+  @Post('reject')
+  @HttpCode(HttpStatus.OK)
+  @Auditable({
+    action: AuditAction.BookRequestReject,
+    resource: AuditResource.BookRequest,
+    getMeta: (_req, body) => {
+      const result = body as { updated?: unknown[]; failed?: unknown[] } | null;
+      return { rejected: result?.updated?.length ?? 0, failed: result?.failed?.length ?? 0 };
+    },
+    description: 'Rejected a selection of book requests',
+  })
+  rejectMany(@Body() dto: BulkRejectBookRequestsDto, @CurrentUser() user: RequestUser) {
+    return this.service.rejectMany(dto, user);
+  }
+
+  @Post(':id/reject')
+  @HttpCode(HttpStatus.OK)
+  @Auditable({
+    action: AuditAction.BookRequestReject,
+    resource: AuditResource.BookRequest,
+    getResourceId: (req) => Number(req.params.id),
+    description: 'Rejected a book request',
+  })
+  reject(@Param('id', ParseIntPipe) id: number, @Body() dto: DecideBookRequestDto, @CurrentUser() user: RequestUser) {
+    return this.service.reject(id, dto, user);
+  }
+
+  /**
+   * The escape hatch for a settled row nobody wants in the history any more. Everyone else gets
+   * dismissal, which hides a request without taking the record of it away from the other people
+   * who asked for the same book.
+   */
+  @Delete(':id')
+  @HttpCode(HttpStatus.NO_CONTENT)
+  @Auditable({
+    action: AuditAction.BookRequestDelete,
+    resource: AuditResource.BookRequest,
+    getResourceId: (req) => Number(req.params.id),
+    description: 'Deleted a book request',
+  })
+  remove(@Param('id', ParseIntPipe) id: number, @CurrentUser() user: RequestUser) {
+    return this.service.remove(id, user);
+  }
+
+  @Post(':id/fulfill')
+  @HttpCode(HttpStatus.OK)
+  @Auditable({
+    action: AuditAction.BookRequestFulfill,
+    resource: AuditResource.BookRequest,
+    getResourceId: (req) => Number(req.params.id),
+    description: 'Marked a book request fulfilled',
+  })
+  fulfill(@Param('id', ParseIntPipe) id: number, @Body() dto: FulfillBookRequestDto, @CurrentUser() user: RequestUser) {
+    return this.service.markFulfilled(id, dto, user);
+  }
+
+  /**
+   * What is actually sitting in the dock, and what the score was measuring. Read on demand rather
+   * than folded into the request itself: it costs a dock read plus a settings read, and the list
+   * renders hundreds of rows that will never be opened.
+   */
+  @Get(':id/review')
+  getReview(@Param('id', ParseIntPipe) id: number) {
+    return this.verification.getReview(id);
+  }
+
+  /** The approver disagrees with the score. Files the held import exactly as a pass would have. */
+  @Post(':id/force-file')
+  @HttpCode(HttpStatus.OK)
+  @Auditable({
+    action: AuditAction.BookRequestImport,
+    resource: AuditResource.BookRequest,
+    getResourceId: (req) => Number(req.params.id),
+    description: 'Filed a held book request import',
+  })
+  async forceFile(@Param('id', ParseIntPipe) id: number, @CurrentUser() user: RequestUser) {
+    await this.verification.fileHeldImport(id, user);
+    return this.service.getOne(id, user);
+  }
+
+  /**
+   * The other answer to a held import: it is the wrong book, so the entry is discarded and the
+   * request fails. Without this the only way out was cancelling, which left the dock entry behind
+   * as an orphan nobody would connect back to a request.
+   */
+  @Post(':id/discard-import')
+  @HttpCode(HttpStatus.OK)
+  @Auditable({
+    action: AuditAction.BookRequestImport,
+    resource: AuditResource.BookRequest,
+    getResourceId: (req) => Number(req.params.id),
+    description: 'Discarded a held book request import',
+  })
+  async discardImport(@Param('id', ParseIntPipe) id: number, @CurrentUser() user: RequestUser) {
+    await this.verification.discardHeldImport(id, user);
+    return this.service.getOne(id, user);
+  }
+
+  /**
+   * Fulfilment: the approver picks a release out of the ranked list, or hands over a magnet or a
+   * .torrent by hand. All three go down the same pipeline from here.
+   */
+  @Post(':id/grab')
+  @HttpCode(HttpStatus.OK)
+  @Auditable({
+    action: AuditAction.BookRequestGrab,
+    resource: AuditResource.BookRequest,
+    getResourceId: (req) => Number(req.params.id),
+    description: 'Sent a book request to a download client',
+  })
+  grab(@Param('id', ParseIntPipe) id: number, @Body() dto: GrabBookRequestDto, @CurrentUser() user: RequestUser) {
+    return this.fulfillment.grab(id, dto, user);
+  }
+
+  /**
+   * Every release this request has been sent to, newest first, including the ones a source refused
+   * before anything was downloaded. Read on demand rather than carried on the request: the queue
+   * shows the current attempt, and only somebody looking at one request wants the rest.
+   */
+  @Get(':id/attempts')
+  attempts(@Param('id', ParseIntPipe) id: number) {
+    return this.fulfillment.listAttempts(id);
+  }
+
+  /**
+   * What the client is doing with this request's torrent, read live. Null when there is no
+   * attempt to ask about, or when the client no longer holds it.
+   */
+  @Get(':id/seed')
+  seedStatus(@Param('id', ParseIntPipe) id: number) {
+    return this.seed.getSeedStatus(id);
+  }
+
+  /**
+   * Resolves a held attempt whose release turned out to hold several distinct books. The download
+   * is untouched and still on disk, so this finishes the import that stopped at the question
+   * rather than starting a new attempt.
+   */
+  @Post(':id/downloads/:downloadId/select-unit')
+  @HttpCode(HttpStatus.OK)
+  @Auditable({
+    action: AuditAction.BookRequestImport,
+    resource: AuditResource.BookRequest,
+    getResourceId: (req) => Number(req.params.id),
+    description: 'Chose which book to import from a multi-book release',
+  })
+  selectReleaseUnit(@Param('id', ParseIntPipe) id: number, @Param('downloadId', ParseIntPipe) downloadId: number, @Body() dto: SelectReleaseUnitDto) {
+    return this.imports.importChosenUnit(id, downloadId, dto.unitIndex);
+  }
+
+  /**
+   * The one action BookOrbit takes against a seed. Removing one that is still working also fails
+   * the request: nothing else is going to finish it, and saying so beats leaving it at
+   * "downloading" until the watchdog notices twelve hours later.
+   */
+  @Post(':id/downloads/:downloadId/remove')
+  @HttpCode(HttpStatus.OK)
+  @Auditable({
+    action: AuditAction.BookRequestRemoveDownload,
+    resource: AuditResource.BookRequest,
+    getResourceId: (req) => Number(req.params.id),
+    description: 'Removed a book request download from its download client',
+  })
+  removeDownload(
+    @Param('id', ParseIntPipe) id: number,
+    @Param('downloadId', ParseIntPipe) downloadId: number,
+    @Body() dto: RemoveDownloadDto,
+    @CurrentUser() user: RequestUser,
+  ) {
+    return this.seed.removeFromClient(id, downloadId, dto.deleteFiles ?? false, user);
+  }
+}
diff --git a/server/src/modules/book-request/book-request-attribution.service.test.ts b/server/src/modules/book-request/book-request-attribution.service.test.ts
new file mode 100644
index 000000000..1b50a1aa8
--- /dev/null
+++ b/server/src/modules/book-request/book-request-attribution.service.test.ts
@@ -0,0 +1,130 @@
+import { ForbiddenException, NotFoundException } from '@nestjs/common';
+import { Permission, withRequiredPermissions } from '@bookorbit/types';
+
+import { BookRequestAttributionService } from './book-request-attribution.service';
+import type { RequestUser } from '../../common/types/request-user';
+
+function user(overrides: Partial<RequestUser> = {}): RequestUser {
+  return {
+    id: 1,
+    username: 'reader',
+    name: 'Reader',
+    email: null,
+    active: true,
+    isSuperuser: false,
+    isDefaultPassword: false,
+    tokenVersion: 1,
+    settings: {},
+    avatarUrl: null,
+    provisioningMethod: 'local',
+    permissions: [Permission.BookRequestAccess],
+    contentFilters: {},
+    ...overrides,
+  } as RequestUser;
+}
+
+/** An integration account as the assignment path builds one. */
+function integration(overrides: Partial<RequestUser> = {}): RequestUser {
+  return user({ id: 1, username: 'bookbot', name: 'Bookbot', permissions: withRequiredPermissions([Permission.ManageBookRequests]), ...overrides });
+}
+
+const subject = user({ id: 42, username: 'bob', name: 'Bob' });
+
+function makeService(overrides: { findActingUser?: unknown } = {}) {
+  const auth = { findActingUser: vi.fn().mockResolvedValue(subject), ...overrides };
+  return { service: new BookRequestAttributionService(auth as never), auth };
+}
+
+/** The refusal code an integration reads, rather than the sentence a person reads. */
+function errorCode(error: unknown): string | undefined {
+  return ((error as { getResponse?: () => { errorCode?: string } }).getResponse?.() ?? {}).errorCode;
+}
+
+describe('BookRequestAttributionService.resolveSubject', () => {
+  it('returns the caller untouched when no requester is named', async () => {
+    const { service, auth } = makeService();
+    const actor = user();
+
+    await expect(service.resolveSubject(actor, undefined)).resolves.toBe(actor);
+    await expect(service.resolveSubject(actor, null)).resolves.toBe(actor);
+    // The path every ordinary request takes costs no lookup at all.
+    expect(auth.findActingUser).not.toHaveBeenCalled();
+  });
+
+  it('treats the caller naming themselves as an ordinary request, with no permission needed', async () => {
+    const { service, auth } = makeService();
+    const actor = user({ id: 7 });
+
+    await expect(service.resolveSubject(actor, 7)).resolves.toBe(actor);
+    expect(auth.findActingUser).not.toHaveBeenCalled();
+  });
+
+  it('refuses a caller who cannot manage requests', async () => {
+    const { service, auth } = makeService();
+
+    const error = await service.resolveSubject(user(), 42).catch((e: unknown) => e);
+    expect(error).toBeInstanceOf(ForbiddenException);
+    expect(errorCode(error)).toBe('SUBMIT_ON_BEHALF_FORBIDDEN');
+    // Refused before the lookup, so an ordinary user cannot probe which ids exist.
+    expect(auth.findActingUser).not.toHaveBeenCalled();
+  });
+
+  it('refuses a caller holding only self-fulfilment, which is not a moderation permission', async () => {
+    const { service } = makeService();
+    const actor = user({ permissions: withRequiredPermissions([Permission.BookRequestSelfFulfill]) });
+
+    await expect(service.resolveSubject(actor, 42)).rejects.toThrow(ForbiddenException);
+  });
+
+  it('allows a caller holding manage_book_requests', async () => {
+    const { service, auth } = makeService();
+
+    await expect(service.resolveSubject(integration(), 42)).resolves.toBe(subject);
+    expect(auth.findActingUser).toHaveBeenCalledWith(42);
+  });
+
+  it('allows a superuser', async () => {
+    const { service } = makeService();
+
+    await expect(service.resolveSubject(user({ isSuperuser: true }), 42)).resolves.toBe(subject);
+  });
+
+  /**
+   * The regression this whole file exists for. Falling back to the caller here reads as defensive
+   * and is the exact mis-attribution the feature was built to end: an unknown id would file
+   * silently under the integration, and nothing would say so.
+   */
+  it('refuses an unresolvable requester rather than filing under the caller', async () => {
+    const { service } = makeService({ findActingUser: vi.fn().mockResolvedValue(null) });
+
+    const error = await service.resolveSubject(integration(), 999).catch((e: unknown) => e);
+    expect(error).toBeInstanceOf(NotFoundException);
+    expect(errorCode(error)).toBe('SUBMIT_ON_BEHALF_UNKNOWN_USER');
+  });
+
+  it('hands back the named user with their own permissions, never the caller with a new id', async () => {
+    const namedUser = user({ id: 42, permissions: [Permission.BookRequestAccess, Permission.BookRequestAutoApprove] });
+    const { service } = makeService({ findActingUser: vi.fn().mockResolvedValue(namedUser) });
+    const actor = integration({ permissions: withRequiredPermissions([Permission.ManageBookRequests, Permission.BookRequestSelfFulfill]) });
+
+    const resolved = await service.resolveSubject(actor, 42);
+    expect(resolved).toBe(namedUser);
+    expect(resolved.permissions).not.toContain(Permission.BookRequestSelfFulfill);
+    expect(resolved.permissions).not.toContain(Permission.ManageBookRequests);
+  });
+});
+
+describe('BookRequestAttributionService.createdByUserIdFor', () => {
+  it('records nothing when the requester made their own request', () => {
+    const { service } = makeService();
+    const actor = user({ id: 7 });
+
+    expect(service.createdByUserIdFor(actor, actor)).toBeNull();
+  });
+
+  it('records the caller when somebody else filed it', () => {
+    const { service } = makeService();
+
+    expect(service.createdByUserIdFor(integration({ id: 3 }), subject)).toBe(3);
+  });
+});
diff --git a/server/src/modules/book-request/book-request-attribution.service.ts b/server/src/modules/book-request/book-request-attribution.service.ts
new file mode 100644
index 000000000..ea13054a0
--- /dev/null
+++ b/server/src/modules/book-request/book-request-attribution.service.ts
@@ -0,0 +1,82 @@
+import { ForbiddenException, HttpStatus, Injectable, NotFoundException } from '@nestjs/common';
+import { Permission } from '@bookorbit/types';
+
+import type { RequestUser } from '../../common/types/request-user';
+import { AuthService } from '../auth/auth.service';
+
+/**
+ * The same coded shape every other submission refusal carries, so the request form and an
+ * integration both read these the way they read the rest.
+ */
+function onBehalfForbidden(): ForbiddenException {
+  return new ForbiddenException({
+    message: 'You cannot file a book request for another user',
+    errorCode: 'SUBMIT_ON_BEHALF_FORBIDDEN',
+    statusCode: HttpStatus.FORBIDDEN,
+  });
+}
+
+function onBehalfUnknownUser(): NotFoundException {
+  return new NotFoundException({
+    message: 'That user cannot have a book request filed for them',
+    errorCode: 'SUBMIT_ON_BEHALF_UNKNOWN_USER',
+    statusCode: HttpStatus.NOT_FOUND,
+  });
+}
+
+/**
+ * Who a request is *for*, when that is not the account that made the call.
+ *
+ * A front end that its own users sign into has one BookOrbit account and many people behind it, so
+ * every request it files lands under the integration rather than under whoever asked. Naming the
+ * requester fixes that, and the whole risk of allowing it lives in this one file.
+ *
+ * Two roles, and keeping them apart is the entire design:
+ *
+ * - the **actor** holds the token. They decide nothing about the request beyond being allowed to
+ *   name somebody, and they stay the actor in the audit log, because who made the call is the
+ *   question an audit log answers.
+ * - the **subject** is who the request is for: their permissions, their reachable libraries, their
+ *   caps, their notifications.
+ *
+ * The invariant that makes this safe is that naming a subject must never let the actor do
+ * something they could not already do, and must never lend the subject something the actor holds.
+ * It is gated on `manage_book_requests`, whose holder can already approve, grab, fulfil and delete
+ * any request in the queue, so what this adds is attribution and not capability. Gated on anything
+ * weaker it would be a plain escalation, because an ordinary user could then borrow the
+ * self-fulfilment of somebody who has it.
+ */
+@Injectable()
+export class BookRequestAttributionService {
+  constructor(private readonly auth: AuthService) {}
+
+  /**
+   * The user a submission should be recorded against.
+   *
+   * Returns the actor unchanged for every ordinary request, including one that names its own
+   * caller, so the path the web app and the mobile app take is the path that existed before this.
+   */
+  async resolveSubject(actor: RequestUser, subjectUserId: number | null | undefined): Promise<RequestUser> {
+    if (subjectUserId === null || subjectUserId === undefined || subjectUserId === actor.id) return actor;
+    if (!this.canActForOthers(actor)) throw onBehalfForbidden();
+
+    // Resolved the way an authenticated request resolves them, so a deactivated account and a
+    // shared account whose link was revoked are refused here exactly as they are at the login.
+    //
+    // Deliberately not a fall back to the actor: filing silently under the caller is the
+    // mis-attribution this exists to end, and doing it on a typo would hide the typo too.
+    const subject = await this.auth.findActingUser(subjectUserId);
+    if (!subject) throw onBehalfUnknownUser();
+
+    return subject;
+  }
+
+  /** Who filed it, recorded only where that is not also who it is for. */
+  createdByUserIdFor(actor: RequestUser, subject: RequestUser): number | null {
+    return actor.id === subject.id ? null : actor.id;
+  }
+
+  private canActForOthers(actor: RequestUser): boolean {
+    return actor.isSuperuser || actor.permissions.includes(Permission.ManageBookRequests);
+  }
+}
diff --git a/server/src/modules/book-request/book-request-automation.controller.ts b/server/src/modules/book-request/book-request-automation.controller.ts
new file mode 100644
index 000000000..f28e22413
--- /dev/null
+++ b/server/src/modules/book-request/book-request-automation.controller.ts
@@ -0,0 +1,36 @@
+import { Body, Controller, Get, Put } from '@nestjs/common';
+import { AuditAction, AuditResource, Permission } from '@bookorbit/types';
+
+import { Auditable } from '../../common/decorators/auditable.decorator';
+import { RequirePermission } from '../../common/decorators/require-permission.decorator';
+import { UpdateAutomationSettingsDto } from './dto/automation-settings.dto';
+import { RequestAutomationSettingsService } from './fulfillment/request-automation-settings.service';
+
+/**
+ * Gated on `ManageAppSettings`, matching the indexer and download-client rows: deciding that the
+ * instance may grab releases unattended is an instance-configuration decision, not a moderation
+ * one, and an approver should not get it by having the queue.
+ *
+ * Its own path rather than a segment under `admin/book-requests`, where it would be matched by
+ * that controller's `:id` routes and rejected by their integer pipe.
+ */
+@Controller('admin/book-request-automation')
+@RequirePermission(Permission.ManageAppSettings)
+export class BookRequestAutomationController {
+  constructor(private readonly settings: RequestAutomationSettingsService) {}
+
+  @Get()
+  get() {
+    return this.settings.get();
+  }
+
+  @Put()
+  @Auditable({
+    action: AuditAction.AppSettingsUpdate,
+    resource: AuditResource.AppSettings,
+    description: 'Updated book request automation settings',
+  })
+  update(@Body() dto: UpdateAutomationSettingsDto) {
+    return this.settings.update(dto);
+  }
+}
diff --git a/server/src/modules/book-request/book-request-dedupe.service.test.ts b/server/src/modules/book-request/book-request-dedupe.service.test.ts
new file mode 100644
index 000000000..e50fb8ff1
--- /dev/null
+++ b/server/src/modules/book-request/book-request-dedupe.service.test.ts
@@ -0,0 +1,452 @@
+import { BookRequestDedupeService, dedupeKeyCandidates, lowerTitleKey, normalizeIsbn, primaryDedupeKey } from './book-request-dedupe.service';
+import type { BookRequestRepository } from './book-request.repository';
+
+function makeService(repoOverrides: Record<string, unknown> = {}) {
+  const repo = {
+    findOwnedMatches: vi.fn().mockResolvedValue({ byIsbn13: new Map(), byTitle: new Map() }),
+    findActiveByDedupeKeys: vi.fn().mockResolvedValue(new Map()),
+    findSubscribedRequestIds: vi.fn().mockResolvedValue(new Set()),
+    ...repoOverrides,
+  } as unknown as BookRequestRepository;
+
+  return { service: new BookRequestDedupeService(repo), repo };
+}
+
+function owned(bookId: number, ...authorNames: string[]) {
+  return { bookId, authorNames };
+}
+
+describe('normalizeIsbn', () => {
+  it('strips separators and keeps a 13-digit ISBN', () => {
+    expect(normalizeIsbn('978-0-441-01359-3')).toBe('9780441013593');
+  });
+
+  it('keeps a trailing X check digit', () => {
+    expect(normalizeIsbn('043942089x')).toBe('043942089X');
+  });
+
+  it('rejects anything that is not a 10 or 13 character ISBN', () => {
+    expect(normalizeIsbn('12345')).toBeNull();
+    expect(normalizeIsbn(null)).toBeNull();
+    expect(normalizeIsbn(undefined)).toBeNull();
+  });
+});
+
+describe('dedupeKeyCandidates', () => {
+  it('emits every key shape the work could have been filed under, most specific first', () => {
+    const keys = dedupeKeyCandidates({
+      title: 'Dune',
+      authors: ['Frank Herbert'],
+      isbn13: '978-0-441-01359-3',
+      providerKey: 'google',
+      providerId: 'abc',
+      mediaKind: 'ebook',
+    });
+
+    expect(keys).toEqual(['isbn13:9780441013593:ebook', 'provider:google:abc:ebook', 'work:dune:frankherbert:ebook']);
+  });
+
+  it('still emits the work key when the candidate carries no identifiers', () => {
+    expect(dedupeKeyCandidates({ title: 'Dune', mediaKind: 'ebook' })).toEqual(['work:dune::ebook']);
+  });
+
+  it('folds punctuation, case and accents so the same work reaches the same key', () => {
+    const a = dedupeKeyCandidates({ title: 'Les Misérables', authors: ['Victor Hugo'], mediaKind: 'ebook' });
+    const b = dedupeKeyCandidates({ title: 'les miserables!', authors: ['victor hugo'], mediaKind: 'ebook' });
+    expect(a).toEqual(b);
+  });
+
+  it('separates media kinds, so wanting the audiobook too is a second request', () => {
+    const ebook = dedupeKeyCandidates({ title: 'Dune', isbn13: '9780441013593', mediaKind: 'ebook' });
+    const audio = dedupeKeyCandidates({ title: 'Dune', isbn13: '9780441013593', mediaKind: 'audiobook' });
+    expect(ebook[0]).not.toBe(audio[0]);
+  });
+
+  it('ignores a 10-digit ISBN for the isbn13 key', () => {
+    const keys = dedupeKeyCandidates({ title: 'Dune', isbn13: '0441013597', mediaKind: 'ebook' });
+    expect(keys.some((key) => key.startsWith('isbn13:'))).toBe(false);
+  });
+
+  it('uses every provider identifier as an alias but files conflicting editions by work', () => {
+    const work = {
+      title: 'Dune',
+      authors: ['Frank Herbert'],
+      mediaKind: 'ebook' as const,
+      metadataSources: [
+        { providerKey: 'google', providerId: 'g1', providerLabel: 'Google Books', isbn10: '0441013597', isbn13: null },
+        { providerKey: 'amazon', providerId: 'a1', providerLabel: 'Amazon', isbn10: null, isbn13: '9781250301697' },
+      ],
+    };
+
+    expect(dedupeKeyCandidates(work)).toEqual([
+      'isbn13:9780441013593:ebook',
+      'isbn13:9781250301697:ebook',
+      'provider:google:g1:ebook',
+      'provider:amazon:a1:ebook',
+      'work:dune:frankherbert:ebook',
+    ]);
+    expect(primaryDedupeKey(work)).toBe('work:dune:frankherbert:ebook');
+  });
+});
+
+/**
+ * The keys these produce are what a partial unique index enforces, so two different works sharing
+ * one is not a near miss: the second submitter gets a unique violation the recovery cannot explain
+ * and a 500 with nothing on it about the book they asked for.
+ */
+describe('dedupeKeyCandidates in alphabets other than Latin', () => {
+  it.each([
+    ['Cyrillic', 'Война и мир', 'Лев Толстой'],
+    ['Greek', 'Οδύσσεια', 'Όμηρος'],
+    ['Japanese', 'ノルウェイの森', '村上春樹'],
+    ['Arabic', 'ألف ليلة وليلة', 'مجهول'],
+  ])('keeps a %s title and author apart from another one', (_alphabet, title, author) => {
+    const [key] = dedupeKeyCandidates({ title, authors: [author], mediaKind: 'ebook' });
+    const [other] = dedupeKeyCandidates({ title: 'Dune', authors: ['Frank Herbert'], mediaKind: 'ebook' });
+
+    expect(key).not.toBe(other);
+    expect(key).not.toBe('work:::ebook');
+    expect(key.startsWith('work:')).toBe(true);
+  });
+
+  it('gives two different non-Latin titles two different keys', () => {
+    const [war] = dedupeKeyCandidates({ title: 'Война и мир', mediaKind: 'ebook' });
+    const [anna] = dedupeKeyCandidates({ title: 'Анна Каренина', mediaKind: 'ebook' });
+
+    expect(war).not.toBe(anna);
+  });
+
+  it('still folds punctuation and case within one alphabet', () => {
+    const a = dedupeKeyCandidates({ title: 'Война и мир!', mediaKind: 'ebook' });
+    const b = dedupeKeyCandidates({ title: '  война, и мир  ', mediaKind: 'ebook' });
+
+    expect(a).toEqual(b);
+  });
+
+  /** Punctuation or symbols alone still tokenize to nothing, and must not become one shared key. */
+  it('keeps two untokenizable titles apart rather than collapsing them onto one key', () => {
+    const stars = dedupeKeyCandidates({ title: '★★★', mediaKind: 'ebook' });
+    const marks = dedupeKeyCandidates({ title: '???', mediaKind: 'ebook' });
+
+    expect(stars).toHaveLength(1);
+    expect(stars).not.toEqual(marks);
+  });
+});
+
+describe('primaryDedupeKey', () => {
+  it('stores under the most specific key available', () => {
+    expect(primaryDedupeKey({ title: 'Dune', isbn13: '9780441013593', providerKey: 'google', providerId: 'x', mediaKind: 'ebook' })).toBe(
+      'isbn13:9780441013593:ebook',
+    );
+    expect(primaryDedupeKey({ title: 'Dune', providerKey: 'google', providerId: 'x', mediaKind: 'ebook' })).toBe('provider:google:x:ebook');
+    expect(primaryDedupeKey({ title: 'Dune', mediaKind: 'ebook' })).toBe('work:dune::ebook');
+  });
+
+  /**
+   * The probe and the insert have to agree about what a work is called. A constant here would file
+   * every work the candidate list came back empty for under one key nothing ever looks a request
+   * up by, so the second one of a medium collides on the index and 500s.
+   */
+  it('never falls back to a key two different works could share', () => {
+    const stars = primaryDedupeKey({ title: '★★★', mediaKind: 'ebook' });
+    const marks = primaryDedupeKey({ title: '???', mediaKind: 'ebook' });
+
+    expect(stars).not.toBe(marks);
+    expect(stars).toBe(dedupeKeyCandidates({ title: '★★★', mediaKind: 'ebook' })[0]);
+  });
+});
+
+/**
+ * `book_requests.dedupe_key` is `varchar(500)` and the submission DTO allows a 500-character title
+ * beside a 255-character author. An unbounded key overflowed the column, and Postgres 22001 reached
+ * the requester as an unexplained 500.
+ */
+describe('dedupe keys against the column they are stored in', () => {
+  const DEDUPE_KEY_LENGTH = 500;
+  const longTitle = 'a'.repeat(500);
+  const longAuthor = 'b'.repeat(255);
+
+  it('fits the longest title and author the DTO accepts', () => {
+    for (const key of dedupeKeyCandidates({ title: longTitle, authors: [longAuthor], mediaKind: 'audiobook' })) {
+      expect(key.length).toBeLessThanOrEqual(DEDUPE_KEY_LENGTH);
+    }
+    expect(primaryDedupeKey({ title: longTitle, authors: [longAuthor], mediaKind: 'audiobook' }).length).toBeLessThanOrEqual(DEDUPE_KEY_LENGTH);
+  });
+
+  it('fits the longest provider identifiers the DTO accepts', () => {
+    const key = primaryDedupeKey({
+      title: longTitle,
+      providerKey: 'p'.repeat(50),
+      providerId: 'i'.repeat(255),
+      mediaKind: 'audiobook',
+    });
+
+    expect(key.length).toBeLessThanOrEqual(DEDUPE_KEY_LENGTH);
+  });
+
+  /**
+   * Truncated with the full token's hash appended rather than simply cut. Two long titles sharing
+   * a prefix - a series, a subtitle-heavy edition - would otherwise fold two books into one
+   * request, which is worse than the overflow this bound exists to prevent.
+   */
+  it('keeps two long titles apart when only their tails differ', () => {
+    const first = primaryDedupeKey({ title: longTitle, authors: [`${longAuthor}one`], mediaKind: 'ebook' });
+    const second = primaryDedupeKey({ title: longTitle, authors: [`${longAuthor}two`], mediaKind: 'ebook' });
+
+    expect(first).not.toBe(second);
+  });
+
+  /**
+   * Shortening is for keys that would not fit, not for tokens over some width. A stored key is only
+   * useful while the probe still computes it, so changing one that already fits would file every
+   * existing request of a long-titled work under a key nothing looks it up by.
+   */
+  it('leaves a long title that still fits exactly as it was', () => {
+    const title = 'a'.repeat(300);
+
+    expect(primaryDedupeKey({ title, mediaKind: 'ebook' })).toBe(`work:${title}::ebook`);
+  });
+
+  /** A title inside the bound keeps the plain readable key it has always had. */
+  it('leaves an ordinary title untouched', () => {
+    expect(primaryDedupeKey({ title: 'Dune', authors: ['Frank Herbert'], mediaKind: 'ebook' })).toBe('work:dune:frankherbert:ebook');
+  });
+});
+
+describe('lowerTitleKey', () => {
+  it('matches the lower(title) expression index rather than normalizing harder', () => {
+    expect(lowerTitleKey('  The Hobbit  ')).toBe('the hobbit');
+  });
+});
+
+describe('BookRequestDedupeService.findOwnedBookFor', () => {
+  it('finds a present copy by any canonical ISBN and keeps the lookup library-scoped', async () => {
+    const findOwnedMatches = vi.fn().mockResolvedValue({
+      byIsbn13: new Map([['9781250301697', 42]]),
+      byTitle: new Map(),
+    });
+    const { service } = makeService({ findOwnedMatches });
+
+    const result = await service.findOwnedBookFor(
+      {
+        title: 'Dune',
+        authors: ['Frank Herbert'],
+        isbn13: '9780441013593',
+        metadataSources: [{ providerKey: 'amazon', providerId: 'edition-2', providerLabel: 'Amazon', isbn10: null, isbn13: '9781250301697' }],
+        mediaKind: 'ebook',
+      },
+      [3, 4],
+    );
+
+    expect(result).toBe(42);
+    expect(findOwnedMatches).toHaveBeenCalledWith(['9780441013593', '9781250301697'], ['dune'], [3, 4]);
+  });
+
+  it('requires the author to agree when ownership is found by title', async () => {
+    const { service } = makeService({
+      findOwnedMatches: vi.fn().mockResolvedValue({
+        byIsbn13: new Map(),
+        byTitle: new Map([['it', [owned(11, 'Stephen King'), owned(12, 'John Doe')]]]),
+      }),
+    });
+
+    await expect(service.findOwnedBookFor({ title: 'It', authors: ['John Doe'], mediaKind: 'ebook' }, null)).resolves.toBe(12);
+  });
+});
+
+describe('BookRequestDedupeService.checkAvailability', () => {
+  it('returns nothing for an empty batch without touching the database', async () => {
+    const { service, repo } = makeService();
+    await expect(service.checkAvailability([], 1, null)).resolves.toEqual([]);
+    expect(repo.findActiveByDedupeKeys).not.toHaveBeenCalled();
+  });
+
+  it('probes every key shape, not just the candidate preferred one', async () => {
+    const { service, repo } = makeService();
+    await service.checkAvailability([{ title: 'Dune', author: 'Frank Herbert', isbn13: '9780441013593', mediaKind: 'ebook' }], 1, null);
+
+    expect(repo.findActiveByDedupeKeys).toHaveBeenCalledWith(['isbn13:9780441013593:ebook', 'work:dune:frankherbert:ebook']);
+  });
+
+  it('finds an existing request filed under a weaker key than the candidate carries', async () => {
+    // Someone requested Dune from a provider with no ISBN; this candidate has one. Preferred
+    // keys differ, so only probing the preferred key would miss it and create a second request.
+    const existing = { id: 7, userId: 2, status: 'pending', dedupeKey: 'work:dune:frankherbert:ebook' };
+    const { service } = makeService({
+      findActiveByDedupeKeys: vi.fn().mockResolvedValue(new Map([['work:dune:frankherbert:ebook', existing]])),
+    });
+
+    const [result] = await service.checkAvailability(
+      [{ title: 'Dune', author: 'Frank Herbert', isbn13: '9780441013593', mediaKind: 'ebook' }],
+      1,
+      null,
+    );
+
+    expect(result.existingRequestId).toBe(7);
+    expect(result.existingRequestStatus).toBe('pending');
+  });
+
+  it('reports ownership by ISBN13 ahead of title', async () => {
+    const { service } = makeService({
+      findOwnedMatches: vi.fn().mockResolvedValue({ byIsbn13: new Map([['9780441013593', 42]]), byTitle: new Map([['dune', [owned(99)]]]) }),
+    });
+
+    const [result] = await service.checkAvailability([{ title: 'Dune', isbn13: '9780441013593', mediaKind: 'ebook' }], 1, null);
+    expect(result.ownedBookId).toBe(42);
+  });
+
+  it('falls back to a title match when the candidate has no ISBN', async () => {
+    const { service } = makeService({
+      findOwnedMatches: vi.fn().mockResolvedValue({ byIsbn13: new Map(), byTitle: new Map([['dune', [owned(99)]]]) }),
+    });
+
+    const [result] = await service.checkAvailability([{ title: 'Dune', mediaKind: 'ebook' }], 1, null);
+    expect(result.ownedBookId).toBe(99);
+  });
+
+  it('requires the author to agree before a shared title counts as owned', async () => {
+    const { service } = makeService({
+      findOwnedMatches: vi.fn().mockResolvedValue({ byIsbn13: new Map(), byTitle: new Map([['it', [owned(99, 'Alexa Chipman')]]]) }),
+    });
+
+    const [result] = await service.checkAvailability([{ title: 'It', author: 'Stephen King', mediaKind: 'ebook' }], 1, null);
+    expect(result.ownedBookId).toBeNull();
+  });
+
+  it('picks the book whose author matches out of several sharing a title', async () => {
+    const { service } = makeService({
+      findOwnedMatches: vi.fn().mockResolvedValue({
+        byIsbn13: new Map(),
+        byTitle: new Map([['it', [owned(99, 'Alexa Chipman'), owned(101, 'Stephen King')]]]),
+      }),
+    });
+
+    const [result] = await service.checkAvailability([{ title: 'It', author: 'Stephen King', mediaKind: 'ebook' }], 1, null);
+    expect(result.ownedBookId).toBe(101);
+  });
+
+  it('ignores punctuation, case and combining accents when comparing authors', async () => {
+    const { service } = makeService({
+      findOwnedMatches: vi.fn().mockResolvedValue({ byIsbn13: new Map(), byTitle: new Map([['germinal', [owned(7, 'Émile Zola')]]]) }),
+    });
+
+    const [result] = await service.checkAvailability([{ title: 'Germinal', author: 'emile  zola', mediaKind: 'ebook' }], 1, null);
+    expect(result.ownedBookId).toBe(7);
+  });
+
+  it('marks the requester as already subscribed to their own request', async () => {
+    const existing = { id: 7, userId: 1, status: 'pending', dedupeKey: 'work:dune::ebook' };
+    const { service } = makeService({
+      findActiveByDedupeKeys: vi.fn().mockResolvedValue(new Map([['work:dune::ebook', existing]])),
+    });
+
+    const [result] = await service.checkAvailability([{ title: 'Dune', mediaKind: 'ebook' }], 1, null);
+    expect(result.alreadySubscribed).toBe(true);
+  });
+
+  it('marks a subscriber on someone else request as already subscribed', async () => {
+    const existing = { id: 7, userId: 2, status: 'pending', dedupeKey: 'work:dune::ebook' };
+    const { service } = makeService({
+      findActiveByDedupeKeys: vi.fn().mockResolvedValue(new Map([['work:dune::ebook', existing]])),
+      findSubscribedRequestIds: vi.fn().mockResolvedValue(new Set([7])),
+    });
+
+    const [result] = await service.checkAvailability([{ title: 'Dune', mediaKind: 'ebook' }], 1, null);
+    expect(result.alreadySubscribed).toBe(true);
+  });
+
+  it('leaves a stranger request unsubscribed', async () => {
+    const existing = { id: 7, userId: 2, status: 'pending', dedupeKey: 'work:dune::ebook' };
+    const { service } = makeService({
+      findActiveByDedupeKeys: vi.fn().mockResolvedValue(new Map([['work:dune::ebook', existing]])),
+    });
+
+    const [result] = await service.checkAvailability([{ title: 'Dune', mediaKind: 'ebook' }], 1, null);
+    expect(result.alreadySubscribed).toBe(false);
+  });
+
+  it('scopes ownership to the libraries the caller can reach', async () => {
+    const { service, repo } = makeService();
+    await service.checkAvailability([{ title: 'Dune', mediaKind: 'ebook' }], 1, [3, 4]);
+    expect(repo.findOwnedMatches).toHaveBeenCalledWith([], ['dune'], [3, 4]);
+  });
+
+  it('keeps results aligned with the input order', async () => {
+    const { service } = makeService({
+      findOwnedMatches: vi.fn().mockResolvedValue({ byIsbn13: new Map(), byTitle: new Map([['b', [owned(2)]]]) }),
+    });
+
+    const results = await service.checkAvailability(
+      [
+        { title: 'a', mediaKind: 'ebook' },
+        { title: 'b', mediaKind: 'ebook' },
+        { title: 'c', mediaKind: 'ebook' },
+      ],
+      1,
+      null,
+    );
+
+    expect(results.map((r) => r.ownedBookId)).toEqual([null, 2, null]);
+  });
+});
+
+describe('BookRequestDedupeService.findActiveRequestFor', () => {
+  it('returns the match for the most specific key when several hit', async () => {
+    const byIsbn = { id: 1, dedupeKey: 'isbn13:9780441013593:ebook' };
+    const byWork = { id: 2, dedupeKey: 'work:dune:frankherbert:ebook' };
+    const { service } = makeService({
+      findActiveByDedupeKeys: vi.fn().mockResolvedValue(
+        new Map([
+          ['isbn13:9780441013593:ebook', byIsbn],
+          ['work:dune:frankherbert:ebook', byWork],
+        ]),
+      ),
+    });
+
+    const found = await service.findActiveRequestFor({
+      title: 'Dune',
+      authors: ['Frank Herbert'],
+      isbn13: '9780441013593',
+      mediaKind: 'ebook',
+    });
+
+    expect(found).toBe(byIsbn);
+  });
+
+  it('returns undefined when nothing is live', async () => {
+    const { service } = makeService();
+    await expect(service.findActiveRequestFor({ title: 'Dune', mediaKind: 'ebook' })).resolves.toBeUndefined();
+  });
+});
+
+/**
+ * The hole aliases exist to narrow, stated as a test so the shape is not re-derived: a request
+ * filed under its ISBN and a free-text one that only ever produces a work key never collide on the
+ * stored key alone, and the unique index permits both.
+ */
+describe('BookRequestDedupeService free-text collision', () => {
+  const isbnWork = { title: 'Dune', authors: ['Frank Herbert'], isbn13: '9780441013593', mediaKind: 'ebook' as const };
+  const typedWork = { title: 'Dune', authors: ['Frank Herbert'], mediaKind: 'ebook' as const };
+
+  it('files an ISBN-bearing request under a key free text can never produce', () => {
+    expect(primaryDedupeKey(isbnWork)).toMatch(/^isbn13:/);
+    expect(primaryDedupeKey(typedWork)).not.toMatch(/^isbn13:/);
+  });
+
+  /** Which is why the work key is stored as an alias alongside it, and probed on the way in. */
+  it("still emits the shared work key as one of the ISBN request's candidates", () => {
+    const shared = primaryDedupeKey(typedWork);
+    expect(dedupeKeyCandidates(isbnWork)).toContain(shared);
+  });
+
+  it('finds the live request through an alias the repository matched', async () => {
+    const existing = { id: 7, dedupeKey: `isbn13:9780441013593:ebook` };
+    const { service } = makeService({
+      // What the repository returns once it has probed the alias table: keyed by the key that was
+      // asked about, not by the one the row was filed under.
+      findActiveByDedupeKeys: vi.fn().mockResolvedValue(new Map([[primaryDedupeKey(typedWork), existing]])),
+    });
+
+    await expect(service.findActiveRequestFor(typedWork)).resolves.toBe(existing);
+  });
+});
diff --git a/server/src/modules/book-request/book-request-dedupe.service.ts b/server/src/modules/book-request/book-request-dedupe.service.ts
new file mode 100644
index 000000000..fbdca5de8
--- /dev/null
+++ b/server/src/modules/book-request/book-request-dedupe.service.ts
@@ -0,0 +1,179 @@
+import { Injectable } from '@nestjs/common';
+import { bookRequestWorkKey, canonicalizeBookRequestIsbn, normalizeWorkToken } from '@bookorbit/types';
+import type { BookRequestAvailability, BookRequestAvailabilityQuery, BookRequestMediaKind, BookRequestMetadataSource } from '@bookorbit/types';
+
+import { BookRequestRepository, type OwnedTitleMatch } from './book-request.repository';
+
+export interface WorkIdentity {
+  title: string;
+  authors?: string[] | null;
+  isbn13?: string | null;
+  providerKey?: string | null;
+  providerId?: string | null;
+  metadataSources?: BookRequestMetadataSource[] | null;
+  mediaKind: BookRequestMediaKind;
+}
+
+export function normalizeIsbn(value: string | null | undefined): string | null {
+  const normalized = (value ?? '').replace(/[^0-9Xx]/g, '').toUpperCase();
+  return normalized.length === 13 || normalized.length === 10 ? normalized : null;
+}
+
+/** Matches the `lower(title)` expression index on `book_metadata`; see the repository. */
+export function lowerTitleKey(title: string): string {
+  return title.trim().toLowerCase();
+}
+
+/** Re-exported so the dedupe rules read from one place; the implementation is shared with the client. */
+export const normalizeToken = normalizeWorkToken;
+
+/**
+ * Every key this work could have been filed under, most specific first.
+ *
+ * Deriving only the preferred key is not enough. Two people can reach the same book through
+ * different providers, one result carrying an ISBN13 and the other not, and their preferred keys
+ * would never collide - so the second request would be created rather than folded in, and on a
+ * private tracker that is two grabs of one torrent. Callers probe all of these.
+ */
+export function dedupeKeyCandidates(work: WorkIdentity): string[] {
+  const isbnKeys: string[] = [];
+  const isbn13 = normalizeIsbn(work.isbn13);
+  if (isbn13 && isbn13.length === 13) isbnKeys.push(`isbn13:${isbn13}:${work.mediaKind}`);
+  for (const source of work.metadataSources ?? []) {
+    const canonical = canonicalizeBookRequestIsbn(source.isbn10, source.isbn13);
+    if (canonical) isbnKeys.push(`isbn13:${canonical}:${work.mediaKind}`);
+  }
+
+  const providerKeys: string[] = [];
+  if (work.providerKey && work.providerId) {
+    providerKeys.push(`provider:${work.providerKey}:${work.providerId}:${work.mediaKind}`);
+  }
+  for (const source of work.metadataSources ?? []) {
+    providerKeys.push(`provider:${source.providerKey}:${source.providerId}:${work.mediaKind}`);
+  }
+
+  // Any title at all produces a work key. Testing the normalized token instead used to leave every
+  // non-Latin title with no key here while `primaryDedupeKey` filed the row under a constant, so
+  // the probe found nothing, the insert collided with an unrelated request and the submitter got a
+  // 500. The two have to agree about what a work is called, whatever alphabet it is called it in.
+  const workKeys: string[] = [];
+  if (work.title.trim()) {
+    workKeys.push(bookRequestWorkKey(work.title, work.authors?.[0], work.mediaKind));
+  }
+
+  return [...new Set([...isbnKeys, ...providerKeys, ...workKeys])];
+}
+
+/**
+ * The key a new request is stored under: the most specific one available.
+ *
+ * The last resort is the work key rather than a constant. A constant would be one key shared by
+ * every request the candidate list came back empty for, and since the probe never looks a request
+ * up under a key it was not given, the second such submission of a medium would collide on the
+ * partial unique index and reach the submitter as an unexplained 500.
+ */
+export function primaryDedupeKey(work: WorkIdentity): string {
+  const candidates = dedupeKeyCandidates(work);
+  const fallback = bookRequestWorkKey(work.title, work.authors?.[0], work.mediaKind);
+
+  const isbnKeys = candidates.filter((key) => key.startsWith('isbn13:'));
+  if (isbnKeys.length <= 1) return candidates[0] ?? fallback;
+
+  return candidates.find((key) => key.startsWith('work:')) ?? candidates[0] ?? fallback;
+}
+
+/**
+ * A shared title is not a shared book. When the candidate names an author, only a book that
+ * agrees on it counts as owned; a candidate with no author at all has nothing better to go on,
+ * so the title match stands.
+ */
+export function matchOwnedByTitle(matches: OwnedTitleMatch[] | undefined, author: string | null | undefined): number | null {
+  if (!matches?.length) return null;
+
+  const wanted = normalizeToken(author ?? '');
+  if (!wanted) return matches[0].bookId;
+
+  const agreed = matches.find((match) => match.authorNames.some((name) => normalizeToken(name) === wanted));
+  return agreed?.bookId ?? null;
+}
+
+@Injectable()
+export class BookRequestDedupeService {
+  constructor(private readonly repo: BookRequestRepository) {}
+
+  /** Finds a present copy of one work inside the libraries the requester can reach. */
+  async findOwnedBookFor(work: WorkIdentity, accessibleLibraryIds: number[] | null): Promise<number | null> {
+    const isbn13s = [normalizeIsbn(work.isbn13), ...(work.metadataSources ?? []).map((source) => normalizeIsbn(source.isbn13))].filter(
+      (value): value is string => value !== null && value.length === 13,
+    );
+    const titleKey = lowerTitleKey(work.title);
+    const owned = await this.repo.findOwnedMatches([...new Set(isbn13s)], titleKey ? [titleKey] : [], accessibleLibraryIds);
+
+    for (const isbn13 of isbn13s) {
+      const bookId = owned.byIsbn13.get(isbn13);
+      if (bookId !== undefined) return bookId;
+    }
+    return matchOwnedByTitle(owned.byTitle.get(titleKey), work.authors?.[0]);
+  }
+
+  /**
+   * Annotates a batch of search candidates with "already in your library" and "already
+   * requested". Three queries total regardless of batch size.
+   */
+  async checkAvailability(
+    queries: BookRequestAvailabilityQuery[],
+    userId: number,
+    accessibleLibraryIds: number[] | null,
+  ): Promise<BookRequestAvailability[]> {
+    if (queries.length === 0) return [];
+
+    const perQueryKeys = queries.map((query) =>
+      dedupeKeyCandidates({
+        title: query.title,
+        authors: query.author ? [query.author] : [],
+        isbn13: query.isbn13,
+        providerKey: query.providerKey,
+        providerId: query.providerId,
+        mediaKind: query.mediaKind,
+      }),
+    );
+
+    const isbn13s = [...new Set(queries.map((q) => normalizeIsbn(q.isbn13)).filter((v): v is string => v !== null && v.length === 13))];
+    const lowerTitles = [...new Set(queries.map((q) => lowerTitleKey(q.title)).filter(Boolean))];
+    const allKeys = [...new Set(perQueryKeys.flat())];
+
+    const [owned, activeRequests] = await Promise.all([
+      this.repo.findOwnedMatches(isbn13s, lowerTitles, accessibleLibraryIds),
+      this.repo.findActiveByDedupeKeys(allKeys),
+    ]);
+
+    const matchedRequestIds = [...new Set([...activeRequests.values()].map((row) => row.id))];
+    const subscribedIds = await this.repo.findSubscribedRequestIds(userId, matchedRequestIds);
+
+    return queries.map((query, index) => {
+      const isbn13 = normalizeIsbn(query.isbn13);
+      const ownedByIsbn = isbn13 !== null && isbn13.length === 13 ? owned.byIsbn13.get(isbn13) : undefined;
+      const ownedBookId = ownedByIsbn ?? matchOwnedByTitle(owned.byTitle.get(lowerTitleKey(query.title)), query.author);
+
+      const existing = perQueryKeys[index].map((key) => activeRequests.get(key)).find((row) => row !== undefined);
+
+      return {
+        ownedBookId,
+        existingRequestId: existing?.id ?? null,
+        existingRequestStatus: existing ? (existing.status as BookRequestAvailability['existingRequestStatus']) : null,
+        alreadySubscribed: existing ? existing.userId === userId || subscribedIds.has(existing.id) : false,
+      };
+    });
+  }
+
+  /** Single-work form used on submit, where all three key shapes still have to be probed. */
+  async findActiveRequestFor(work: WorkIdentity) {
+    const keys = dedupeKeyCandidates(work);
+    const matches = await this.repo.findActiveByDedupeKeys(keys);
+    for (const key of keys) {
+      const row = matches.get(key);
+      if (row) return row;
+    }
+    return undefined;
+  }
+}
diff --git a/server/src/modules/book-request/book-request-events.service.ts b/server/src/modules/book-request/book-request-events.service.ts
new file mode 100644
index 000000000..df21dcf23
--- /dev/null
+++ b/server/src/modules/book-request/book-request-events.service.ts
@@ -0,0 +1,15 @@
+import { Injectable } from '@nestjs/common';
+import { EventEmitter } from 'events';
+
+/**
+ * Emitted with a `book_request_downloads.id` whenever an attempt ends badly.
+ *
+ * The seam exists so the retry policy can live in one place without the fulfilment service and
+ * the automation service holding references to each other: fulfilment would need automation to
+ * decide whether to retry, and automation needs fulfilment to perform the grab. Mirrors
+ * `BookDockEventsService`, which the module already consumes for the same reason.
+ */
+export const BOOK_REQUEST_DOWNLOAD_FAILED = 'book-request.download.failed';
+
+@Injectable()
+export class BookRequestEventsService extends EventEmitter {}
diff --git a/server/src/modules/book-request/book-request-notifier.service.test.ts b/server/src/modules/book-request/book-request-notifier.service.test.ts
new file mode 100644
index 000000000..193e503bb
--- /dev/null
+++ b/server/src/modules/book-request/book-request-notifier.service.test.ts
@@ -0,0 +1,129 @@
+import { NotificationType, Permission } from '@bookorbit/types';
+
+import { BookRequestNotifier } from './book-request-notifier.service';
+
+function makeNotifier(
+  interested: number[] = [3, 4],
+  reachers: number[] = interested,
+  libraryId: number | null = 5,
+  restricted: number[] = [],
+  exempt: number[] = [],
+) {
+  const notifications = { notify: vi.fn().mockResolvedValue(undefined) };
+  const repo = {
+    findInterestedUserIds: vi.fn().mockResolvedValue(interested),
+    findBookLibraryId: vi.fn().mockResolvedValue(libraryId),
+  };
+  const libraries = { findUserIdsWithAccess: vi.fn().mockResolvedValue(new Set(reachers)) };
+  const contentFilters = {
+    hasAnyContentFilters: vi.fn().mockResolvedValue(new Set(restricted)),
+    findExemptUserIds: vi.fn().mockResolvedValue(new Set(exempt)),
+  };
+  return {
+    notifier: new BookRequestNotifier(notifications as never, repo as never, libraries as never, contentFilters as never),
+    notifications,
+    repo,
+    libraries,
+    contentFilters,
+  };
+}
+
+const payload = { title: 'Book request download failed', message: '"Dune": the tracker went away' };
+
+describe('BookRequestNotifier.notifyResponsible', () => {
+  it('tells the approvers about an ordinary request', async () => {
+    const { notifier, notifications } = makeNotifier();
+
+    await notifier.notifyResponsible({ id: 7, selfServe: false }, NotificationType.BookRequestFailed, payload);
+
+    expect(notifications.notify).toHaveBeenCalledWith(
+      expect.objectContaining({ scope: { kind: 'permission', permission: Permission.ManageBookRequests } }),
+    );
+  });
+
+  /**
+   * A self-serve row was deliberately kept out of the moderation queue on the way in. Telling every
+   * approver when it goes wrong would put it back there, about work only its owner can act on.
+   */
+  it('tells the owner, and not the approvers, about a self-serve request', async () => {
+    const { notifier, notifications } = makeNotifier([3]);
+
+    await notifier.notifyResponsible({ id: 7, selfServe: true }, NotificationType.BookRequestFailed, payload);
+
+    expect(notifications.notify).toHaveBeenCalledTimes(1);
+    expect(notifications.notify).toHaveBeenCalledWith(expect.objectContaining({ scope: { kind: 'user', userId: 3 } }));
+  });
+
+  it('reaches every subscriber of a self-serve request, not only its creator', async () => {
+    const { notifier, notifications } = makeNotifier([3, 4]);
+
+    await notifier.notifyResponsible({ id: 7, selfServe: true }, NotificationType.BookRequestNeedsReview, payload);
+
+    expect(notifications.notify).toHaveBeenCalledTimes(2);
+  });
+});
+
+/**
+ * Where a request files is allowed to be a library the requester cannot read; saying so with a
+ * link that answers 403 is not. Both halves are asserted in one place because the two paths that
+ * announce a filed book - automatic import and closing by hand - go through this method.
+ */
+describe('BookRequestNotifier.notifyBookAvailable', () => {
+  const available = { title: 'Your requested book is available', message: '"Dune" is ready' };
+
+  it('links straight to the book for a recipient who can open it', async () => {
+    const { notifier, notifications } = makeNotifier([3], [3]);
+
+    await notifier.notifyBookAvailable(7, 42, available);
+
+    expect(notifications.notify).toHaveBeenCalledExactlyOnceWith(
+      expect.objectContaining({ actionUrl: '/book/42', scope: { kind: 'user', userId: 3 } }),
+    );
+  });
+
+  it('sends a recipient who cannot reach the destination to their request list instead', async () => {
+    const { notifier, notifications } = makeNotifier([3, 4], [3]);
+
+    await notifier.notifyBookAvailable(7, 42, available);
+
+    expect(notifications.notify).toHaveBeenCalledWith(expect.objectContaining({ actionUrl: '/book/42', scope: { kind: 'user', userId: 3 } }));
+    expect(notifications.notify).toHaveBeenCalledWith(expect.objectContaining({ actionUrl: '/requests', scope: { kind: 'user', userId: 4 } }));
+  });
+
+  it('sends everyone to the request list when nothing was filed as a book', async () => {
+    const { notifier, notifications, libraries } = makeNotifier([3, 4]);
+
+    await notifier.notifyBookAvailable(7, null, available);
+
+    expect(libraries.findUserIdsWithAccess).not.toHaveBeenCalled();
+    expect(notifications.notify).toHaveBeenCalledTimes(2);
+    expect(notifications.notify).toHaveBeenCalledWith(expect.objectContaining({ actionUrl: '/requests' }));
+  });
+
+  /** A book row with no library is a row nothing can be opened through, so nobody gets its link. */
+  it('sends everyone to the request list when the book names no library', async () => {
+    const { notifier, notifications } = makeNotifier([3], [3], null);
+
+    await notifier.notifyBookAvailable(7, 42, available);
+
+    expect(notifications.notify).toHaveBeenCalledExactlyOnceWith(expect.objectContaining({ actionUrl: '/requests' }));
+  });
+});
+
+describe('BookRequestNotifier.notifyBookAvailable content restrictions', () => {
+  it('sends a restricted recipient to their request list, not to a book their rules hide', async () => {
+    const { notifier, notifications } = makeNotifier([3], [3], 5, [3], []);
+
+    await notifier.notifyBookAvailable(7, 55, payload);
+
+    expect(notifications.notify).toHaveBeenCalledWith(expect.objectContaining({ actionUrl: '/requests', scope: { kind: 'user', userId: 3 } }));
+  });
+
+  it('links a restricted recipient straight to the book when they are exempt for their own requests', async () => {
+    const { notifier, notifications } = makeNotifier([3], [3], 5, [3], [3]);
+
+    await notifier.notifyBookAvailable(7, 55, payload);
+
+    expect(notifications.notify).toHaveBeenCalledWith(expect.objectContaining({ actionUrl: '/book/55', scope: { kind: 'user', userId: 3 } }));
+  });
+});
diff --git a/server/src/modules/book-request/book-request-notifier.service.ts b/server/src/modules/book-request/book-request-notifier.service.ts
new file mode 100644
index 000000000..7cf4c0b6f
--- /dev/null
+++ b/server/src/modules/book-request/book-request-notifier.service.ts
@@ -0,0 +1,98 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { NotificationType, Permission } from '@bookorbit/types';
+
+import { sanitizeLogValue } from '../../common/utils/log-sanitize.utils';
+import { LibraryService } from '../library/library.service';
+import { NotificationService } from '../notification/notification.service';
+import { ContentFilterRepository } from '../user/content-filter.repository';
+import { BookRequestRepository } from './book-request.repository';
+
+export interface RequestNotification {
+  title: string;
+  message: string;
+  actionUrl?: string;
+  meta?: Record<string, unknown>;
+}
+
+/**
+ * One place for the two audiences this feature notifies, so the grab pipeline and the approval
+ * flow cannot drift on who hears about what. A failed notification never fails the operation that
+ * triggered it: a book that landed has landed whether or not the mail went out.
+ */
+@Injectable()
+export class BookRequestNotifier {
+  private readonly logger = new Logger(BookRequestNotifier.name);
+
+  constructor(
+    private readonly notifications: NotificationService,
+    private readonly repo: BookRequestRepository,
+    private readonly libraries: LibraryService,
+    private readonly contentFilters: ContentFilterRepository,
+  ) {}
+
+  /** Everyone who can act on the queue, resolved by permission rather than by enumerating users. */
+  async notifyApprovers(type: NotificationType, payload: RequestNotification): Promise<void> {
+    await this.dispatch(type, { ...payload, scope: { kind: 'permission', permission: Permission.ManageBookRequests } });
+  }
+
+  /**
+   * Who hears about one request going wrong.
+   *
+   * A self-serve row is nobody's queue item. Its owner picked the release, is the only person who
+   * can act on what happened to it, and was deliberately kept out of the moderation queue on the
+   * way in; telling every approver about it would be noise about work that is not theirs.
+   */
+  async notifyResponsible(request: { id: number; selfServe: boolean }, type: NotificationType, payload: RequestNotification): Promise<void> {
+    if (request.selfServe) return this.notifyInterested(request.id, type, payload);
+    return this.notifyApprovers(type, payload);
+  }
+
+  /** The requester plus every subscriber: everyone who put their name against this book. */
+  async notifyInterested(requestId: number, type: NotificationType, payload: RequestNotification): Promise<void> {
+    const userIds = await this.repo.findInterestedUserIds(requestId);
+    for (const userId of userIds) {
+      await this.dispatch(type, { ...payload, scope: { kind: 'user', userId } });
+    }
+  }
+
+  /**
+   * The same audience, told that their book landed, with the link resolved for each of them.
+   *
+   * Where a request files is deliberately allowed to be a library the requester cannot read: the
+   * operator chose the instance default for the whole instance, and somebody who cannot see it is
+   * exactly who it exists for. Saying so with a link that answers 403 is not deliberate. Anybody
+   * who can open the book is sent to the book; everybody else is sent to their request list,
+   * which is theirs whatever the destination turned out to be.
+   *
+   * Library access is only the first gate. Content restrictions hide individual books inside a
+   * library somebody can otherwise open, so a restricted reader was still being handed a link to
+   * a book their own queries refuse to return. Somebody exempted from their restrictions for
+   * their own requests can open this one by definition, since this is one. The remaining case,
+   * a restricted reader whose rules happen to admit this book anyway, is sent to the request list
+   * rather than resolved exactly: one extra click beats a link that answers nothing.
+   */
+  async notifyBookAvailable(requestId: number, bookId: number | null, payload: Omit<RequestNotification, 'actionUrl'>): Promise<void> {
+    const userIds = await this.repo.findInterestedUserIds(requestId);
+    const libraryId = bookId === null ? null : await this.repo.findBookLibraryId(bookId);
+    const reachers = libraryId === null ? new Set<number>() : await this.libraries.findUserIdsWithAccess(libraryId, userIds);
+
+    const restricted = await this.contentFilters.hasAnyContentFilters([...reachers]);
+    const exempt = restricted.size > 0 ? await this.contentFilters.findExemptUserIds([...restricted]) : new Set<number>();
+
+    for (const userId of userIds) {
+      const canOpen = reachers.has(userId) && (!restricted.has(userId) || exempt.has(userId));
+      const actionUrl = bookId !== null && canOpen ? `/book/${bookId}` : '/requests';
+      await this.dispatch(NotificationType.BookRequestAvailable, { ...payload, actionUrl, scope: { kind: 'user', userId } });
+    }
+  }
+
+  private async dispatch(
+    type: NotificationType,
+    payload: RequestNotification & { scope: Parameters<NotificationService['notify']>[0]['scope'] },
+  ): Promise<void> {
+    await this.notifications.notify({ type, ...payload }).catch((err: unknown) => {
+      const message = sanitizeLogValue(err instanceof Error ? err.message : String(err));
+      this.logger.warn(`[book_request.notify] [fail] type=${type} error="${message}" - notification dispatch failed`);
+    });
+  }
+}
diff --git a/server/src/modules/book-request/book-request-self-fulfil.controller.ts b/server/src/modules/book-request/book-request-self-fulfil.controller.ts
new file mode 100644
index 000000000..f5ae6093c
--- /dev/null
+++ b/server/src/modules/book-request/book-request-self-fulfil.controller.ts
@@ -0,0 +1,166 @@
+import { Body, Controller, DefaultValuePipe, Get, HttpCode, HttpStatus, Param, ParseBoolPipe, ParseIntPipe, Post, Query } from '@nestjs/common';
+import { AuditAction, AuditResource, Permission } from '@bookorbit/types';
+
+import { Auditable } from '../../common/decorators/auditable.decorator';
+import { CurrentUser } from '../../common/decorators/current-user.decorator';
+import { RequirePermission } from '../../common/decorators/require-permission.decorator';
+import type { RequestUser } from '../../common/types/request-user';
+import { BookRequestService } from './book-request.service';
+import { DownloadClientConfigService } from './download-clients/download-client-config.service';
+import { RequestFulfillmentService } from './fulfillment/request-fulfillment.service';
+import { RequestImportService } from './fulfillment/request-import.service';
+import { RequestSeedService } from './fulfillment/request-seed.service';
+import { RequestVerificationService } from './fulfillment/request-verification.service';
+import { GrabBookRequestDto } from './dto/grab-book-request.dto';
+import { InspectBookRequestReleaseDto } from './dto/inspect-book-request-release.dto';
+import { SelectReleaseUnitDto } from './dto/select-release-unit.dto';
+import { SearchBookRequestReleasesDto } from './dto/search-book-request-releases.dto';
+
+/**
+ * Fulfilling your own request without an approver in the loop. Every route here has an identical
+ * twin under `admin/book-requests`; the difference is who may call it and on which rows, which
+ * `assertCanFulfil` answers per request rather than the guard answering once for all of them.
+ *
+ * Its own path rather than a segment under `book-requests`, for the reason the automation
+ * controller has one: `book-requests/:id` would match `book-requests/download-clients` first and
+ * reject it in the integer pipe before this controller was ever consulted.
+ *
+ * A method-level `@RequirePermission` would not have worked either. `PermissionGuard` reads with
+ * `getAllAndOverride`, so a handler-level permission *replaces* the class-level one instead of
+ * adding to it, and these routes would have stopped requiring `BookRequestAccess` at all.
+ *
+ * Deliberately absent: `fulfill`, which closes a request by hand, and removing a completed torrent
+ * that is only seeding. Cancelling an active transfer lives on the shared request controller, so
+ * the person driving it can stop the download without closing the request.
+ */
+@Controller('book-request-fulfilment')
+@RequirePermission(Permission.BookRequestAccess, Permission.BookRequestSelfFulfill)
+export class BookRequestSelfFulfilController {
+  constructor(
+    private readonly service: BookRequestService,
+    private readonly fulfillment: RequestFulfillmentService,
+    private readonly downloadClients: DownloadClientConfigService,
+    private readonly seed: RequestSeedService,
+    private readonly imports: RequestImportService,
+    private readonly verification: RequestVerificationService,
+  ) {}
+
+  /** Names and ids only, so the grab dialog can offer a choice it is allowed to act on. */
+  @Get('download-clients')
+  listDownloadClients() {
+    return this.downloadClients.findEnabledSummaries('torrent');
+  }
+
+  @Get(':id/releases')
+  async listReleases(
+    @Param('id', ParseIntPipe) id: number,
+    @Query('refresh', new DefaultValuePipe(false), ParseBoolPipe) refresh: boolean,
+    @CurrentUser() user: RequestUser,
+  ) {
+    await this.service.assertCanFulfil(id, user);
+    return this.fulfillment.listReleases(id, { refresh });
+  }
+
+  @Post(':id/releases/search')
+  @HttpCode(HttpStatus.OK)
+  async searchReleases(@Param('id', ParseIntPipe) id: number, @Body() dto: SearchBookRequestReleasesDto, @CurrentUser() user: RequestUser) {
+    await this.service.assertCanFulfil(id, user);
+    return this.fulfillment.listReleases(id, { refresh: true, overrides: dto });
+  }
+
+  @Post(':id/releases/inspect')
+  @HttpCode(HttpStatus.OK)
+  async inspectRelease(@Param('id', ParseIntPipe) id: number, @Body() dto: InspectBookRequestReleaseDto, @CurrentUser() user: RequestUser) {
+    await this.service.assertCanFulfil(id, user);
+    return this.fulfillment.inspectRelease(id, dto);
+  }
+
+  @Post(':id/grab')
+  @HttpCode(HttpStatus.OK)
+  @Auditable({
+    action: AuditAction.BookRequestGrab,
+    resource: AuditResource.BookRequest,
+    getResourceId: (req) => Number(req.params.id),
+    description: 'Sent their own book request to a download client',
+  })
+  async grab(@Param('id', ParseIntPipe) id: number, @Body() dto: GrabBookRequestDto, @CurrentUser() user: RequestUser) {
+    await this.service.assertCanFulfil(id, user);
+    return this.fulfillment.grab(id, dto, user);
+  }
+
+  @Get(':id/attempts')
+  async attempts(@Param('id', ParseIntPipe) id: number, @CurrentUser() user: RequestUser) {
+    await this.service.assertCanFulfil(id, user);
+    return this.fulfillment.listAttempts(id);
+  }
+
+  /** Read only. Stopping a seed is a decision about shared infrastructure, so it stays moderator-only. */
+  @Get(':id/seed')
+  async seedStatus(@Param('id', ParseIntPipe) id: number, @CurrentUser() user: RequestUser) {
+    await this.service.assertCanFulfil(id, user);
+    return this.seed.getSeedStatus(id);
+  }
+
+  @Get(':id/review')
+  async getReview(@Param('id', ParseIntPipe) id: number, @CurrentUser() user: RequestUser) {
+    await this.service.assertCanFulfil(id, user);
+    return this.verification.getReview(id);
+  }
+
+  /**
+   * Overriding the verifier on a release you picked deliberately. Without this the feature would
+   * dead-end exactly where auto-approval does: a below-threshold score on your own choice is a
+   * common outcome, not a rare one.
+   */
+  @Post(':id/force-file')
+  @HttpCode(HttpStatus.OK)
+  @Auditable({
+    action: AuditAction.BookRequestImport,
+    resource: AuditResource.BookRequest,
+    getResourceId: (req) => Number(req.params.id),
+    description: 'Filed their own held book request import',
+  })
+  async forceFile(@Param('id', ParseIntPipe) id: number, @CurrentUser() user: RequestUser) {
+    await this.service.assertCanFulfil(id, user);
+    await this.verification.fileHeldImport(id, user);
+    return this.service.getOne(id, user);
+  }
+
+  /**
+   * The other half of reviewing your own import. Filing needs a destination and force-filing is
+   * an override; this is the answer when the release turned out to be the wrong book. The dock
+   * entry goes through the dock's own discard, so a self-fulfiller without Book Dock permissions
+   * can still clear up after themselves rather than leaving an orphan behind.
+   */
+  @Post(':id/discard-import')
+  @HttpCode(HttpStatus.OK)
+  @Auditable({
+    action: AuditAction.BookRequestImport,
+    resource: AuditResource.BookRequest,
+    getResourceId: (req) => Number(req.params.id),
+    description: 'Discarded their own held book request import',
+  })
+  async discardImport(@Param('id', ParseIntPipe) id: number, @CurrentUser() user: RequestUser) {
+    await this.service.assertCanFulfil(id, user);
+    await this.verification.discardHeldImport(id, user);
+    return this.service.getOne(id, user);
+  }
+
+  @Post(':id/downloads/:downloadId/select-unit')
+  @HttpCode(HttpStatus.OK)
+  @Auditable({
+    action: AuditAction.BookRequestImport,
+    resource: AuditResource.BookRequest,
+    getResourceId: (req) => Number(req.params.id),
+    description: 'Chose which book to import from their own multi-book release',
+  })
+  async selectReleaseUnit(
+    @Param('id', ParseIntPipe) id: number,
+    @Param('downloadId', ParseIntPipe) downloadId: number,
+    @Body() dto: SelectReleaseUnitDto,
+    @CurrentUser() user: RequestUser,
+  ) {
+    await this.service.assertCanFulfil(id, user);
+    return this.imports.importChosenUnit(id, downloadId, dto.unitIndex);
+  }
+}
diff --git a/server/src/modules/book-request/book-request.controller.ts b/server/src/modules/book-request/book-request.controller.ts
new file mode 100644
index 000000000..a5994b4dc
--- /dev/null
+++ b/server/src/modules/book-request/book-request.controller.ts
@@ -0,0 +1,150 @@
+import { Body, Controller, Delete, Get, HttpCode, HttpStatus, Param, ParseIntPipe, Post, Query } from '@nestjs/common';
+import { AuditAction, AuditResource, Permission } from '@bookorbit/types';
+
+import { Auditable } from '../../common/decorators/auditable.decorator';
+import { CurrentUser } from '../../common/decorators/current-user.decorator';
+import { RequireAnyPermission } from '../../common/decorators/require-any-permission.decorator';
+import { RequirePermission } from '../../common/decorators/require-permission.decorator';
+import type { RequestUser } from '../../common/types/request-user';
+import { BookRequestService } from './book-request.service';
+import { CheckAvailabilityDto } from './dto/check-availability.dto';
+import { CreateBookRequestDto } from './dto/create-book-request.dto';
+import { BulkBookRequestsDto } from './dto/bulk-book-requests.dto';
+import { ListBookRequestsDto } from './dto/list-book-requests.dto';
+import { UpdateBookRequestLanguageDto } from './dto/update-book-request-language.dto';
+
+@Controller('book-requests')
+@RequirePermission(Permission.BookRequestAccess)
+export class BookRequestController {
+  constructor(private readonly service: BookRequestService) {}
+
+  @Post()
+  @Auditable({
+    action: AuditAction.BookRequestCreate,
+    resource: AuditResource.BookRequest,
+    getResourceId: (_req, body) => (body as { request?: { id?: number } })?.request?.id,
+    description: 'Created a book request',
+  })
+  submit(@Body() dto: CreateBookRequestDto, @CurrentUser() user: RequestUser) {
+    return this.service.submit(dto, user);
+  }
+
+  @Get()
+  listMine(@Query() query: ListBookRequestsDto, @CurrentUser() user: RequestUser) {
+    return this.service.listMine(query, user);
+  }
+
+  @Get('summary')
+  getSummary(@CurrentUser() user: RequestUser) {
+    return this.service.getSummary(user);
+  }
+
+  /**
+   * Counts only, for the same reason `default-destinations` is here: it is instance configuration
+   * a requester has to be told about, and the indexer list it comes from is admin-only. Without
+   * it a request queued against nothing looks identical to one waiting its turn.
+   *
+   * Also answers to `ManageAppSettings`, which is the permission the automation tab requires: the
+   * one warning that tab exists for is "auto-grab is on and there is nothing to search", and an
+   * operator who is not also a requester was silently never shown it.
+   */
+  @Get('source-status')
+  @RequireAnyPermission(Permission.BookRequestAccess, Permission.ManageAppSettings)
+  getSourceStatus() {
+    return this.service.getSourceStatus();
+  }
+
+  /**
+   * Instance configuration rather than anything of this user's, but read from the request form,
+   * so it is gated on requesting rather than on managing settings.
+   */
+  @Get('default-destinations')
+  getDefaultDestinations() {
+    return this.service.getDefaultDestinations();
+  }
+
+  /**
+   * POST because the payload is a batch of candidates, not an addressable resource. Read-only,
+   * so it is not audited.
+   */
+  @Post('availability')
+  @HttpCode(HttpStatus.OK)
+  checkAvailability(@Body() dto: CheckAvailabilityDto, @CurrentUser() user: RequestUser) {
+    return this.service.checkAvailability(dto.items, user);
+  }
+
+  @Get(':id')
+  getOne(@Param('id', ParseIntPipe) id: number, @CurrentUser() user: RequestUser) {
+    return this.service.getOne(id, user);
+  }
+
+  /**
+   * Not audited alongside the decisions: this changes what the request is asking for, not whether
+   * it was allowed, and the service logs the before and after either way.
+   */
+  @Post(':id/language')
+  @HttpCode(HttpStatus.OK)
+  setLanguage(@Param('id', ParseIntPipe) id: number, @Body() dto: UpdateBookRequestLanguageDto, @CurrentUser() user: RequestUser) {
+    return this.service.setLanguage(id, dto.language, user);
+  }
+
+  @Post(':id/cancel')
+  @HttpCode(HttpStatus.OK)
+  @Auditable({
+    action: AuditAction.BookRequestCancel,
+    resource: AuditResource.BookRequest,
+    getResourceId: (req) => Number(req.params.id),
+    description: 'Cancelled a book request',
+  })
+  cancel(@Param('id', ParseIntPipe) id: number, @CurrentUser() user: RequestUser) {
+    return this.service.cancel(id, user);
+  }
+
+  @Post(':id/downloads/:downloadId/cancel')
+  @HttpCode(HttpStatus.OK)
+  @Auditable({
+    action: AuditAction.BookRequestRemoveDownload,
+    resource: AuditResource.BookRequest,
+    getResourceId: (req) => Number(req.params.id),
+    description: 'Cancelled an active book request download',
+  })
+  cancelDownload(@Param('id', ParseIntPipe) id: number, @Param('downloadId', ParseIntPipe) downloadId: number, @CurrentUser() user: RequestUser) {
+    return this.service.cancelDownload(id, downloadId, user);
+  }
+
+  /**
+   * Leaving a request somebody else made, which is the way back out of joining one. Not audited
+   * for the same reason dismissal is not: it changes nothing anybody else can see.
+   */
+  @Delete(':id/subscription')
+  @HttpCode(HttpStatus.NO_CONTENT)
+  unsubscribe(@Param('id', ParseIntPipe) id: number, @CurrentUser() user: RequestUser) {
+    return this.service.unsubscribe(id, user);
+  }
+
+  /**
+   * Bulk hiding, declared before `:id/dismiss` for readability; the two paths never collide.
+   * Not audited: what one person keeps on their own list is not a moderation event.
+   */
+  @Post('dismiss')
+  @HttpCode(HttpStatus.OK)
+  dismissMany(@Body() dto: BulkBookRequestsDto, @CurrentUser() user: RequestUser) {
+    return this.service.dismissMany(dto, user);
+  }
+
+  /**
+   * Hiding a settled request from your own list. Not audited: it changes nothing anybody else can
+   * see, and a log of who stopped looking at what is noise.
+   */
+  @Post(':id/dismiss')
+  @HttpCode(HttpStatus.OK)
+  dismiss(@Param('id', ParseIntPipe) id: number, @CurrentUser() user: RequestUser) {
+    return this.service.dismiss(id, user);
+  }
+
+  @Post(':id/restore')
+  @HttpCode(HttpStatus.OK)
+  restore(@Param('id', ParseIntPipe) id: number, @CurrentUser() user: RequestUser) {
+    return this.service.restore(id, user);
+  }
+}
diff --git a/server/src/modules/book-request/book-request.gateway.test.ts b/server/src/modules/book-request/book-request.gateway.test.ts
new file mode 100644
index 000000000..6ee8b73b3
--- /dev/null
+++ b/server/src/modules/book-request/book-request.gateway.test.ts
@@ -0,0 +1,79 @@
+import { Permission } from '@bookorbit/types';
+
+import { BookRequestGateway } from './book-request.gateway';
+
+function makeGateway() {
+  const jwtService = { verify: vi.fn() };
+  const authService = { validateUser: vi.fn() };
+  const gateway = new BookRequestGateway(jwtService as any, authService as any);
+  return { gateway, jwtService, authService };
+}
+
+function makeClient(id = 'socket-1') {
+  return {
+    id,
+    handshake: { auth: { token: 'jwt' } },
+    data: {},
+    join: vi.fn().mockResolvedValue(undefined),
+    emit: vi.fn(),
+    disconnect: vi.fn(),
+  } as any;
+}
+
+async function connect(user: { id: number; isSuperuser: boolean; permissions: Permission[] }) {
+  const { gateway, jwtService, authService } = makeGateway();
+  jwtService.verify.mockReturnValue({ sub: user.id, ver: 1 });
+  authService.validateUser.mockResolvedValue(user);
+  const client = makeClient();
+  await gateway.handleConnection(client);
+  return { gateway, client };
+}
+
+describe('BookRequestGateway', () => {
+  it('rejects a socket without book request access', async () => {
+    const { client } = await connect({ id: 5, isSuperuser: false, permissions: [] });
+
+    expect(client.disconnect).toHaveBeenCalledTimes(1);
+    expect(client.join).not.toHaveBeenCalled();
+  });
+
+  it('puts an ordinary requester in their own room only', async () => {
+    const { client } = await connect({ id: 5, isSuperuser: false, permissions: [Permission.BookRequestAccess] });
+
+    expect(client.disconnect).not.toHaveBeenCalled();
+    expect(client.join.mock.calls.flat()).toEqual(['book-requests:user:5']);
+  });
+
+  it('puts a moderator in the managers room as well', async () => {
+    const { client } = await connect({ id: 6, isSuperuser: false, permissions: [Permission.BookRequestAccess, Permission.ManageBookRequests] });
+
+    expect(client.join.mock.calls.flat()).toEqual(['book-requests:user:6', 'book-requests:managers']);
+  });
+
+  /** A progress tick names request ids and byte totals, which HTTP hands to these people only. */
+  it('routes progress to the managers and the named viewers rather than broadcasting it', () => {
+    const { gateway } = makeGateway();
+    const emit = vi.fn();
+    const to = vi.fn().mockReturnValue({ emit });
+    const serverEmit = vi.fn();
+    gateway.server = { to, emit: serverEmit } as any;
+
+    gateway.emitProgress({ requestId: 3, downloadId: 9, status: 'downloading', progressPercent: 40, downloadedBytes: 4, totalBytes: 10 }, [5, 8]);
+
+    expect(to).toHaveBeenCalledWith(['book-requests:managers', 'book-requests:user:5', 'book-requests:user:8']);
+    expect(emit).toHaveBeenCalledWith('book-requests:progress', expect.objectContaining({ requestId: 3 }));
+    expect(serverEmit).not.toHaveBeenCalled();
+  });
+
+  /** The change signal carries nothing, and every page answers it with a scoped fetch. */
+  it('broadcasts the change signal to every connected socket', () => {
+    const { gateway } = makeGateway();
+    const emit = vi.fn();
+    gateway.server = { emit } as any;
+
+    gateway.emitChanged();
+
+    expect(emit).toHaveBeenCalledWith('book-requests:changed');
+    expect(gateway.changeVersion).toBe(1);
+  });
+});
diff --git a/server/src/modules/book-request/book-request.gateway.ts b/server/src/modules/book-request/book-request.gateway.ts
new file mode 100644
index 000000000..a84f010c5
--- /dev/null
+++ b/server/src/modules/book-request/book-request.gateway.ts
@@ -0,0 +1,93 @@
+import { Logger, UnauthorizedException } from '@nestjs/common';
+import { JwtService } from '@nestjs/jwt';
+import { OnGatewayConnection, OnGatewayDisconnect, WebSocketGateway, WebSocketServer } from '@nestjs/websockets';
+import { Server, Socket } from 'socket.io';
+import { Permission } from '@bookorbit/types';
+import type { BookRequestProgressEvent } from '@bookorbit/types';
+
+import { AuthService } from '../auth/auth.service';
+import { sanitizeLogValue } from '../../common/utils/log-sanitize.utils';
+import { rejectSocketConnection } from '../../common/utils/ws-auth.utils';
+import { wsCorsOrigin } from '../../common/utils/ws-cors.utils';
+
+/** Everybody who reaches every request over HTTP, and therefore every request's progress. */
+const MANAGERS_ROOM = 'book-requests:managers';
+
+/** One room per connected user, so a progress tick can name who is entitled to it. */
+function userRoom(userId: number): string {
+  return `book-requests:user:${userId}`;
+}
+
+/**
+ * Mirrors `book-dock.gateway.ts`, with one difference that matters: progress is routed rather than
+ * broadcast. The payload carries request ids, download ids and byte totals, and `GET
+ * /book-requests/:id` hands those to the requester, the subscribers and the moderators only. A
+ * socket holding `book_request_access` is not automatically one of those, so a broadcast would
+ * put operational detail about somebody else's request on a page that cannot open it.
+ *
+ * `changed` stays a broadcast. It carries nothing, and every page answers it with a fetch that is
+ * scoped by the same rules the HTTP surface applies.
+ */
+@WebSocketGateway({ namespace: '/book-requests', cors: { origin: wsCorsOrigin() } })
+export class BookRequestGateway implements OnGatewayConnection, OnGatewayDisconnect {
+  @WebSocketServer() server: Server;
+  private readonly logger = new Logger(BookRequestGateway.name);
+  private changes = 0;
+
+  constructor(
+    private readonly jwtService: JwtService,
+    private readonly authService: AuthService,
+  ) {}
+
+  async handleConnection(client: Socket): Promise<void> {
+    try {
+      const token = client.handshake.auth?.token as string | undefined;
+      if (!token) throw new UnauthorizedException('No token provided');
+      const payload = this.jwtService.verify<{ sub: number; ver: number }>(token, { algorithms: ['HS256'] });
+      const user = await this.authService.validateUser(payload.sub, payload.ver);
+      if (!user) throw new UnauthorizedException('User not found or token revoked');
+      if (!user.isSuperuser && !user.permissions.includes(Permission.BookRequestAccess)) {
+        throw new UnauthorizedException('Missing book request access');
+      }
+      (client.data as Record<string, unknown>).user = user;
+      await client.join(userRoom(user.id));
+      // Read once at connect, like the permission check above it: a permission taken away mid
+      // session is caught by the token version, which drops the socket rather than re-roles it.
+      if (user.isSuperuser || user.permissions.includes(Permission.ManageBookRequests)) await client.join(MANAGERS_ROOM);
+      this.logger.debug(`WS connected: user=${user.id} socket=${client.id}`);
+    } catch (err) {
+      this.logger.warn(
+        `[book_request.ws_connect] [fail] socket=${client.id} errorClass=${(err as Error)?.constructor?.name ?? 'Error'} error="${sanitizeLogValue((err as Error).message)}" - handshake refused`,
+      );
+      rejectSocketConnection(client, err);
+    }
+  }
+
+  handleDisconnect(client: Socket): void {
+    this.logger.debug(`WS disconnected: socket=${client.id}`);
+  }
+
+  /**
+   * How many change broadcasts have gone out. Every page answers a broadcast with a refetch, so
+   * anything caching a derived view of the request set keys on this: a value computed before the
+   * last change can then never be served after it, without every mutation having to know what
+   * caches exist.
+   */
+  get changeVersion(): number {
+    return this.changes;
+  }
+
+  emitChanged(): void {
+    this.changes++;
+    this.server?.emit('book-requests:changed');
+  }
+
+  /**
+   * `viewerUserIds` is the requester plus the subscribers; the managers room is added here so no
+   * caller has to resolve who those are. Socket.IO delivers once per socket however many of the
+   * named rooms it is in.
+   */
+  emitProgress(event: BookRequestProgressEvent, viewerUserIds: readonly number[]): void {
+    this.server?.to([MANAGERS_ROOM, ...viewerUserIds.map(userRoom)]).emit('book-requests:progress', event);
+  }
+}
diff --git a/server/src/modules/book-request/book-request.mapper.ts b/server/src/modules/book-request/book-request.mapper.ts
new file mode 100644
index 000000000..5880f64fd
--- /dev/null
+++ b/server/src/modules/book-request/book-request.mapper.ts
@@ -0,0 +1,103 @@
+import type {
+  BookRequestDownloadItem,
+  BookRequestDownloadSource,
+  BookRequestDownloadStatus,
+  BookRequestHandbackCode,
+  BookRequestItem,
+  BookRequestMediaKind,
+  BookRequestStatus,
+  BookRequestSubscriber,
+} from '@bookorbit/types';
+
+import type { BookRequestJoinedRow } from './book-request.repository';
+import type { BookRequestDownloadJoinedRow } from './fulfillment/book-request-download.repository';
+
+/**
+ * Shared by the request service and the fulfilment pipeline, both of which hand a request back
+ * over HTTP. A second copy of this mapping is how a field ends up present on one endpoint and
+ * missing on another.
+ */
+export function mapBookRequestRow(
+  row: BookRequestJoinedRow,
+  subscribers: BookRequestSubscriber[],
+  download: BookRequestDownloadJoinedRow | null,
+  dismissed: boolean,
+): BookRequestItem {
+  const r = row.request;
+  return {
+    id: r.id,
+    userId: r.userId,
+    requesterUsername: row.requesterUsername,
+    requesterName: row.requesterName,
+    mediaKind: r.mediaKind as BookRequestMediaKind,
+    status: r.status as BookRequestStatus,
+    title: r.title,
+    subtitle: r.subtitle,
+    authors: r.authors ?? [],
+    seriesName: r.seriesName,
+    seriesIndex: r.seriesIndex,
+    isbn10: r.isbn10,
+    isbn13: r.isbn13,
+    publishedYear: r.publishedYear,
+    language: r.language,
+    coverUrl: r.coverUrl,
+    providerKey: r.providerKey,
+    providerId: r.providerId,
+    metadataSources: r.metadataSources ?? [],
+    preferredFormats: r.preferredFormats ?? [],
+    note: r.note,
+    targetLibraryId: r.targetLibraryId,
+    targetLibraryName: row.targetLibraryName,
+    targetFolderId: r.targetFolderId,
+    decidedByUserId: r.decidedByUserId,
+    decidedByUsername: row.decidedByUsername,
+    decidedAt: r.decidedAt?.toISOString() ?? null,
+    decisionNote: r.decisionNote,
+    matchedBookId: r.matchedBookId,
+    bookDockFileId: r.bookDockFileId,
+    selfServe: r.selfServe,
+    fulfillerUserId: r.fulfillerUserId,
+    statusReason: r.statusReason,
+    failureCode: (r.failureCode as BookRequestHandbackCode | null) ?? null,
+    failureMeta: r.failureMeta ?? null,
+    subscribers,
+    download: download ? mapBookRequestDownload(download) : null,
+    dismissed,
+    createdAt: r.createdAt.toISOString(),
+    updatedAt: r.updatedAt.toISOString(),
+  };
+}
+
+export function mapBookRequestDownload({
+  download,
+  downloadClientName,
+  downloadClientColor,
+  indexerName,
+  indexerColor,
+}: BookRequestDownloadJoinedRow): BookRequestDownloadItem {
+  return {
+    id: download.id,
+    requestId: download.requestId,
+    downloadClientId: download.downloadClientId,
+    downloadClientName,
+    downloadClientColor,
+    source: download.source as BookRequestDownloadSource,
+    indexerId: download.indexerId,
+    indexerName,
+    indexerColor,
+    automated: download.automated,
+    releaseTitle: download.releaseTitle,
+    releaseSizeBytes: download.releaseSizeBytes,
+    clientHash: download.clientHash,
+    status: download.status as BookRequestDownloadStatus,
+    progressPercent: download.progressPercent,
+    downloadedBytes: download.downloadedBytes,
+    totalBytes: download.totalBytes,
+    errorMessage: download.errorMessage,
+    grabbedAt: download.grabbedAt?.toISOString() ?? null,
+    completedAt: download.completedAt?.toISOString() ?? null,
+    importedAt: download.importedAt?.toISOString() ?? null,
+    releaseUnits: download.releaseUnits ?? null,
+    createdAt: download.createdAt.toISOString(),
+  };
+}
diff --git a/server/src/modules/book-request/book-request.module.ts b/server/src/modules/book-request/book-request.module.ts
new file mode 100644
index 000000000..5f7845d1c
--- /dev/null
+++ b/server/src/modules/book-request/book-request.module.ts
@@ -0,0 +1,148 @@
+import { Module, forwardRef } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { JwtModule } from '@nestjs/jwt';
+import type { StringValue } from 'ms';
+
+import { AppSettingsModule } from '../app-settings/app-settings.module';
+import { AuditModule } from '../audit/audit.module';
+import { AuthModule } from '../auth/auth.module';
+import { BookDockModule } from '../book-dock/book-dock.module';
+import { LibraryModule } from '../library/library.module';
+import { NotificationModule } from '../notification/notification.module';
+import { UploadModule } from '../upload/upload.module';
+import { UserModule } from '../user/user.module';
+import { BookRequestAdminController } from './book-request-admin.controller';
+import { BookRequestAutomationController } from './book-request-automation.controller';
+import { BookRequestAttributionService } from './book-request-attribution.service';
+import { BookRequestController } from './book-request.controller';
+import { BookRequestSelfFulfilController } from './book-request-self-fulfil.controller';
+import { BookRequestDedupeService } from './book-request-dedupe.service';
+import { BookRequestEventsService } from './book-request-events.service';
+import { BookRequestGateway } from './book-request.gateway';
+import { BookRequestNotifier } from './book-request-notifier.service';
+import { BookRequestRepository } from './book-request.repository';
+import { BookRequestService } from './book-request.service';
+import { RequestCredentialService } from './request-credential.service';
+import { DOWNLOAD_CLIENT_ADAPTERS } from './download-clients/download-client-adapter';
+import { DownloadClientConfigService } from './download-clients/download-client-config.service';
+import { DownloadClientReconciliationService } from './download-clients/download-client-reconciliation.service';
+import { DownloadClientController } from './download-clients/download-client.controller';
+import { DownloadClientRegistry } from './download-clients/download-client-registry';
+import { DownloadClientRepository } from './download-clients/download-client.repository';
+import { PathMappingService } from './download-clients/path-mapping.service';
+import { QbittorrentAdapter } from './download-clients/adapters/qbittorrent.adapter';
+import { TransmissionAdapter } from './download-clients/adapters/transmission.adapter';
+import { DelugeAdapter } from './download-clients/adapters/deluge.adapter';
+import { INDEXER_ADAPTERS } from './indexers/indexer-adapter';
+import { IndexerConfigService } from './indexers/indexer-config.service';
+import { IndexerController } from './indexers/indexer.controller';
+import { IndexerCredentialStore } from './indexers/indexer-credential-store';
+import { IndexerKeepaliveService } from './indexers/indexer-keepalive.service';
+import { IndexerOperationLock } from './indexers/indexer-operation-lock';
+import { IndexerRegistry } from './indexers/indexer-registry';
+import { PluginLoaderService } from './indexers/plugins/plugin-loader.service';
+import { PluginInstallService } from './indexers/plugins/plugin-install.service';
+import { IndexerRepository } from './indexers/indexer.repository';
+import { IndexerSearchService } from './indexers/indexer-search.service';
+import { TorznabAdapter } from './indexers/adapters/torznab.adapter';
+import { BookRequestDownloadRepository } from './fulfillment/book-request-download.repository';
+import { DirectDownloadService } from './fulfillment/direct-download.service';
+import { DownloadMonitorService } from './fulfillment/download-monitor.service';
+import { DownloadRemovalService } from './fulfillment/download-removal.service';
+import { RequestAutomationService } from './fulfillment/request-automation.service';
+import { RequestAutomationSearchDelay } from './fulfillment/request-automation-search-delay.service';
+import { RequestAutomationSettingsService } from './fulfillment/request-automation-settings.service';
+import { RequestFulfillmentService } from './fulfillment/request-fulfillment.service';
+import { RequestImportService } from './fulfillment/request-import.service';
+import { RequestSeedService } from './fulfillment/request-seed.service';
+import { RequestUserCleanupService } from './fulfillment/request-user-cleanup.service';
+import { RequestVerificationService } from './fulfillment/request-verification.service';
+import { RequestWatchdogService } from './fulfillment/request-watchdog.service';
+
+/**
+ * The dependency on `BookDockModule` is one way and must stay that way. The dock must not learn
+ * what a request is; a cycle here does not fail loudly, it hangs the TypeScript compile.
+ */
+@Module({
+  imports: [
+    LibraryModule,
+    AppSettingsModule,
+    AuditModule,
+    BookDockModule,
+    UploadModule,
+    AuthModule,
+    UserModule,
+    forwardRef(() => NotificationModule),
+    JwtModule.registerAsync({
+      inject: [ConfigService],
+      useFactory: (config: ConfigService) => ({
+        secret: config.getOrThrow<string>('auth.jwtSecret'),
+        signOptions: { expiresIn: config.getOrThrow<StringValue | number>('auth.jwtExpiresIn') },
+      }),
+    }),
+  ],
+  controllers: [
+    BookRequestController,
+    BookRequestSelfFulfilController,
+    BookRequestAdminController,
+    BookRequestAutomationController,
+    DownloadClientController,
+    IndexerController,
+  ],
+  providers: [
+    BookRequestService,
+    BookRequestRepository,
+    BookRequestAttributionService,
+    BookRequestDedupeService,
+    BookRequestNotifier,
+    BookRequestGateway,
+    BookRequestEventsService,
+    RequestCredentialService,
+
+    DownloadClientRepository,
+    DownloadClientConfigService,
+    DownloadClientReconciliationService,
+    DownloadClientRegistry,
+    PathMappingService,
+    QbittorrentAdapter,
+    TransmissionAdapter,
+    DelugeAdapter,
+    {
+      provide: DOWNLOAD_CLIENT_ADAPTERS,
+      useFactory: (qbittorrent: QbittorrentAdapter, transmission: TransmissionAdapter, deluge: DelugeAdapter) => [qbittorrent, transmission, deluge],
+      inject: [QbittorrentAdapter, TransmissionAdapter, DelugeAdapter],
+    },
+
+    IndexerRepository,
+    IndexerConfigService,
+    IndexerRegistry,
+    PluginInstallService,
+    PluginLoaderService,
+    IndexerCredentialStore,
+    IndexerSearchService,
+    IndexerKeepaliveService,
+    IndexerOperationLock,
+    TorznabAdapter,
+    {
+      provide: INDEXER_ADAPTERS,
+      useFactory: (torznab: TorznabAdapter) => [torznab],
+      inject: [TorznabAdapter],
+    },
+
+    BookRequestDownloadRepository,
+    DirectDownloadService,
+    DownloadRemovalService,
+    RequestFulfillmentService,
+    RequestImportService,
+    RequestVerificationService,
+    RequestSeedService,
+    RequestUserCleanupService,
+    RequestAutomationSettingsService,
+    RequestAutomationSearchDelay,
+    RequestAutomationService,
+    DownloadMonitorService,
+    RequestWatchdogService,
+  ],
+  exports: [BookRequestService],
+})
+export class BookRequestModule {}
diff --git a/server/src/modules/book-request/book-request.repository.test.ts b/server/src/modules/book-request/book-request.repository.test.ts
new file mode 100644
index 000000000..0f3daa1f2
--- /dev/null
+++ b/server/src/modules/book-request/book-request.repository.test.ts
@@ -0,0 +1,391 @@
+import type { SQL } from 'drizzle-orm';
+import { PgDialect } from 'drizzle-orm/pg-core';
+
+import { BookRequestRepository } from './book-request.repository';
+
+function makeDb() {
+  const chainable = {
+    update: vi.fn(),
+    set: vi.fn(),
+    where: vi.fn(),
+    returning: vi.fn(),
+  };
+
+  chainable.update.mockReturnValue(chainable);
+  chainable.set.mockReturnValue(chainable);
+  chainable.where.mockReturnValue(chainable);
+  chainable.returning.mockResolvedValue([{ id: 7 }]);
+
+  return chainable;
+}
+
+/** What `set()` was actually handed, which is the only thing these cases are about. */
+function written(db: ReturnType<typeof makeDb>): Record<string, unknown> {
+  return db.set.mock.calls.at(-1)?.[0] as Record<string, unknown>;
+}
+
+describe('BookRequestRepository.update', () => {
+  it('clears the classified failure fields when a new reason arrives without one', async () => {
+    const db = makeDb();
+    const repo = new BookRequestRepository(db as never);
+
+    await repo.update(7, { status: 'failed', statusReason: 'the tracker answered 406' });
+
+    expect(written(db)).toEqual({ status: 'failed', statusReason: 'the tracker answered 406', failureCode: null, failureMeta: null });
+  });
+
+  /** A grab clearing the reason must clear the code with it, or the UI translates a stale failure. */
+  it('clears them when the reason itself is cleared', async () => {
+    const db = makeDb();
+    const repo = new BookRequestRepository(db as never);
+
+    await repo.update(7, { status: 'grabbed', statusReason: null });
+
+    expect(written(db)).toEqual({ status: 'grabbed', statusReason: null, failureCode: null, failureMeta: null });
+  });
+
+  it('keeps a code the caller supplied alongside its reason', async () => {
+    const db = makeDb();
+    const repo = new BookRequestRepository(db as never);
+
+    await repo.update(7, {
+      status: 'approved',
+      statusReason: 'nothing cleared the floor',
+      failureCode: 'BELOW_SCORE_FLOOR',
+      failureMeta: { floor: 80 },
+    });
+
+    expect(written(db)).toMatchObject({ failureCode: 'BELOW_SCORE_FLOOR', failureMeta: { floor: 80 } });
+  });
+
+  /** An update that says nothing about failure must not quietly wipe the reason already on the row. */
+  it('leaves the failure fields alone when the update is about something else', async () => {
+    const db = makeDb();
+    const repo = new BookRequestRepository(db as never);
+
+    await repo.update(7, { status: 'downloading' });
+
+    expect(written(db)).toEqual({ status: 'downloading' });
+  });
+});
+
+describe('BookRequestRepository.updateIf', () => {
+  /** The same invariant `update` enforces: nothing about a conditional write changes it. */
+  it('clears the classified failure fields when a new reason arrives without one', async () => {
+    const db = makeDb();
+    const repo = new BookRequestRepository(db as never);
+
+    await repo.updateIf(7, ['downloading'], { status: 'failed', statusReason: 'the tracker answered 406' });
+
+    expect(written(db)).toEqual({ status: 'failed', statusReason: 'the tracker answered 406', failureCode: null, failureMeta: null });
+  });
+
+  it('resolves to the row it wrote when the status still held', async () => {
+    const db = makeDb();
+    const repo = new BookRequestRepository(db as never);
+
+    await expect(repo.updateIf(7, ['pending'], { status: 'approved' })).resolves.toEqual({ id: 7 });
+  });
+
+  /** No row matched the status filter, which is the caller's cue to refuse rather than report success. */
+  it('resolves to undefined when the row moved on', async () => {
+    const db = makeDb();
+    db.returning.mockResolvedValue([]);
+    const repo = new BookRequestRepository(db as never);
+
+    await expect(repo.updateIf(7, ['pending'], { status: 'approved' })).resolves.toBeUndefined();
+  });
+
+  /**
+   * An empty set is a caller bug, and matching everything would be exactly the unconditional write
+   * the primitive exists to replace.
+   */
+  it('writes nothing at all when no status is allowed', async () => {
+    const db = makeDb();
+    const repo = new BookRequestRepository(db as never);
+
+    await expect(repo.updateIf(7, [], { status: 'approved' })).resolves.toBeUndefined();
+    expect(db.update).not.toHaveBeenCalled();
+  });
+});
+
+describe('BookRequestRepository.claimForGrab', () => {
+  it('reports the claim as taken when a row matched', async () => {
+    const db = makeDb();
+    const repo = new BookRequestRepository(db as never);
+
+    await expect(repo.claimForGrab(7, ['approved', 'failed'])).resolves.toBe('claimed');
+    expect(written(db)).toEqual({ status: 'grabbed' });
+  });
+
+  it('reports the claim as lost when another attempt took it first', async () => {
+    const db = makeDb();
+    db.returning.mockResolvedValue([]);
+    const repo = new BookRequestRepository(db as never);
+
+    await expect(repo.claimForGrab(7, ['approved'])).resolves.toBe('moved');
+  });
+
+  /**
+   * `failed` sits outside the partial unique index, so the work can be requested again while a
+   * failed request still names it. Re-grabbing that failed request puts it back inside the index
+   * beside the new one, and the retry path used to answer the approver with a 500.
+   */
+  it('reports a dedupe collision rather than throwing the unique violation at the caller', async () => {
+    const db = makeDb();
+    db.returning.mockRejectedValue(Object.assign(new Error('duplicate key value'), { code: '23505' }));
+    const repo = new BookRequestRepository(db as never);
+
+    await expect(repo.claimForGrab(7, ['failed'])).resolves.toBe('duplicate');
+  });
+
+  it('still throws anything that is not a unique violation', async () => {
+    const db = makeDb();
+    db.returning.mockRejectedValue(new Error('connection lost'));
+    const repo = new BookRequestRepository(db as never);
+
+    await expect(repo.claimForGrab(7, ['failed'])).rejects.toThrow('connection lost');
+  });
+});
+
+describe('BookRequestRepository.remove', () => {
+  it('deletes nothing when no status is allowed', async () => {
+    const db = { ...makeDb(), delete: vi.fn() };
+    const repo = new BookRequestRepository(db as never);
+
+    await expect(repo.remove(7, [])).resolves.toBe(false);
+    expect(db.delete).not.toHaveBeenCalled();
+  });
+});
+
+describe('BookRequestRepository.create', () => {
+  function makeInsertingDb() {
+    const insertValues = vi.fn();
+    const tx = {
+      insert: vi.fn().mockReturnValue({
+        values: insertValues.mockReturnValue({ returning: vi.fn().mockResolvedValue([{ id: 7, dedupeKey: 'isbn13:9780441013593:ebook' }]) }),
+      }),
+    };
+    return { db: { transaction: vi.fn().mockImplementation((cb: (t: unknown) => unknown) => cb(tx)) }, tx, insertValues };
+  }
+
+  /** A row without its aliases is one the next requester silently fails to collide with. */
+  it('writes the aliases in the same transaction as the row', async () => {
+    const { db, insertValues } = makeInsertingDb();
+    const repo = new BookRequestRepository(db as never);
+
+    await repo.create({ title: 'Dune' } as never, ['isbn13:9780441013593:ebook', 'work:dune:frankherbert:ebook']);
+
+    expect(db.transaction).toHaveBeenCalled();
+    expect(insertValues).toHaveBeenLastCalledWith([{ requestId: 7, dedupeKey: 'work:dune:frankherbert:ebook' }]);
+  });
+
+  /** The key the row is already filed under is the constraint, not an alias of itself. */
+  it("does not repeat the row's own key as an alias", async () => {
+    const { db, insertValues } = makeInsertingDb();
+    const repo = new BookRequestRepository(db as never);
+
+    await repo.create({ title: 'Dune' } as never, ['isbn13:9780441013593:ebook']);
+
+    expect(insertValues).toHaveBeenCalledTimes(1);
+  });
+});
+
+/**
+ * Counting and then inserting is not a cap. Two submissions for different works each read nine
+ * and both proceed, and the limit an operator was promised turns out to be a suggestion, so the
+ * count has to happen inside the insert's own transaction behind a lock nothing else can pass.
+ */
+describe('BookRequestRepository.createWithinSelfServeCap', () => {
+  function makeCappedDb(live: number) {
+    const calls: string[] = [];
+    const insertValues = vi.fn().mockReturnValue({ returning: vi.fn().mockResolvedValue([{ id: 7, dedupeKey: 'work:dune' }]) });
+    const tx = {
+      execute: vi.fn().mockImplementation(() => {
+        calls.push('lock');
+        return Promise.resolve();
+      }),
+      select: vi.fn().mockReturnValue({
+        from: vi.fn().mockReturnValue({
+          where: vi.fn().mockImplementation(() => {
+            calls.push('count');
+            return Promise.resolve([{ total: live }]);
+          }),
+        }),
+      }),
+      insert: vi.fn().mockImplementation(() => {
+        calls.push('insert');
+        return { values: insertValues };
+      }),
+    };
+    return { db: { transaction: vi.fn().mockImplementation((cb: (t: unknown) => unknown) => cb(tx)) }, tx, calls };
+  }
+
+  it('takes the lock before it counts, and inserts under the same one', async () => {
+    const { db, calls } = makeCappedDb(2);
+    const repo = new BookRequestRepository(db as never);
+
+    await repo.createWithinSelfServeCap({ userId: 3, title: 'Dune' } as never, [], 10);
+
+    expect(db.transaction).toHaveBeenCalled();
+    expect(calls).toEqual(['lock', 'count', 'insert']);
+  });
+
+  it('refuses rather than inserting once the caller is at the cap', async () => {
+    const { db, tx } = makeCappedDb(10);
+    const repo = new BookRequestRepository(db as never);
+
+    await expect(repo.createWithinSelfServeCap({ userId: 3, title: 'Dune' } as never, [], 10)).resolves.toBeNull();
+    expect(tx.insert).not.toHaveBeenCalled();
+  });
+
+  /** Per user, so two people submitting at the same moment never wait on each other. */
+  it('locks on the caller rather than on the whole table', async () => {
+    const { db, tx } = makeCappedDb(0);
+    const repo = new BookRequestRepository(db as never);
+
+    await repo.createWithinSelfServeCap({ userId: 3, title: 'Dune' } as never, [], 10);
+
+    const [statement] = tx.execute.mock.calls[0] as [{ queryChunks?: unknown[] }];
+    expect(JSON.stringify(statement)).toContain('pg_advisory_xact_lock');
+    expect(JSON.stringify(statement)).toContain('3');
+  });
+});
+
+/**
+ * Taking a request on is in-flight work for the caller exactly as an insert would have been, so
+ * it is counted under the same lock rather than being a way around the cap.
+ */
+describe('BookRequestRepository.claimForSelfServe', () => {
+  function makeClaimingDb(live: number, claimed: Array<{ id: number }> = [{ id: 7 }]) {
+    const update = vi.fn();
+    const tx = {
+      execute: vi.fn().mockResolvedValue(undefined),
+      select: vi.fn().mockReturnValue({ from: vi.fn().mockReturnValue({ where: vi.fn().mockResolvedValue([{ total: live }]) }) }),
+      update: update.mockReturnValue({
+        set: vi.fn().mockReturnValue({ where: vi.fn().mockReturnValue({ returning: vi.fn().mockResolvedValue(claimed) }) }),
+      }),
+    };
+    return { db: { transaction: vi.fn().mockImplementation((cb: (t: unknown) => unknown) => cb(tx)) }, tx, update };
+  }
+
+  it('records the caller as the fulfiller and approves what nobody had decided on', async () => {
+    const { db, tx } = makeClaimingDb(0);
+    const repo = new BookRequestRepository(db as never);
+
+    await expect(repo.claimForSelfServe(7, 3, ['pending', 'approved'], 10)).resolves.toEqual({ id: 7 });
+    expect(tx.update.mock.results[0].value.set).toHaveBeenCalledWith(
+      expect.objectContaining({ selfServe: true, fulfillerUserId: 3, status: 'approved' }),
+    );
+  });
+
+  it('refuses without writing once the caller is at the cap', async () => {
+    const { db, update } = makeClaimingDb(10);
+    const repo = new BookRequestRepository(db as never);
+
+    await expect(repo.claimForSelfServe(7, 3, ['pending'], 10)).resolves.toBeNull();
+    expect(update).not.toHaveBeenCalled();
+  });
+
+  /** Somebody deciding on it between the read and the write wins over the claim. */
+  it('resolves to null when the conditional write matched nothing', async () => {
+    const { db } = makeClaimingDb(0, []);
+    const repo = new BookRequestRepository(db as never);
+
+    await expect(repo.claimForSelfServe(7, 3, ['pending'], 10)).resolves.toBeNull();
+  });
+
+  it('writes nothing at all when no status is allowed', async () => {
+    const { db } = makeClaimingDb(0);
+    const repo = new BookRequestRepository(db as never);
+
+    await expect(repo.claimForSelfServe(7, 3, [], 10)).resolves.toBeNull();
+    expect(db.transaction).not.toHaveBeenCalled();
+  });
+});
+
+/**
+ * The list is bounded, so the search is the only thing that makes somebody past the bound
+ * reachable. What matters here is that a term becomes a condition on the query at all, and that a
+ * term made of wildcards is a search for those characters rather than a search for everybody.
+ */
+describe('BookRequestRepository.findRequesterOptions', () => {
+  function makeSelectingDb() {
+    const chain: Record<string, ReturnType<typeof vi.fn>> = {
+      selectDistinct: vi.fn(),
+      from: vi.fn(),
+      innerJoin: vi.fn(),
+      where: vi.fn(),
+      orderBy: vi.fn(),
+      limit: vi.fn(),
+    };
+    for (const key of ['selectDistinct', 'from', 'innerJoin', 'where', 'orderBy']) chain[key].mockReturnValue(chain);
+    chain.limit.mockResolvedValue([]);
+    return chain;
+  }
+
+  /** What the condition compiles to, which is the only honest way to read a drizzle expression. */
+  function compiled(condition: unknown): { sql: string; params: unknown[] } {
+    return new PgDialect().sqlToQuery(condition as SQL);
+  }
+
+  it('asks for everyone when no search was given', async () => {
+    const db = makeSelectingDb();
+    await new BookRequestRepository(db as never).findRequesterOptions(null);
+
+    expect(db.where).toHaveBeenCalledWith(undefined);
+    expect(db.limit).toHaveBeenCalledWith(100);
+  });
+
+  it('narrows to a search term', async () => {
+    const db = makeSelectingDb();
+    await new BookRequestRepository(db as never).findRequesterOptions('  ada  ');
+
+    const { sql, params } = compiled(db.where.mock.calls.at(-1)![0]);
+    expect(sql).toContain('ilike');
+    expect(params).toEqual(['%ada%', '%ada%']);
+  });
+
+  /** Otherwise a search for `%` is a search for everybody, silently. */
+  it('escapes the wildcards a person can type', async () => {
+    const db = makeSelectingDb();
+    await new BookRequestRepository(db as never).findRequesterOptions('50%_off');
+
+    expect(compiled(db.where.mock.calls.at(-1)![0]).params).toEqual(['%50\\%\\_off%', '%50\\%\\_off%']);
+  });
+});
+
+describe('BookRequestRepository.findRequestViewerIds', () => {
+  function makeDb(owners: Array<{ requestId: number; userId: number }>, subscribed: Array<{ requestId: number; userId: number }>) {
+    const results = [owners, subscribed];
+    return {
+      select: vi.fn().mockImplementation(() => ({
+        from: vi.fn().mockReturnValue({ where: vi.fn().mockResolvedValue(results.shift() ?? []) }),
+      })),
+    };
+  }
+
+  it('asks nothing of the database for an empty batch', async () => {
+    const db = makeDb([], []);
+    expect(await new BookRequestRepository(db as never).findRequestViewerIds([])).toEqual(new Map());
+    expect(db.select).not.toHaveBeenCalled();
+  });
+
+  it('folds the requester in with the subscribers, once each', async () => {
+    const db = makeDb(
+      [
+        { requestId: 3, userId: 5 },
+        { requestId: 4, userId: 9 },
+      ],
+      [
+        { requestId: 3, userId: 5 },
+        { requestId: 3, userId: 6 },
+      ],
+    );
+
+    const viewers = await new BookRequestRepository(db as never).findRequestViewerIds([3, 4]);
+
+    expect(viewers.get(3)).toEqual([5, 6]);
+    expect(viewers.get(4)).toEqual([9]);
+  });
+});
diff --git a/server/src/modules/book-request/book-request.repository.ts b/server/src/modules/book-request/book-request.repository.ts
new file mode 100644
index 000000000..56443beee
--- /dev/null
+++ b/server/src/modules/book-request/book-request.repository.ts
@@ -0,0 +1,823 @@
+import { Inject, Injectable } from '@nestjs/common';
+import { and, asc, count, desc, eq, ilike, inArray, isNull, lt, notExists, notInArray, or, sql, type SQL } from 'drizzle-orm';
+import { NodePgDatabase } from 'drizzle-orm/node-postgres';
+import { ACTIVE_BOOK_REQUEST_STATUSES } from '@bookorbit/types';
+import type {
+  BookRequestMediaKind,
+  BookRequestRequesterOption,
+  BookRequestSortDirection,
+  BookRequestSortField,
+  BookRequestStatus,
+} from '@bookorbit/types';
+
+import { isUniqueViolation } from '../../common/utils/db-error.utils';
+import { DB } from '../../db';
+import * as schema from '../../db/schema';
+import {
+  authors,
+  bookAuthors,
+  bookDockFiles,
+  bookMetadata,
+  bookRequestDedupeAliases,
+  bookRequestDismissals,
+  bookRequestDownloads,
+  bookRequestSubscribers,
+  bookRequests,
+  books,
+  libraries,
+  libraryFolders,
+  users,
+  type BookRequestRow,
+  type NewBookRequestRow,
+} from '../../db/schema';
+
+/**
+ * What happened to a grab claim. `moved` is somebody else's decision landing first; `duplicate` is
+ * another live request already holding the dedupe claim on the same work.
+ */
+export type GrabClaimOutcome = 'claimed' | 'moved' | 'duplicate';
+
+type Db = NodePgDatabase<typeof schema>;
+/** What the write helpers below need, so they take a transaction as readily as the pool. */
+type RequestWriteExecutor = Pick<Db, 'insert'>;
+type RequestReadExecutor = Pick<Db, 'select'>;
+
+/**
+ * A new `statusReason` clears the classified fields unless the caller supplies them, so a stale
+ * code can never translate a failure that is no longer there.
+ */
+function withFailureFields(data: Partial<NewBookRequestRow>): Partial<NewBookRequestRow> {
+  return 'statusReason' in data && !('failureCode' in data) ? { ...data, failureCode: null, failureMeta: null } : data;
+}
+
+/**
+ * In-flight self-serve work one person is driving, which is what bounds their tracker traffic.
+ *
+ * Driving it, not having asked for it: a request somebody else claimed is their download to run,
+ * and a request this person claimed counts against them even though the row names another
+ * requester. An unclaimed self-serve row is driven by whoever created it.
+ */
+async function countLiveSelfServe(executor: RequestReadExecutor, userId: number): Promise<number> {
+  const [row] = await executor
+    .select({ total: count() })
+    .from(bookRequests)
+    .where(
+      and(
+        eq(bookRequests.selfServe, true),
+        inArray(bookRequests.status, [...ACTIVE_BOOK_REQUEST_STATUSES]),
+        or(eq(bookRequests.fulfillerUserId, userId), and(isNull(bookRequests.fulfillerUserId), eq(bookRequests.userId, userId))),
+      ),
+    );
+  return row?.total ?? 0;
+}
+
+const REQUESTER_OPTION_LIMIT = 100;
+
+/**
+ * The two states an untouched self-serve row can be sitting in. Anything further along has a
+ * download behind it, and anything settled is nobody's problem.
+ */
+const ABANDONABLE_SELF_SERVE_STATUSES: readonly BookRequestStatus[] = ['approved', 'searching'];
+
+/**
+ * An arbitrary but stable namespace for the per-user advisory lock the self-serve cap is counted
+ * under, so it cannot collide with a lock any other feature takes on the same user id.
+ */
+const SELF_SERVE_CAP_LOCK_NAMESPACE = 248_001;
+
+export interface ListRequestsOptions {
+  page: number;
+  limit: number;
+  status?: BookRequestStatus;
+  mediaKind?: BookRequestMediaKind;
+  /** Exact original requester. Unlike userId, this does not include subscribers. */
+  requesterUserId?: number;
+  /** Restricts to requests this user owns or subscribes to. Omitted for the approver queue. */
+  userId?: number;
+  /** Drops the rows this user has hidden. Applies to the approver queue too: dismissal is personal. */
+  excludeDismissedFor?: number;
+  /** Narrows to self-served rows, or to the ones that went through approval. */
+  selfServe?: boolean;
+  sortBy?: BookRequestSortField;
+  sortDir?: BookRequestSortDirection;
+}
+
+export interface BookRequestJoinedRow {
+  request: BookRequestRow;
+  requesterUsername: string;
+  requesterName: string;
+  decidedByUsername: string | null;
+  targetLibraryName: string | null;
+}
+
+/** A book that shares a title with a search candidate, plus the authors that decide the match. */
+export interface OwnedTitleMatch {
+  bookId: number;
+  authorNames: string[];
+}
+
+export interface OwnedMatchLookup {
+  byIsbn13: Map<string, number>;
+  byTitle: Map<string, OwnedTitleMatch[]>;
+}
+
+@Injectable()
+export class BookRequestRepository {
+  constructor(@Inject(DB) private readonly db: Db) {}
+
+  async findAll(opts: ListRequestsOptions): Promise<{ items: BookRequestJoinedRow[]; total: number }> {
+    const conditions: SQL[] = [];
+    if (opts.status) conditions.push(eq(bookRequests.status, opts.status));
+    if (opts.mediaKind) conditions.push(eq(bookRequests.mediaKind, opts.mediaKind));
+    if (opts.requesterUserId !== undefined) conditions.push(eq(bookRequests.userId, opts.requesterUserId));
+    if (opts.selfServe !== undefined) conditions.push(eq(bookRequests.selfServe, opts.selfServe));
+    if (opts.userId !== undefined) {
+      const subscribed = this.db
+        .select({ id: bookRequestSubscribers.requestId })
+        .from(bookRequestSubscribers)
+        .where(eq(bookRequestSubscribers.userId, opts.userId));
+      conditions.push(or(eq(bookRequests.userId, opts.userId), inArray(bookRequests.id, subscribed)) as SQL);
+    }
+    if (opts.excludeDismissedFor !== undefined) {
+      const dismissed = this.db
+        .select({ id: bookRequestDismissals.requestId })
+        .from(bookRequestDismissals)
+        .where(eq(bookRequestDismissals.userId, opts.excludeDismissedFor));
+      conditions.push(notInArray(bookRequests.id, dismissed));
+    }
+
+    const where = conditions.length ? and(...conditions) : undefined;
+    const direction = opts.sortDir === 'asc' ? asc : desc;
+    const SORT_COLUMNS = {
+      createdAt: bookRequests.createdAt,
+      title: bookRequests.title,
+      mediaKind: bookRequests.mediaKind,
+      requester: users.name,
+      status: bookRequests.status,
+    } as const;
+    // The id tie-break runs the same way as the sort, so a row cannot sit on both sides of a page
+    // boundary when two requests share a title or a timestamp.
+    const orderBy = [direction(SORT_COLUMNS[opts.sortBy ?? 'createdAt']), direction(bookRequests.id)];
+
+    const [rows, [totals]] = await Promise.all([
+      this.db
+        .select({
+          request: bookRequests,
+          requesterUsername: users.username,
+          requesterName: users.name,
+          targetLibraryName: libraries.name,
+        })
+        .from(bookRequests)
+        .innerJoin(users, eq(users.id, bookRequests.userId))
+        .leftJoin(libraries, eq(libraries.id, bookRequests.targetLibraryId))
+        .where(where)
+        .orderBy(...orderBy)
+        .limit(opts.limit)
+        .offset((opts.page - 1) * opts.limit),
+      this.db.select({ total: count() }).from(bookRequests).where(where),
+    ]);
+
+    const decidedByNames = await this.findUsernames(rows.map((r) => r.request.decidedByUserId));
+
+    return {
+      items: rows.map((row) => ({
+        ...row,
+        decidedByUsername: row.request.decidedByUserId != null ? (decidedByNames.get(row.request.decidedByUserId) ?? null) : null,
+      })),
+      total: totals?.total ?? 0,
+    };
+  }
+
+  /**
+   * Who the moderator filter can be pointed at, narrowed by a search rather than by luck.
+   *
+   * The limit stays: a select with every requester on an instance in it is not a control anybody
+   * can use. What the search adds is that the limit bounds the *answer* rather than the question,
+   * so somebody who sorts past the hundredth name is still reachable by typing it.
+   */
+  async findRequesterOptions(search: string | null): Promise<BookRequestRequesterOption[]> {
+    const term = search?.trim();
+    const pattern = term ? `%${term.replace(/[\\%_]/g, '\\$&')}%` : null;
+
+    return this.db
+      .selectDistinct({ userId: users.id, username: users.username, name: users.name })
+      .from(bookRequests)
+      .innerJoin(users, eq(users.id, bookRequests.userId))
+      .where(pattern === null ? undefined : or(ilike(users.name, pattern), ilike(users.username, pattern)))
+      .orderBy(asc(users.name), asc(users.username), asc(users.id))
+      .limit(REQUESTER_OPTION_LIMIT);
+  }
+
+  async findById(id: number): Promise<BookRequestJoinedRow | undefined> {
+    const [row] = await this.db
+      .select({
+        request: bookRequests,
+        requesterUsername: users.username,
+        requesterName: users.name,
+        targetLibraryName: libraries.name,
+      })
+      .from(bookRequests)
+      .innerJoin(users, eq(users.id, bookRequests.userId))
+      .leftJoin(libraries, eq(libraries.id, bookRequests.targetLibraryId))
+      .where(eq(bookRequests.id, id))
+      .limit(1);
+
+    if (!row) return undefined;
+
+    const names = await this.findUsernames([row.request.decidedByUserId]);
+    return {
+      ...row,
+      decidedByUsername: row.request.decidedByUserId != null ? (names.get(row.request.decidedByUserId) ?? null) : null,
+    };
+  }
+
+  private async findUsernames(ids: Array<number | null>): Promise<Map<number, string>> {
+    const unique = [...new Set(ids.filter((id): id is number => id != null))];
+    if (unique.length === 0) return new Map();
+    const rows = await this.db.select({ id: users.id, username: users.username }).from(users).where(inArray(users.id, unique));
+    return new Map(rows.map((r) => [r.id, r.username]));
+  }
+
+  /**
+   * The aliases go in with the row rather than after it: a request that exists without them is one
+   * the next requester will not collide with, and nothing would ever notice.
+   */
+  async create(data: NewBookRequestRow, aliasKeys: string[] = []): Promise<BookRequestRow> {
+    return this.db.transaction(async (tx) => this.insertWithAliases(tx, data, aliasKeys));
+  }
+
+  /**
+   * `create`, refused once the caller already has `maxLive` self-serve requests in flight.
+   *
+   * Counted inside the transaction and behind a per-user advisory lock, because counting and then
+   * inserting is not a cap: two submissions for different works each see nine and each proceed,
+   * and the limit an operator was promised turns out to be a suggestion. The lock is per user, so
+   * two people submitting at the same time never wait on each other. Null means the cap refused.
+   */
+  async createWithinSelfServeCap(data: NewBookRequestRow, aliasKeys: string[], maxLive: number): Promise<BookRequestRow | null> {
+    return this.db.transaction(async (tx) => {
+      await tx.execute(sql`select pg_advisory_xact_lock(${SELF_SERVE_CAP_LOCK_NAMESPACE}, ${data.userId})`);
+      if ((await countLiveSelfServe(tx, data.userId)) >= maxLive) return null;
+      return this.insertWithAliases(tx, data, aliasKeys);
+    });
+  }
+
+  private async insertWithAliases(tx: RequestWriteExecutor, data: NewBookRequestRow, aliasKeys: string[]): Promise<BookRequestRow> {
+    const [row] = await tx.insert(bookRequests).values(data).returning();
+
+    const keys = [...new Set(aliasKeys)].filter((key) => key !== row.dedupeKey);
+    if (keys.length > 0) {
+      await tx.insert(bookRequestDedupeAliases).values(keys.map((dedupeKey) => ({ requestId: row.id, dedupeKey })));
+    }
+    return row;
+  }
+
+  /**
+   * Writing a new `statusReason` clears the classified fields unless the caller supplies them,
+   * which is the invariant that keeps a stale code from translating a failure that is no longer
+   * there. Enforced here rather than at each call site because most writers of `statusReason`
+   * have never heard of a code and should not have to.
+   */
+  async update(id: number, data: Partial<NewBookRequestRow>): Promise<BookRequestRow | undefined> {
+    const [row] = await this.db.update(bookRequests).set(withFailureFields(data)).where(eq(bookRequests.id, id)).returning();
+    return row;
+  }
+
+  /**
+   * `update`, refused unless the row is still in one of the statuses the caller decided against.
+   *
+   * Every lifecycle transition reads the request, decides, and writes, and the gap between the
+   * read and the write is real: a moderator clicks while a twenty-second client poll is in flight,
+   * two moderators click at once, an import spends minutes extracting an archive. An unconditional
+   * write lets the later one land whether or not it was ever entitled to, so the loser's decision
+   * is silently undone and both are told they succeeded. Returns undefined when the row moved on,
+   * which is the caller's cue to refuse rather than to report success.
+   */
+  async updateIf(id: number, expected: readonly BookRequestStatus[], data: Partial<NewBookRequestRow>): Promise<BookRequestRow | undefined> {
+    if (expected.length === 0) return undefined;
+    const [row] = await this.db
+      .update(bookRequests)
+      .set(withFailureFields(data))
+      .where(and(eq(bookRequests.id, id), inArray(bookRequests.status, [...expected])))
+      .returning();
+    return row;
+  }
+
+  /**
+   * Moves a request out of the grabbable set atomically, so only the first of two concurrent
+   * attempts proceeds. The duplicate-hash index already stops the same release twice; this is what
+   * stops two *different* releases being started for one request.
+   *
+   * `duplicate` is the third outcome, and it is reachable through the documented retry path rather
+   * than through any race: `failed` sits outside the partial unique index on an active dedupe key,
+   * so once a request fails, the work can legitimately be requested again. Claiming the failed one
+   * moves it back inside the index, where the new request is already sitting. Uncaught, the 23505
+   * reached the approver as a 500 on the "try another release" button.
+   */
+  async claimForGrab(id: number, from: readonly BookRequestStatus[]): Promise<GrabClaimOutcome> {
+    try {
+      return (await this.updateIf(id, from, { status: 'grabbed' })) !== undefined ? 'claimed' : 'moved';
+    } catch (error) {
+      if (isUniqueViolation(error)) return 'duplicate';
+      throw error;
+    }
+  }
+
+  /** The live request holding a claim on this work, if any. */
+  async findActiveByDedupeKey(dedupeKey: string): Promise<BookRequestRow | undefined> {
+    const [row] = await this.db
+      .select()
+      .from(bookRequests)
+      .where(and(eq(bookRequests.dedupeKey, dedupeKey), inArray(bookRequests.status, [...ACTIVE_BOOK_REQUEST_STATUSES])))
+      .limit(1);
+    return row;
+  }
+
+  /**
+   * Batched form, so annotating a page of search results is one query. Takes every key shape a
+   * candidate could hash to, not just its preferred one: the same work reached through two
+   * providers can produce two different keys, and missing that is what turns one wanted book
+   * into two grabs.
+   */
+  async findActiveByDedupeKeys(dedupeKeys: string[]): Promise<Map<string, BookRequestRow>> {
+    if (dedupeKeys.length === 0) return new Map();
+
+    const live = inArray(bookRequests.status, [...ACTIVE_BOOK_REQUEST_STATUSES]);
+    const [direct, aliased] = await Promise.all([
+      this.db
+        .select()
+        .from(bookRequests)
+        .where(and(inArray(bookRequests.dedupeKey, dedupeKeys), live)),
+      this.db
+        .select({ key: bookRequestDedupeAliases.dedupeKey, request: bookRequests })
+        .from(bookRequestDedupeAliases)
+        .innerJoin(bookRequests, eq(bookRequests.id, bookRequestDedupeAliases.requestId))
+        .where(and(inArray(bookRequestDedupeAliases.dedupeKey, dedupeKeys), live)),
+    ]);
+
+    // Keyed by the key that was *asked about*, not by the one the row was filed under, because the
+    // caller probes its candidates in order of specificity and looks each one up by name.
+    const matches = new Map<string, BookRequestRow>();
+    // Aliases first, so a row found both ways is the one that owns the key rather than borrows it.
+    for (const row of aliased) matches.set(row.key, row.request);
+    for (const row of direct) matches.set(row.dedupeKey, row);
+    return matches;
+  }
+
+  async addSubscriber(requestId: number, userId: number): Promise<void> {
+    await this.db.insert(bookRequestSubscribers).values({ requestId, userId }).onConflictDoNothing();
+  }
+
+  /** True when a subscription was actually there to remove, so the caller can 404 on a stale one. */
+  async removeSubscriber(requestId: number, userId: number): Promise<boolean> {
+    const rows = await this.db
+      .delete(bookRequestSubscribers)
+      .where(and(eq(bookRequestSubscribers.requestId, requestId), eq(bookRequestSubscribers.userId, userId)))
+      .returning({ userId: bookRequestSubscribers.userId });
+    return rows.length > 0;
+  }
+
+  async isSubscriber(requestId: number, userId: number): Promise<boolean> {
+    const [row] = await this.db
+      .select({ userId: bookRequestSubscribers.userId })
+      .from(bookRequestSubscribers)
+      .where(and(eq(bookRequestSubscribers.requestId, requestId), eq(bookRequestSubscribers.userId, userId)))
+      .limit(1);
+    return row !== undefined;
+  }
+
+  async findSubscribedRequestIds(userId: number, requestIds: number[]): Promise<Set<number>> {
+    if (requestIds.length === 0) return new Set();
+    const rows = await this.db
+      .select({ requestId: bookRequestSubscribers.requestId })
+      .from(bookRequestSubscribers)
+      .where(and(eq(bookRequestSubscribers.userId, userId), inArray(bookRequestSubscribers.requestId, requestIds)));
+    return new Set(rows.map((r) => r.requestId));
+  }
+
+  /**
+   * Who may see each of these requests without managing all of them: the requester and everybody
+   * subscribed. Moderators are deliberately absent - they reach every request, so listing them
+   * per request would mean reading the whole permission table on every progress tick.
+   *
+   * One query for the batch, because the caller is the poll loop and asking per download would
+   * add a round trip per active transfer per tick.
+   */
+  async findRequestViewerIds(requestIds: number[]): Promise<Map<number, number[]>> {
+    if (requestIds.length === 0) return new Map();
+    const [owners, subscribed] = await Promise.all([
+      this.db.select({ requestId: bookRequests.id, userId: bookRequests.userId }).from(bookRequests).where(inArray(bookRequests.id, requestIds)),
+      this.db
+        .select({ requestId: bookRequestSubscribers.requestId, userId: bookRequestSubscribers.userId })
+        .from(bookRequestSubscribers)
+        .where(inArray(bookRequestSubscribers.requestId, requestIds)),
+    ]);
+
+    const map = new Map<number, number[]>();
+    for (const row of [...owners, ...subscribed]) {
+      const bucket = map.get(row.requestId);
+      if (!bucket) map.set(row.requestId, [row.userId]);
+      else if (!bucket.includes(row.userId)) bucket.push(row.userId);
+    }
+    return map;
+  }
+
+  async findSubscribers(requestIds: number[]): Promise<Map<number, Array<{ userId: number; username: string; name: string }>>> {
+    if (requestIds.length === 0) return new Map();
+    const rows = await this.db
+      .select({
+        requestId: bookRequestSubscribers.requestId,
+        userId: bookRequestSubscribers.userId,
+        username: users.username,
+        name: users.name,
+      })
+      .from(bookRequestSubscribers)
+      .innerJoin(users, eq(users.id, bookRequestSubscribers.userId))
+      .where(inArray(bookRequestSubscribers.requestId, requestIds));
+
+    const map = new Map<number, Array<{ userId: number; username: string; name: string }>>();
+    for (const row of rows) {
+      const bucket = map.get(row.requestId) ?? [];
+      bucket.push({ userId: row.userId, username: row.username, name: row.name });
+      map.set(row.requestId, bucket);
+    }
+    return map;
+  }
+
+  async dismiss(requestId: number, userId: number): Promise<void> {
+    await this.db.insert(bookRequestDismissals).values({ requestId, userId }).onConflictDoNothing();
+  }
+
+  /**
+   * Hiding a request, refused unless it is still in one of the statuses the caller checked for.
+   *
+   * The guard lives in a transaction rather than in the insert because the two rows are in
+   * different tables: locking the request for the length of the insert is what stops a retry
+   * re-grabbing it in the gap and leaving live work hidden from the person driving it.
+   */
+  async dismissIf(requestId: number, userId: number, expected: readonly BookRequestStatus[]): Promise<boolean> {
+    if (expected.length === 0) return false;
+    return this.db.transaction(async (tx) => {
+      const [row] = await tx.select({ status: bookRequests.status }).from(bookRequests).where(eq(bookRequests.id, requestId)).for('update').limit(1);
+      if (!row || !expected.includes(row.status as BookRequestStatus)) return false;
+      await tx.insert(bookRequestDismissals).values({ requestId, userId }).onConflictDoNothing();
+      return true;
+    });
+  }
+
+  async restore(requestId: number, userId: number): Promise<void> {
+    await this.db.delete(bookRequestDismissals).where(and(eq(bookRequestDismissals.requestId, requestId), eq(bookRequestDismissals.userId, userId)));
+  }
+
+  /** Batched, so a page of rows costs one query to annotate with the viewer's own dismissals. */
+  async findDismissedRequestIds(userId: number, requestIds: number[]): Promise<Set<number>> {
+    if (requestIds.length === 0) return new Set();
+    const rows = await this.db
+      .select({ requestId: bookRequestDismissals.requestId })
+      .from(bookRequestDismissals)
+      .where(and(eq(bookRequestDismissals.userId, userId), inArray(bookRequestDismissals.requestId, requestIds)));
+    return new Set(rows.map((r) => r.requestId));
+  }
+
+  /** Everyone's, not one viewer's: a request coming back to life belongs on every list again. */
+  async clearDismissals(requestId: number): Promise<void> {
+    await this.db.delete(bookRequestDismissals).where(eq(bookRequestDismissals.requestId, requestId));
+  }
+
+  /**
+   * Subscribers, dismissals and download attempts all cascade from the request row.
+   *
+   * `expected` is the same guard `updateIf` applies to a status change: deleting is a lifecycle
+   * transition too, and a request re-grabbed between the caller's read and this delete must not
+   * disappear from under the transfer it just started.
+   */
+  async remove(id: number, expected: readonly BookRequestStatus[]): Promise<boolean> {
+    if (expected.length === 0) return false;
+    const rows = await this.db
+      .delete(bookRequests)
+      .where(and(eq(bookRequests.id, id), inArray(bookRequests.status, [...expected])))
+      .returning({ id: bookRequests.id });
+    return rows.length > 0;
+  }
+
+  /** Requester plus every subscriber, for "it landed" notifications. */
+  async findInterestedUserIds(requestId: number): Promise<number[]> {
+    const [row] = await this.db.select({ userId: bookRequests.userId }).from(bookRequests).where(eq(bookRequests.id, requestId)).limit(1);
+    if (!row) return [];
+    const subs = await this.db
+      .select({ userId: bookRequestSubscribers.userId })
+      .from(bookRequestSubscribers)
+      .where(eq(bookRequestSubscribers.requestId, requestId));
+    return [...new Set([row.userId, ...subs.map((s) => s.userId)])];
+  }
+
+  /**
+   * Self-serve rows nobody ever grabbed anything for: a search somebody opened and walked away
+   * from. They matter because a live row holds the dedupe claim on its work, so an abandoned one
+   * quietly subscribes the next person to ask for that book to a request nobody is driving.
+   *
+   * Bounded, because this runs on a timer and a backlog must not turn into one enormous sweep.
+   */
+  async findAbandonedSelfServe(olderThan: Date, limit: number): Promise<BookRequestRow[]> {
+    const withAttempt = this.db
+      .select({ id: bookRequestDownloads.requestId })
+      .from(bookRequestDownloads)
+      .where(eq(bookRequestDownloads.requestId, bookRequests.id));
+
+    return this.db
+      .select()
+      .from(bookRequests)
+      .where(
+        and(
+          eq(bookRequests.selfServe, true),
+          inArray(bookRequests.status, [...ABANDONABLE_SELF_SERVE_STATUSES]),
+          lt(bookRequests.createdAt, olderThan),
+          notExists(withAttempt),
+        ),
+      )
+      .orderBy(asc(bookRequests.createdAt))
+      .limit(limit);
+  }
+
+  /**
+   * Conditional, so a row somebody picked a release for between the sweep reading it and acting on
+   * it is left alone rather than cancelled out from under them.
+   */
+  async cancelAbandoned(id: number, reason: string, code: string): Promise<boolean> {
+    const rows = await this.db
+      .update(bookRequests)
+      .set({ status: 'cancelled', statusReason: reason, failureCode: code, decidedAt: new Date() })
+      .where(and(eq(bookRequests.id, id), inArray(bookRequests.status, [...ABANDONABLE_SELF_SERVE_STATUSES])))
+      .returning({ id: bookRequests.id });
+    return rows.length > 0;
+  }
+
+  /**
+   * Requests still sitting at `searching` that nothing is searching.
+   *
+   * `searching` is claimed by a fire-and-forget task that lives only in this process, so the
+   * status outlives the work every time: the task dies with a restart, or throws somewhere its
+   * own handler cannot reach. What is left keeps the dedupe claim on its work, which quietly
+   * subscribes everybody who asks for that book next to a request nobody is driving.
+   *
+   * Bounded, because a backlog must not turn into one enormous sweep.
+   */
+  async findStrandedSearching(olderThan: Date, limit: number): Promise<BookRequestRow[]> {
+    return this.db
+      .select()
+      .from(bookRequests)
+      .where(and(eq(bookRequests.status, 'searching'), lt(bookRequests.updatedAt, olderThan)))
+      .orderBy(asc(bookRequests.updatedAt))
+      .limit(limit);
+  }
+
+  /**
+   * Approved requests nothing has found a release for yet and that are due another look.
+   *
+   * Three conditions, and each one keeps a class of request out of the sweep rather than being
+   * decided again per row afterwards. `approved` alone, so nothing in flight is disturbed and a
+   * settled request is never reopened. A destination, because a grab refuses a request with
+   * nowhere to file the book and re-declaring that every night would rewrite the same reason on a
+   * row nobody is going to act on until a person edits it. And a cut-off, so a book that never
+   * appears stops costing tracker traffic.
+   *
+   * The interval itself is per-row rather than one constant: it doubles for each week the request
+   * has been waiting, capped, so a growing backlog of old requests does not become a growing
+   * nightly load against every configured tracker. `updated_at` is the clock because a pass writes
+   * the status twice, so a request that was searched at all has a fresh one.
+   *
+   * Bounded, and oldest first, so a backlog is worked off across ticks instead of in one sweep.
+   */
+  async findDueForResearch(
+    baseIntervalHours: number,
+    maxAgeDays: number,
+    backoffCap: number,
+    weekMs: number,
+    limit: number,
+  ): Promise<BookRequestRow[]> {
+    return this.db
+      .select()
+      .from(bookRequests)
+      .where(
+        and(
+          eq(bookRequests.status, 'approved'),
+          sql`${bookRequests.targetLibraryId} is not null`,
+          sql`${bookRequests.createdAt} > now() - make_interval(days => ${maxAgeDays})`,
+          sql`now() - ${bookRequests.updatedAt} >= make_interval(hours => ${baseIntervalHours}) * least(
+            ${backoffCap}::double precision,
+            power(2, floor(extract(epoch from now() - ${bookRequests.createdAt}) * 1000 / ${weekMs}))
+          )`,
+        ),
+      )
+      .orderBy(asc(bookRequests.updatedAt))
+      .limit(limit);
+  }
+
+  /**
+   * Hands an undriven request to a self-fulfiller who asked for the same work.
+   *
+   * One live request per work, so their own submission cannot open a second row; without this
+   * they are attached to somebody else's as a subscriber and then refused by every fulfilment
+   * route, which is a dead end with no explanation on it. Approving it is the honest reading of
+   * what they did: they asked for this book and said they would fetch it themselves.
+   *
+   * Conditional on the row still being unclaimed and still in a status nobody has acted on, and
+   * capped under the same per-user advisory lock a fresh self-serve submission is, because a claim
+   * is in-flight work for them exactly as an insert would have been. Null means it was refused.
+   */
+  async claimForSelfServe(
+    id: number,
+    fulfillerUserId: number,
+    expected: readonly BookRequestStatus[],
+    maxLive: number,
+  ): Promise<BookRequestRow | null> {
+    if (expected.length === 0) return null;
+    return this.db.transaction(async (tx) => {
+      await tx.execute(sql`select pg_advisory_xact_lock(${SELF_SERVE_CAP_LOCK_NAMESPACE}, ${fulfillerUserId})`);
+      if ((await countLiveSelfServe(tx, fulfillerUserId)) >= maxLive) return null;
+
+      const [row] = await tx
+        .update(bookRequests)
+        .set({ selfServe: true, fulfillerUserId, status: 'approved', decidedByUserId: fulfillerUserId, decidedAt: new Date() })
+        .where(
+          and(
+            eq(bookRequests.id, id),
+            inArray(bookRequests.status, [...expected]),
+            eq(bookRequests.selfServe, false),
+            isNull(bookRequests.fulfillerUserId),
+          ),
+        )
+        .returning();
+      return row ?? null;
+    });
+  }
+
+  async countByStatuses(statuses: readonly BookRequestStatus[], excludeDismissedFor?: number): Promise<number> {
+    const conditions: SQL[] = [];
+    if (statuses.length) conditions.push(inArray(bookRequests.status, statuses));
+    if (excludeDismissedFor !== undefined) {
+      const dismissed = this.db
+        .select({ id: bookRequestDismissals.requestId })
+        .from(bookRequestDismissals)
+        .where(eq(bookRequestDismissals.userId, excludeDismissedFor));
+      conditions.push(notInArray(bookRequests.id, dismissed));
+    }
+    const [row] = await this.db
+      .select({ total: count() })
+      .from(bookRequests)
+      .where(conditions.length ? and(...conditions) : undefined);
+    return row?.total ?? 0;
+  }
+
+  /** Owned or subscribed, so the summary count agrees with what `findAll` puts on the page. */
+  async countForUser(userId: number, statuses: readonly BookRequestStatus[], excludeDismissed = false): Promise<number> {
+    const subscribed = this.db
+      .select({ id: bookRequestSubscribers.requestId })
+      .from(bookRequestSubscribers)
+      .where(eq(bookRequestSubscribers.userId, userId));
+
+    const conditions: SQL[] = [or(eq(bookRequests.userId, userId), inArray(bookRequests.id, subscribed)) as SQL];
+    if (statuses.length) conditions.push(inArray(bookRequests.status, statuses));
+    if (excludeDismissed) {
+      const dismissed = this.db
+        .select({ id: bookRequestDismissals.requestId })
+        .from(bookRequestDismissals)
+        .where(eq(bookRequestDismissals.userId, userId));
+      conditions.push(notInArray(bookRequests.id, dismissed));
+    }
+    const [row] = await this.db
+      .select({ total: count() })
+      .from(bookRequests)
+      .where(and(...conditions));
+    return row?.total ?? 0;
+  }
+
+  /**
+   * "Do we already have this?" for a page of search candidates.
+   *
+   * Bounded by the candidate list, never by the library. ISBN13 rides `bm_isbn13_idx` and the
+   * title probe uses `lower(title)` verbatim so it rides `bm_title_lower_idx` - normalizing any
+   * harder than the index expression would turn this into a sequential scan over every book on
+   * the instance.
+   *
+   * The title probe carries each match's authors back with it, because a title on its own is not
+   * an identity: three different books called "It" would otherwise all read as owned.
+   */
+  async findOwnedMatches(isbn13s: string[], lowerTitles: string[], libraryIds: number[] | null): Promise<OwnedMatchLookup> {
+    const byIsbn13 = new Map<string, number>();
+    const byTitle = new Map<string, OwnedTitleMatch[]>();
+    if (libraryIds !== null && libraryIds.length === 0) return { byIsbn13, byTitle };
+
+    const scope = libraryIds !== null ? [inArray(books.libraryId, libraryIds)] : [];
+    const present = eq(books.status, 'present');
+
+    if (isbn13s.length) {
+      const rows = await this.db
+        .select({ bookId: books.id, isbn13: bookMetadata.isbn13 })
+        .from(bookMetadata)
+        .innerJoin(books, eq(books.id, bookMetadata.bookId))
+        .where(and(inArray(bookMetadata.isbn13, isbn13s), present, ...scope));
+      for (const row of rows) if (row.isbn13 && !byIsbn13.has(row.isbn13)) byIsbn13.set(row.isbn13, row.bookId);
+    }
+
+    if (lowerTitles.length) {
+      const titleKey = sql<string>`lower(${bookMetadata.title})`;
+      const rows = await this.db
+        .select({ bookId: books.id, titleKey, authorName: authors.name })
+        .from(bookMetadata)
+        .innerJoin(books, eq(books.id, bookMetadata.bookId))
+        .leftJoin(bookAuthors, eq(bookAuthors.bookId, books.id))
+        .leftJoin(authors, eq(authors.id, bookAuthors.authorId))
+        .where(and(inArray(titleKey, lowerTitles), present, ...scope));
+
+      const byBookId = new Map<number, OwnedTitleMatch>();
+      for (const row of rows) {
+        const bucket = byTitle.get(row.titleKey) ?? [];
+        let match = byBookId.get(row.bookId);
+        if (!match) {
+          match = { bookId: row.bookId, authorNames: [] };
+          byBookId.set(row.bookId, match);
+          bucket.push(match);
+          byTitle.set(row.titleKey, bucket);
+        }
+        if (row.authorName) match.authorNames.push(row.authorName);
+      }
+    }
+
+    return { byIsbn13, byTitle };
+  }
+
+  /** Which library a filed book landed in, so a link to it can be offered only to who can open it. */
+  async findBookLibraryId(bookId: number): Promise<number | null> {
+    const [row] = await this.db.select({ libraryId: books.libraryId }).from(books).where(eq(books.id, bookId)).limit(1);
+    return row?.libraryId ?? null;
+  }
+
+  /**
+   * Guards "mark fulfilled" against pointing a request at a book row that is not there, and
+   * against pointing it at one the person closing the request could not otherwise open.
+   *
+   * `libraryIds` is null for somebody who reaches every library, and the empty array is a real
+   * answer rather than a missing filter: a reader with access to nothing can name nothing.
+   */
+  async bookExists(bookId: number, libraryIds: number[] | null): Promise<boolean> {
+    if (libraryIds !== null && libraryIds.length === 0) return false;
+    const where = libraryIds === null ? eq(books.id, bookId) : and(eq(books.id, bookId), inArray(books.libraryId, libraryIds));
+    const [row] = await this.db.select({ id: books.id }).from(books).where(where).limit(1);
+    return row !== undefined;
+  }
+
+  /**
+   * Same guard for the dock file: without it a stale id is a foreign key error, so a 500, and an
+   * id belonging to somebody else is a reference the actor could never have opened.
+   *
+   * `uploaderId` is null for somebody who may manage every dock item; otherwise only their own
+   * uploads count, which is the same rule the dock itself applies.
+   */
+  async bookDockFileExists(fileId: number, uploaderId: number | null): Promise<boolean> {
+    const where = uploaderId === null ? eq(bookDockFiles.id, fileId) : and(eq(bookDockFiles.id, fileId), eq(bookDockFiles.uploadedBy, uploaderId));
+    const [row] = await this.db.select({ id: bookDockFiles.id }).from(bookDockFiles).where(where).limit(1);
+    return row !== undefined;
+  }
+
+  /**
+   * Names for the libraries the instance defaults point at. One query for all three media rather
+   * than one per medium, and the media usually share fewer libraries than there are of them.
+   */
+  async findLibraryNames(libraryIds: number[]): Promise<Map<number, string>> {
+    if (libraryIds.length === 0) return new Map();
+    const rows = await this.db
+      .select({ id: libraries.id, name: libraries.name })
+      .from(libraries)
+      .where(inArray(libraries.id, [...new Set(libraryIds)]));
+    return new Map(rows.map((row) => [row.id, row.name]));
+  }
+
+  /**
+   * The fallback destination when a request names a library but no folder. Finalize refuses to
+   * resolve a destination without one, and the Book Dock's global default folder is usually unset
+   * and belongs to a different library anyway.
+   */
+  async findFirstFolderId(libraryId: number): Promise<number | null> {
+    const [row] = await this.db
+      .select({ id: libraryFolders.id })
+      .from(libraryFolders)
+      .where(eq(libraryFolders.libraryId, libraryId))
+      .orderBy(libraryFolders.id)
+      .limit(1);
+    return row?.id ?? null;
+  }
+
+  /**
+   * A folder from another library would carry the book into that library at finalize time, and
+   * the foreign key cannot see the mismatch because both ids are individually valid.
+   */
+  async folderBelongsToLibrary(folderId: number, libraryId: number): Promise<boolean> {
+    const [row] = await this.db
+      .select({ id: libraryFolders.id })
+      .from(libraryFolders)
+      .where(and(eq(libraryFolders.id, folderId), eq(libraryFolders.libraryId, libraryId)))
+      .limit(1);
+    return row !== undefined;
+  }
+}
diff --git a/server/src/modules/book-request/book-request.service.test.ts b/server/src/modules/book-request/book-request.service.test.ts
new file mode 100644
index 000000000..c060a56cb
--- /dev/null
+++ b/server/src/modules/book-request/book-request.service.test.ts
@@ -0,0 +1,2096 @@
+import { BadRequestException, ForbiddenException, HttpException, NotFoundException } from '@nestjs/common';
+import { FULFILLABLE_BOOK_REQUEST_STATUSES, NotificationType, Permission, withRequiredPermissions } from '@bookorbit/types';
+
+import { BookRequestAttributionService } from './book-request-attribution.service';
+import { BookRequestNotifier } from './book-request-notifier.service';
+import { BookRequestService } from './book-request.service';
+import type { RequestUser } from '../../common/types/request-user';
+
+/**
+ * A moderator as the assignment path actually builds one: `manage_book_requests` resolves through
+ * `PERMISSION_REQUIRES`, so the route guard these branches sit behind lets them through.
+ */
+function moderator(overrides: Partial<RequestUser> = {}): RequestUser {
+  return user({ permissions: withRequiredPermissions([Permission.ManageBookRequests]), ...overrides });
+}
+
+function user(overrides: Partial<RequestUser> = {}): RequestUser {
+  return {
+    id: 1,
+    username: 'reader',
+    name: 'Reader',
+    email: null,
+    active: true,
+    isSuperuser: false,
+    isDefaultPassword: false,
+    tokenVersion: 1,
+    settings: {},
+    avatarUrl: null,
+    provisioningMethod: 'local',
+    permissions: [Permission.BookRequestAccess],
+    contentFilters: {},
+    ...overrides,
+  } as RequestUser;
+}
+
+function row(overrides: Record<string, unknown> = {}) {
+  return {
+    id: 10,
+    userId: 1,
+    mediaKind: 'ebook',
+    status: 'pending',
+    title: 'Dune',
+    subtitle: null,
+    authors: ['Frank Herbert'],
+    seriesName: null,
+    seriesIndex: null,
+    isbn10: null,
+    isbn13: null,
+    publishedYear: null,
+    language: null,
+    coverUrl: null,
+    providerKey: null,
+    providerId: null,
+    metadataSources: [],
+    preferredFormats: [],
+    note: null,
+    targetLibraryId: null,
+    targetFolderId: null,
+    decidedByUserId: null,
+    decidedAt: null,
+    decisionNote: null,
+    matchedBookId: null,
+    bookDockFileId: null,
+    selfServe: false,
+    fulfillerUserId: null,
+    statusReason: null,
+    dedupeKey: 'work:dune:frankherbert:ebook',
+    createdAt: new Date('2026-08-01T00:00:00Z'),
+    updatedAt: new Date('2026-08-01T00:00:00Z'),
+    ...overrides,
+  };
+}
+
+function joined(overrides: Record<string, unknown> = {}) {
+  return {
+    request: row(overrides),
+    requesterUsername: 'reader',
+    requesterName: 'Reader',
+    decidedByUsername: null,
+    targetLibraryName: null,
+  };
+}
+
+function makeService(
+  overrides: {
+    repo?: Record<string, unknown>;
+    dedupe?: Record<string, unknown>;
+    removal?: Record<string, unknown>;
+    downloads?: Record<string, unknown>;
+    automationSettings?: Record<string, unknown>;
+    libraryService?: Record<string, unknown>;
+    /** The user a delegated submission names, as `AuthService` would resolve them. */
+    actingUser?: RequestUser | null;
+  } = {},
+) {
+  const repo = {
+    findById: vi.fn().mockResolvedValue(joined()),
+    findAll: vi.fn().mockResolvedValue({ items: [], total: 0 }),
+    findRequesterOptions: vi.fn().mockResolvedValue([]),
+    create: vi.fn().mockResolvedValue(row()),
+    createWithinSelfServeCap: vi.fn().mockResolvedValue(row()),
+    claimForSelfServe: vi.fn().mockResolvedValue(null),
+    update: vi.fn().mockResolvedValue(row()),
+    updateIf: vi.fn().mockImplementation((id: number, _expected: unknown, patch: Record<string, unknown>) => Promise.resolve(row({ id, ...patch }))),
+    addSubscriber: vi.fn().mockResolvedValue(undefined),
+    isSubscriber: vi.fn().mockResolvedValue(false),
+    findSubscribers: vi.fn().mockResolvedValue(new Map()),
+    findDismissedRequestIds: vi.fn().mockResolvedValue(new Set()),
+    dismiss: vi.fn().mockResolvedValue(undefined),
+    dismissIf: vi.fn().mockResolvedValue(true),
+    restore: vi.fn().mockResolvedValue(undefined),
+    remove: vi.fn().mockResolvedValue(true),
+    findInterestedUserIds: vi.fn().mockResolvedValue([1]),
+    countLiveSelfServeForUser: vi.fn().mockResolvedValue(0),
+    countByStatuses: vi.fn().mockResolvedValue(0),
+    countForUser: vi.fn().mockResolvedValue(0),
+    bookExists: vi.fn().mockResolvedValue(true),
+    findBookLibraryId: vi.fn().mockResolvedValue(3),
+    findLibraryNames: vi.fn().mockResolvedValue(new Map([[7, 'Audiobooks']])),
+    bookDockFileExists: vi.fn().mockResolvedValue(true),
+    folderBelongsToLibrary: vi.fn().mockResolvedValue(true),
+    ...overrides.repo,
+  };
+  const dedupe = {
+    findActiveRequestFor: vi.fn().mockResolvedValue(undefined),
+    findOwnedBookFor: vi.fn().mockResolvedValue(null),
+    checkAvailability: vi.fn().mockResolvedValue([]),
+    ...overrides.dedupe,
+  };
+  const libraryService = {
+    verifyUserAccess: vi.fn().mockResolvedValue(undefined),
+    findAccessibleLibraryIds: vi.fn().mockResolvedValue([1]),
+    findUserIdsWithAccess: vi.fn().mockResolvedValue(new Set([1])),
+    ...overrides.libraryService,
+  };
+  const notifications = { notify: vi.fn().mockResolvedValue(undefined) };
+  const contentFilterRepo = {
+    hasAnyContentFilters: vi.fn().mockResolvedValue(new Set<number>()),
+    findExemptUserIds: vi.fn().mockResolvedValue(new Set<number>()),
+  };
+  const notifier = new BookRequestNotifier(notifications as never, repo as never, libraryService as never, contentFilterRepo as never);
+  const downloads = {
+    findLatestForRequests: vi.fn().mockResolvedValue(new Map()),
+    findById: vi.fn().mockResolvedValue({ id: 11, requestId: 10, status: 'downloading' }),
+    failInFlightForRequest: vi.fn().mockResolvedValue(0),
+    ...overrides.downloads,
+  };
+
+  const automation = { considerRequest: vi.fn() };
+  // Nothing pinned for the instance, so the destination stays whatever the request itself names.
+  const automationSettings = {
+    resolveDestinationFor: vi.fn().mockResolvedValue({ libraryId: null, folderId: null }),
+    ...overrides.automationSettings,
+  };
+  const removal = {
+    removeLatestForRequest: vi.fn().mockResolvedValue({ removed: false, error: null }),
+    removeAttempt: vi.fn().mockResolvedValue(true),
+    ...overrides.removal,
+  };
+  // The summary caches on the broadcast count, so the stub has to move it the way the real one does.
+  const gateway: { changeVersion: number; emitChanged: ReturnType<typeof vi.fn> } = {
+    changeVersion: 0,
+    emitChanged: vi.fn(() => {
+      gateway.changeVersion++;
+    }),
+  };
+  // The real one: delegation is a security rule, so a stub here would assert nothing.
+  const auth = { findActingUser: vi.fn().mockResolvedValue(overrides.actingUser ?? null) };
+  const attribution = new BookRequestAttributionService(auth as never);
+
+  const service = new BookRequestService(
+    repo as never,
+    dedupe as never,
+    libraryService as never,
+    notifier,
+    downloads as never,
+    automation as never,
+    automationSettings as never,
+    removal as never,
+    gateway as never,
+    attribution,
+  );
+
+  return { service, repo, dedupe, libraryService, notifications, downloads, automation, automationSettings, removal, gateway, auth };
+}
+
+const dto = { title: 'Dune', mediaKind: 'ebook' as const, authors: ['Frank Herbert'] };
+
+describe('BookRequestService.submit', () => {
+  it('creates a pending request and notifies approvers', async () => {
+    const { service, repo, notifications } = makeService();
+    const result = await service.submit(dto, user());
+
+    expect(result.subscribed).toBe(false);
+    expect(repo.create).toHaveBeenCalledWith(
+      expect.objectContaining({ status: 'pending', title: 'Dune', dedupeKey: 'work:dune:frankherbert:ebook' }),
+      // Every key this work could have hashed to, so a later requester reaching it another way
+      // collides with this row rather than opening a second one.
+      expect.arrayContaining(['work:dune:frankherbert:ebook']),
+    );
+    expect(notifications.notify).toHaveBeenCalledWith(
+      expect.objectContaining({
+        type: NotificationType.BookRequestSubmitted,
+        actionUrl: '/requests?tab=all',
+        scope: { kind: 'permission', permission: Permission.ManageBookRequests },
+      }),
+    );
+  });
+
+  it('rejects a blank title rather than storing one', async () => {
+    const { service, repo } = makeService();
+    await expect(service.submit({ ...dto, title: '   ' }, user())).rejects.toThrow(BadRequestException);
+    expect(repo.create).not.toHaveBeenCalled();
+  });
+
+  it('normalizes and persists every provider identifier behind a grouped result', async () => {
+    const { service, repo, dedupe } = makeService();
+    const metadataSources = [
+      {
+        providerKey: ' google ',
+        providerId: ' volume-1 ',
+        providerLabel: ' Google Books ',
+        isbn10: ' 0441013597 ',
+        isbn13: undefined,
+      },
+      {
+        providerKey: 'amazon',
+        providerId: 'edition-2',
+        providerLabel: '   ',
+        isbn10: undefined,
+        isbn13: ' 9781250301697 ',
+      },
+      {
+        providerKey: 'google',
+        providerId: 'volume-1',
+        providerLabel: 'Duplicate',
+        isbn10: null,
+        isbn13: null,
+      },
+    ];
+
+    await service.submit({ ...dto, metadataSources } as never, user());
+
+    const expected = [
+      {
+        providerKey: 'google',
+        providerId: 'volume-1',
+        providerLabel: 'Google Books',
+        isbn10: '0441013597',
+        isbn13: null,
+      },
+      {
+        providerKey: 'amazon',
+        providerId: 'edition-2',
+        providerLabel: 'amazon',
+        isbn10: null,
+        isbn13: '9781250301697',
+      },
+    ];
+    expect(dedupe.findActiveRequestFor).toHaveBeenCalledWith(expect.objectContaining({ metadataSources: expected }));
+    expect(repo.create).toHaveBeenCalledWith(expect.objectContaining({ metadataSources: expected }), expect.any(Array));
+  });
+
+  it('attaches a second requester to the live request instead of creating a duplicate', async () => {
+    const existing = row({ id: 7, userId: 2 });
+    const { service, repo } = makeService({ dedupe: { findActiveRequestFor: vi.fn().mockResolvedValue(existing) } });
+    repo.findById.mockResolvedValue(joined({ id: 7, userId: 2 }));
+
+    const result = await service.submit(dto, user());
+
+    expect(result.subscribed).toBe(true);
+    expect(repo.addSubscriber).toHaveBeenCalledWith(7, 1);
+    expect(repo.create).not.toHaveBeenCalled();
+  });
+
+  it('reuses an existing hidden copy when the requester may see books they request', async () => {
+    const { service, repo, dedupe, automation, notifications } = makeService({
+      dedupe: { findOwnedBookFor: vi.fn().mockResolvedValue(42) },
+    });
+    repo.create.mockResolvedValue(row({ status: 'available', matchedBookId: 42 }));
+    repo.findById.mockResolvedValue(joined({ status: 'available', matchedBookId: 42 }));
+
+    const result = await service.submit(
+      dto,
+      user({ contentFilters: { includeTagIds: [9], excludeTagIds: [], includeGenreIds: [], excludeGenreIds: [], exemptRequestsFromUserId: 1 } }),
+    );
+
+    expect(dedupe.findOwnedBookFor).toHaveBeenCalledWith(expect.objectContaining({ title: 'Dune' }), [1]);
+    expect(repo.create).toHaveBeenCalledWith(expect.objectContaining({ status: 'available', matchedBookId: 42 }), expect.any(Array));
+    expect(result.request.status).toBe('available');
+    expect(automation.considerRequest).not.toHaveBeenCalled();
+    expect(notifications.notify).not.toHaveBeenCalledWith(expect.objectContaining({ type: NotificationType.BookRequestSubmitted }));
+  });
+
+  it('does not reuse a hidden copy when the requester exemption is disabled', async () => {
+    const findOwnedBookFor = vi.fn().mockResolvedValue(42);
+    const { service, repo } = makeService({ dedupe: { findOwnedBookFor } });
+
+    await service.submit(dto, user({ contentFilters: { includeTagIds: [9], excludeTagIds: [], includeGenreIds: [], excludeGenreIds: [] } }));
+
+    expect(findOwnedBookFor).not.toHaveBeenCalled();
+    expect(repo.create).toHaveBeenCalledWith(expect.objectContaining({ status: 'pending', matchedBookId: null }), expect.any(Array));
+  });
+
+  it('does not subscribe the owner to their own live request', async () => {
+    const existing = row({ id: 7, userId: 1 });
+    const { service, repo } = makeService({ dedupe: { findActiveRequestFor: vi.fn().mockResolvedValue(existing) } });
+    repo.findById.mockResolvedValue(joined({ id: 7 }));
+
+    await service.submit(dto, user());
+    expect(repo.addSubscriber).not.toHaveBeenCalled();
+  });
+
+  it('folds a duplicate in rather than opening a second request', async () => {
+    const { service, repo } = makeService({ dedupe: { findActiveRequestFor: vi.fn().mockResolvedValue(row({ id: 7, userId: 2 })) } });
+    await service.submit(dto, user());
+    expect(repo.create).not.toHaveBeenCalled();
+  });
+
+  /**
+   * One live request per work, so a self-fulfiller's own row cannot be opened alongside somebody
+   * else's. Subscribing them and stopping there is what the fold does for everybody else, and for
+   * them it is a dead end: they asked to fetch the book and are handed a request every fulfilment
+   * route then refuses them on.
+   */
+  describe('a self-fulfiller colliding with somebody else', () => {
+    const fulfiller = () => user({ permissions: [Permission.BookRequestAccess, Permission.BookRequestSelfFulfill] });
+
+    function collidingWith(existing: Record<string, unknown>, repoOverrides: Record<string, unknown> = {}) {
+      const harness = makeService({
+        dedupe: { findActiveRequestFor: vi.fn().mockResolvedValue(row({ id: 7, userId: 2, targetLibraryId: 1, ...existing })) },
+        repo: { claimForSelfServe: vi.fn().mockResolvedValue(row({ id: 7, userId: 2, selfServe: true, fulfillerUserId: 1 })), ...repoOverrides },
+      });
+      harness.repo.findById.mockResolvedValue(joined({ id: 7, userId: 2, selfServe: true, fulfillerUserId: 1 }));
+      return harness;
+    }
+
+    it('takes on an undriven request so the caller can reach the picker', async () => {
+      const { service, repo } = collidingWith({ status: 'pending' });
+
+      const result = await service.submit({ ...dto, selfServe: true }, fulfiller());
+
+      expect(repo.claimForSelfServe).toHaveBeenCalledWith(7, 1, ['pending', 'approved'], 10);
+      expect(result.request.fulfillerUserId).toBe(1);
+      expect(repo.createWithinSelfServeCap).not.toHaveBeenCalled();
+    });
+
+    /** They still asked for the book, so they still want telling when it lands. */
+    it('subscribes them to the request they took on', async () => {
+      const { service, repo } = collidingWith({ status: 'pending' });
+
+      await service.submit({ ...dto, selfServe: true }, fulfiller());
+
+      expect(repo.addSubscriber).toHaveBeenCalledWith(7, 1);
+    });
+
+    /** A request that was waiting on a decision has effectively had one, so its requester is told. */
+    it('tells the person whose request it was that somebody is fetching it', async () => {
+      const { service, notifications } = collidingWith({ status: 'pending' });
+
+      await service.submit({ ...dto, selfServe: true }, fulfiller());
+
+      expect(notifications.notify).toHaveBeenCalledWith(
+        expect.objectContaining({ type: NotificationType.BookRequestApproved, message: expect.stringContaining('is fetching it') }),
+      );
+    });
+
+    it('leaves a request somebody already grabbed a release for alone', async () => {
+      const { service, repo, downloads } = collidingWith({ status: 'approved' });
+      downloads.findLatestForRequests.mockResolvedValue(
+        new Map([[7, { download: { id: 3, requestId: 7, createdAt: new Date('2026-08-01T00:00:00Z') } }]]),
+      );
+
+      await service.submit({ ...dto, selfServe: true }, fulfiller());
+
+      expect(repo.claimForSelfServe).not.toHaveBeenCalled();
+    });
+
+    it('leaves a request another self-server is already driving alone', async () => {
+      const { service, repo } = collidingWith({ status: 'approved', selfServe: true });
+
+      await service.submit({ ...dto, selfServe: true }, fulfiller());
+
+      expect(repo.claimForSelfServe).not.toHaveBeenCalled();
+    });
+
+    /**
+     * The same rule a fresh self-serve submission is held to: nobody reviews where a self-server
+     * files a book, so an unreachable destination would let them write into a library they cannot
+     * even read.
+     */
+    it('leaves a request alone whose destination the caller cannot reach', async () => {
+      const { service, repo, libraryService } = collidingWith({ status: 'pending', targetLibraryId: 9 });
+      libraryService.findAccessibleLibraryIds.mockResolvedValue([1]);
+
+      await service.submit({ ...dto, selfServe: true }, fulfiller());
+
+      expect(repo.claimForSelfServe).not.toHaveBeenCalled();
+      expect(repo.addSubscriber).toHaveBeenCalledWith(7, 1);
+    });
+
+    /** Somebody deciding on it between the read and the write wins; they are subscribed instead. */
+    it('subscribes them when the conditional claim finds it already moved on', async () => {
+      const { service, repo } = collidingWith({ status: 'pending' }, { claimForSelfServe: vi.fn().mockResolvedValue(null) });
+
+      const result = await service.submit({ ...dto, selfServe: true }, fulfiller());
+
+      expect(result.subscribed).toBe(true);
+      expect(repo.addSubscriber).toHaveBeenCalledWith(7, 1);
+    });
+
+    /** Pressing Download twice folds them into their own row, which was never a dead end. */
+    it('does not take on a request that is already theirs', async () => {
+      const { service, repo } = collidingWith({ status: 'pending', userId: 1 });
+
+      await service.submit({ ...dto, selfServe: true }, fulfiller());
+
+      expect(repo.claimForSelfServe).not.toHaveBeenCalled();
+    });
+
+    /** Nothing changes for two ordinary requesters: neither of them was going to drive it. */
+    it('never takes one on for a requester who is not fulfilling it themselves', async () => {
+      const { service, repo } = collidingWith({ status: 'pending' });
+
+      const result = await service.submit(dto, user());
+
+      expect(repo.claimForSelfServe).not.toHaveBeenCalled();
+      expect(result.subscribed).toBe(true);
+    });
+  });
+
+  it('auto-approves and skips the approver notification for an auto-approve user', async () => {
+    const { service, repo, notifications, automation } = makeService();
+    repo.create.mockResolvedValue(row({ status: 'approved' }));
+
+    await service.submit({ ...dto, targetLibraryId: 5 }, user({ permissions: [Permission.BookRequestAccess, Permission.BookRequestAutoApprove] }));
+
+    expect(repo.create).toHaveBeenCalledWith(expect.objectContaining({ status: 'approved', decidedByUserId: 1 }), expect.any(Array));
+    expect(notifications.notify).not.toHaveBeenCalled();
+    // Skipping the notification here is only safe because automation knows nobody was told, and
+    // announces the request itself if it ends up handing it back.
+    expect(automation.considerRequest).toHaveBeenCalledWith(10, 'auto_approval');
+  });
+
+  it('refuses a self-serve request from somebody without the permission', async () => {
+    const { service, repo } = makeService();
+
+    await expect(service.submit({ ...dto, selfServe: true, targetLibraryId: 5 }, user())).rejects.toThrow(ForbiddenException);
+    expect(repo.create).not.toHaveBeenCalled();
+  });
+
+  it('creates a self-serve request approved and does not let automation race the picker', async () => {
+    const { service, repo, automation, notifications } = makeService();
+    const fulfiller = user({ permissions: [Permission.BookRequestAccess, Permission.BookRequestSelfFulfill] });
+
+    await service.submit({ ...dto, selfServe: true, targetLibraryId: 5 }, fulfiller);
+
+    expect(repo.createWithinSelfServeCap).toHaveBeenCalledWith(
+      expect.objectContaining({ status: 'approved', selfServe: true, decidedByUserId: 1 }),
+      expect.any(Array),
+      10,
+    );
+    // The requester is on their way to the picker; an unattended grab would take a different release.
+    expect(automation.considerRequest).not.toHaveBeenCalled();
+    expect(notifications.notify).not.toHaveBeenCalled();
+  });
+
+  /**
+   * The instance default exists for requesters who cannot see where their book lands, because an
+   * approver checks it for them. A self-server has no approver, so it has to be somewhere they can
+   * actually reach or they would be writing into a library they cannot read.
+   */
+  it('refuses a self-serve request whose only destination is an instance default the caller cannot reach', async () => {
+    const { service, repo, libraryService } = makeService({
+      automationSettings: { resolveDestinationFor: vi.fn().mockResolvedValue({ libraryId: 9, folderId: null }) },
+    });
+    libraryService.findAccessibleLibraryIds.mockResolvedValue([1, 2]);
+
+    const fulfiller = user({ permissions: [Permission.BookRequestAccess, Permission.BookRequestSelfFulfill] });
+    await expect(service.submit({ ...dto, selfServe: true }, fulfiller)).rejects.toThrow(BadRequestException);
+    expect(repo.create).not.toHaveBeenCalled();
+  });
+
+  it('takes a self-serve request when the instance default is one the caller can reach', async () => {
+    const { service, repo, libraryService } = makeService({
+      automationSettings: { resolveDestinationFor: vi.fn().mockResolvedValue({ libraryId: 9, folderId: null }) },
+    });
+    libraryService.findAccessibleLibraryIds.mockResolvedValue([9]);
+
+    const fulfiller = user({ permissions: [Permission.BookRequestAccess, Permission.BookRequestSelfFulfill] });
+    await service.submit({ ...dto, selfServe: true }, fulfiller);
+
+    expect(repo.createWithinSelfServeCap).toHaveBeenCalledWith(
+      expect.objectContaining({ selfServe: true, targetLibraryId: 9 }),
+      expect.any(Array),
+      10,
+    );
+  });
+
+  /**
+   * A self-server joins no moderation queue, so what is bounded instead is tracker load. Counting
+   * and then inserting is not a cap - two submissions each see nine and both proceed - so the
+   * count lives inside the insert's own transaction and the refusal comes back from it.
+   */
+  it('refuses a self-serve request once too many are already in flight', async () => {
+    const { service, repo } = makeService({ repo: { createWithinSelfServeCap: vi.fn().mockResolvedValue(null) } });
+    const fulfiller = user({ permissions: [Permission.BookRequestAccess, Permission.BookRequestSelfFulfill] });
+
+    await expect(service.submit({ ...dto, selfServe: true, targetLibraryId: 5 }, fulfiller)).rejects.toThrow(ForbiddenException);
+    expect(repo.create).not.toHaveBeenCalled();
+  });
+
+  /** An ordinary request is not self-serve work, so it never goes near the cap. */
+  it('inserts an ordinary request without the self-serve cap', async () => {
+    const { service, repo } = makeService();
+
+    await service.submit(dto, user());
+
+    expect(repo.create).toHaveBeenCalled();
+    expect(repo.createWithinSelfServeCap).not.toHaveBeenCalled();
+  });
+
+  it('refuses an auto-approved request with no destination library', async () => {
+    const { service, repo } = makeService();
+    const autoApprover = user({ permissions: [Permission.BookRequestAccess, Permission.BookRequestAutoApprove] });
+
+    await expect(service.submit(dto, autoApprover)).rejects.toThrow(BadRequestException);
+    expect(repo.create).not.toHaveBeenCalled();
+  });
+
+  it('still takes a request with no destination library from someone whose requests get approved', async () => {
+    const { service, repo } = makeService();
+    await service.submit(dto, user());
+    expect(repo.create).toHaveBeenCalledWith(expect.objectContaining({ status: 'pending', targetLibraryId: null }), expect.any(Array));
+  });
+
+  /**
+   * The whole point of the instance default: a request that names nowhere still gets a
+   * destination, which is what approval and unattended grabbing both refuse to proceed without.
+   */
+  it('falls back to the instance default for the requested medium', async () => {
+    const { service, repo, automationSettings } = makeService({
+      automationSettings: { resolveDestinationFor: vi.fn().mockResolvedValue({ libraryId: 7, folderId: 21 }) },
+    });
+
+    await service.submit(dto, user());
+
+    expect(automationSettings.resolveDestinationFor).toHaveBeenCalledWith('ebook');
+    expect(repo.create).toHaveBeenCalledWith(expect.objectContaining({ targetLibraryId: 7, targetFolderId: 21 }), expect.any(Array));
+  });
+
+  it('keeps the requester own library over the instance default', async () => {
+    const { service, repo, automationSettings } = makeService({
+      automationSettings: { resolveDestinationFor: vi.fn().mockResolvedValue({ libraryId: 7, folderId: 21 }) },
+    });
+
+    await service.submit({ ...dto, targetLibraryId: 5 }, user());
+
+    expect(automationSettings.resolveDestinationFor).not.toHaveBeenCalled();
+    expect(repo.create).toHaveBeenCalledWith(expect.objectContaining({ targetLibraryId: 5 }), expect.any(Array));
+  });
+
+  /**
+   * The operator picked the default for the whole instance, so it is not filtered by what this
+   * requester happens to be able to browse. Checking it would put the request back to having no
+   * destination for exactly the users the default is there to serve.
+   */
+  it('does not check the requester access against the instance default', async () => {
+    const { service, repo, libraryService } = makeService({
+      automationSettings: { resolveDestinationFor: vi.fn().mockResolvedValue({ libraryId: 7, folderId: 21 }) },
+    });
+
+    await service.submit(dto, user());
+
+    expect(libraryService.verifyUserAccess).not.toHaveBeenCalled();
+    expect(repo.create).toHaveBeenCalledWith(expect.objectContaining({ targetLibraryId: 7 }), expect.any(Array));
+  });
+
+  it('refuses a destination folder that is not in the destination library', async () => {
+    const { service, repo } = makeService({ repo: { folderBelongsToLibrary: vi.fn().mockResolvedValue(false) } });
+
+    await expect(service.submit({ ...dto, targetLibraryId: 5, targetFolderId: 8 }, user())).rejects.toThrow(BadRequestException);
+    expect(repo.create).not.toHaveBeenCalled();
+  });
+
+  it('rejects a target library the requester cannot reach', async () => {
+    const { service, repo, libraryService } = makeService();
+    libraryService.verifyUserAccess.mockRejectedValue(new ForbiddenException('No access to this library'));
+
+    await expect(service.submit({ ...dto, targetLibraryId: 9 }, user())).rejects.toThrow(ForbiddenException);
+    expect(repo.create).not.toHaveBeenCalled();
+  });
+
+  it('attaches the loser of an insert race to the winning request instead of failing', async () => {
+    const winner = row({ id: 7, userId: 2 });
+    const { service, repo, dedupe } = makeService({
+      dedupe: { findActiveRequestFor: vi.fn().mockResolvedValueOnce(undefined).mockResolvedValueOnce(winner) },
+    });
+    repo.create.mockRejectedValue(
+      new Error('Failed query', { cause: Object.assign(new Error('duplicate key value violates unique constraint'), { code: '23505' }) }),
+    );
+    repo.findById.mockResolvedValue(joined({ id: 7, userId: 2 }));
+
+    const result = await service.submit(dto, user());
+
+    expect(result.subscribed).toBe(true);
+    expect(repo.addSubscriber).toHaveBeenCalledWith(7, 1);
+    expect(dedupe.findActiveRequestFor).toHaveBeenCalledTimes(2);
+  });
+
+  /** The claim the winner held is free again the moment it settles, so the insert that lost works. */
+  it('retries the insert once when the request that won the race has already gone', async () => {
+    const { service, repo, dedupe } = makeService();
+    repo.create
+      .mockRejectedValueOnce(new Error('Failed query', { cause: Object.assign(new Error('duplicate key'), { code: '23505' }) }))
+      .mockResolvedValue(row());
+
+    const result = await service.submit(dto, user());
+
+    expect(result.subscribed).toBe(false);
+    expect(repo.create).toHaveBeenCalledTimes(2);
+    expect(dedupe.findActiveRequestFor).toHaveBeenCalledTimes(2);
+  });
+
+  it('retries the insert when the winner is deleted between finding it and reading it back', async () => {
+    const winner = row({ id: 7, userId: 2 });
+    const { service, repo } = makeService({
+      dedupe: { findActiveRequestFor: vi.fn().mockResolvedValueOnce(undefined).mockResolvedValue(winner) },
+    });
+    repo.create
+      .mockRejectedValueOnce(new Error('Failed query', { cause: Object.assign(new Error('duplicate key'), { code: '23505' }) }))
+      .mockResolvedValue(row());
+    repo.findById.mockResolvedValueOnce(undefined).mockResolvedValue(joined());
+
+    const result = await service.submit(dto, user());
+
+    expect(result.subscribed).toBe(false);
+    expect(repo.create).toHaveBeenCalledTimes(2);
+  });
+
+  it('joins the winner when the retry loses to a second concurrent insert', async () => {
+    const winner = row({ id: 7, userId: 2 });
+    const violation = new Error('Failed query', { cause: Object.assign(new Error('duplicate key'), { code: '23505' }) });
+    const { service, repo, dedupe } = makeService({
+      dedupe: { findActiveRequestFor: vi.fn().mockResolvedValueOnce(undefined).mockResolvedValueOnce(undefined).mockResolvedValue(winner) },
+    });
+    repo.create.mockRejectedValue(violation);
+    repo.findById.mockResolvedValue(joined({ id: 7, userId: 2 }));
+
+    const result = await service.submit(dto, user());
+
+    expect(result.subscribed).toBe(true);
+    expect(repo.create).toHaveBeenCalledTimes(2);
+    expect(dedupe.findActiveRequestFor).toHaveBeenCalledTimes(3);
+  });
+
+  it('rethrows a unique violation that no live request explains', async () => {
+    const { service, repo } = makeService();
+    const violation = new Error('Failed query', { cause: Object.assign(new Error('duplicate key'), { code: '23505' }) });
+    repo.create.mockRejectedValue(violation);
+
+    await expect(service.submit(dto, user())).rejects.toBe(violation);
+  });
+
+  it('rethrows any other database failure untouched', async () => {
+    const { service, repo } = makeService();
+    repo.create.mockRejectedValue(Object.assign(new Error('connection terminated'), { code: '57P01' }));
+
+    await expect(service.submit(dto, user())).rejects.toThrow('connection terminated');
+  });
+});
+
+/**
+ * Filing a request for somebody else, which is what a front end that its own users sign into needs
+ * in order to say who actually asked.
+ *
+ * Every test here is the same question asked once per decision the submission makes: does this
+ * branch ask about the requester, or about whoever holds the token? The answer must always be the
+ * requester, or naming somebody quietly hands them the integration's privileges.
+ */
+describe('BookRequestService.submit on behalf of another user', () => {
+  const bob = () => user({ id: 42, username: 'bob', name: 'Bob' });
+
+  it('records the named user as the requester and the caller as who filed it', async () => {
+    const { service, repo } = makeService({ actingUser: bob() });
+
+    await service.submit({ ...dto, userId: 42 }, moderator());
+
+    expect(repo.create).toHaveBeenCalledWith(expect.objectContaining({ userId: 42, createdByUserId: 1 }), expect.anything());
+  });
+
+  it('leaves an ordinary request recorded as nobody else having filed it', async () => {
+    const { service, repo, auth } = makeService();
+
+    await service.submit(dto, user());
+
+    expect(repo.create).toHaveBeenCalledWith(expect.objectContaining({ userId: 1, createdByUserId: null }), expect.anything());
+    expect(auth.findActingUser).not.toHaveBeenCalled();
+  });
+
+  it('treats a caller naming their own id as an ordinary request, with no permission needed', async () => {
+    const { service, repo, auth } = makeService();
+
+    await service.submit({ ...dto, userId: 1 }, user());
+
+    expect(repo.create).toHaveBeenCalledWith(expect.objectContaining({ userId: 1, createdByUserId: null }), expect.anything());
+    expect(auth.findActingUser).not.toHaveBeenCalled();
+  });
+
+  it('refuses a caller who cannot manage requests, before looking the requester up', async () => {
+    const { service, repo, auth } = makeService({ actingUser: bob() });
+
+    await expect(service.submit({ ...dto, userId: 42 }, user())).rejects.toThrow(ForbiddenException);
+    expect(repo.create).not.toHaveBeenCalled();
+    expect(auth.findActingUser).not.toHaveBeenCalled();
+  });
+
+  /**
+   * The regression that matters most. A fall back to the caller here would read as defensive and
+   * would silently reinstate the mis-attribution the whole feature exists to end.
+   */
+  it('refuses a requester who cannot be resolved rather than filing under the caller', async () => {
+    const { service, repo } = makeService({ actingUser: null });
+
+    await expect(service.submit({ ...dto, userId: 999 }, moderator())).rejects.toThrow(NotFoundException);
+    expect(repo.create).not.toHaveBeenCalled();
+  });
+
+  it('holds the request for a decision when the requester cannot auto-approve, though the caller can', async () => {
+    const { service, repo, automation } = makeService({ actingUser: bob() });
+    const caller = moderator({ permissions: withRequiredPermissions([Permission.ManageBookRequests, Permission.BookRequestAutoApprove]) });
+
+    await service.submit({ ...dto, userId: 42 }, caller);
+
+    expect(repo.create).toHaveBeenCalledWith(expect.objectContaining({ status: 'pending', decidedByUserId: null }), expect.anything());
+    expect(automation.considerRequest).not.toHaveBeenCalled();
+  });
+
+  it('auto-approves when the requester can, though the caller cannot', async () => {
+    const autoApprover = user({ id: 42, name: 'Bob', permissions: [Permission.BookRequestAccess, Permission.BookRequestAutoApprove] });
+    const { service, repo, automation } = makeService({ actingUser: autoApprover });
+
+    await service.submit({ ...dto, userId: 42, targetLibraryId: 5 }, moderator());
+
+    expect(repo.create).toHaveBeenCalledWith(expect.objectContaining({ status: 'approved', decidedByUserId: 42 }), expect.anything());
+    expect(automation.considerRequest).toHaveBeenCalled();
+  });
+
+  it('refuses self-fulfilment the requester does not hold, though the caller holds it', async () => {
+    const { service, repo } = makeService({ actingUser: bob() });
+    const caller = moderator({ permissions: withRequiredPermissions([Permission.ManageBookRequests, Permission.BookRequestSelfFulfill]) });
+
+    await expect(service.submit({ ...dto, userId: 42, selfServe: true, targetLibraryId: 5 }, caller)).rejects.toThrow(ForbiddenException);
+    expect(repo.create).not.toHaveBeenCalled();
+    expect(repo.createWithinSelfServeCap).not.toHaveBeenCalled();
+  });
+
+  it('resolves the destination against the requester libraries, not the caller libraries', async () => {
+    const { service, libraryService } = makeService({ actingUser: bob() });
+
+    await service.submit({ ...dto, userId: 42, targetLibraryId: 5 }, moderator());
+
+    expect(libraryService.verifyUserAccess).toHaveBeenCalledWith(42, 5, false);
+  });
+
+  /**
+   * The cap is enforced inside the insert, keyed on the row it is inserting. Filing under the
+   * caller instead would hand every proxied user a fresh allowance of downloads in flight.
+   */
+  it('counts the downloads-in-flight cap against the requester', async () => {
+    const selfFulfiller = user({ id: 42, name: 'Bob', permissions: [Permission.BookRequestAccess, Permission.BookRequestSelfFulfill] });
+    const { service, repo } = makeService({ actingUser: selfFulfiller });
+
+    await service.submit({ ...dto, userId: 42, selfServe: true, targetLibraryId: 5 }, moderator());
+
+    expect(repo.createWithinSelfServeCap).toHaveBeenCalledWith(
+      expect.objectContaining({ userId: 42, selfServe: true }),
+      expect.anything(),
+      expect.any(Number),
+    );
+  });
+
+  /**
+   * The branch a happy-path test never reaches: a proxied request for a book somebody already
+   * asked for folds into the existing row, and the person subscribed to it has to be the requester
+   * or they never hear that their book arrived.
+   */
+  it('subscribes the requester when the work was already requested', async () => {
+    const { service, repo } = makeService({
+      actingUser: bob(),
+      dedupe: { findActiveRequestFor: vi.fn().mockResolvedValue(row({ id: 7, userId: 2 })) },
+    });
+    repo.findById.mockResolvedValue(joined({ id: 7, userId: 2 }));
+
+    const result = await service.submit({ ...dto, userId: 42 }, moderator());
+
+    expect(result.subscribed).toBe(true);
+    expect(repo.addSubscriber).toHaveBeenCalledWith(7, 42);
+  });
+
+  it('names the requester to the approvers, not the account that called', async () => {
+    const { service, notifications } = makeService({ actingUser: bob() });
+
+    await service.submit({ ...dto, userId: 42 }, moderator({ name: 'Bookbot' }));
+
+    expect(notifications.notify).toHaveBeenCalledWith(
+      expect.objectContaining({ type: NotificationType.BookRequestSubmitted, message: expect.stringContaining('Bob') }),
+    );
+    expect(notifications.notify).not.toHaveBeenCalledWith(expect.objectContaining({ message: expect.stringContaining('Bookbot') }));
+  });
+
+  it('lets a superuser file for somebody else', async () => {
+    const { service, repo } = makeService({ actingUser: bob() });
+
+    await service.submit({ ...dto, userId: 42 }, user({ id: 3, isSuperuser: true }));
+
+    expect(repo.create).toHaveBeenCalledWith(expect.objectContaining({ userId: 42, createdByUserId: 3 }), expect.anything());
+  });
+});
+
+describe('BookRequestService.submit language', () => {
+  it.each([
+    ['spa', 'es'],
+    ['English', 'en'],
+    ['pt-BR', 'pt'],
+  ])('stores a provider language of %s as %s', async (given, stored) => {
+    const { service, repo } = makeService();
+    await service.submit({ title: 'Dune', mediaKind: 'ebook', language: given } as never, user());
+    expect(repo.create).toHaveBeenCalledWith(expect.objectContaining({ language: stored }), expect.any(Array));
+  });
+
+  /**
+   * The offered list is curated; what a provider already stated is not. Narrowing a request down to
+   * only the offered codes would turn a language the matcher handled perfectly well into no filter
+   * at all, so a code outside that list still has to survive being stored.
+   */
+  it('keeps a provider language the dropdown does not happen to offer', async () => {
+    const { service, repo } = makeService();
+    await service.submit({ title: 'Dune', mediaKind: 'ebook', language: 'ne' } as never, user());
+    expect(repo.create).toHaveBeenCalledWith(expect.objectContaining({ language: 'ne' }), expect.any(Array));
+  });
+
+  it('stores nothing rather than a filter nothing satisfies', async () => {
+    const { service, repo } = makeService();
+    await service.submit({ title: 'Dune', mediaKind: 'ebook', language: '' } as never, user());
+    expect(repo.create).toHaveBeenCalledWith(expect.objectContaining({ language: null }), expect.any(Array));
+  });
+});
+
+/**
+ * `cancel` and `setLanguage` live on the requester controller, whose class guard answers to
+ * `BookRequestAccess`. Their moderator branches are only reachable if a `manage_book_requests`
+ * grant carries that access with it, which is what makes them worth testing at all.
+ */
+describe('the moderator role a manage grant produces', () => {
+  it('carries the access the guard in front of cancel and language asks for', () => {
+    expect(moderator().permissions).toContain(Permission.BookRequestAccess);
+  });
+});
+
+describe('BookRequestService.cancel', () => {
+  it('lets the owner cancel a pending request', async () => {
+    const { service, repo } = makeService();
+    await service.cancel(10, user());
+    expect(repo.updateIf).toHaveBeenCalledWith(10, expect.anything(), expect.objectContaining({ status: 'cancelled' }));
+  });
+
+  it('refuses a stranger', async () => {
+    const { service } = makeService({ repo: { findById: vi.fn().mockResolvedValue(joined({ userId: 2 })) } });
+    await expect(service.cancel(10, user())).rejects.toThrow(ForbiddenException);
+  });
+
+  it('lets an approver cancel someone else request', async () => {
+    const { service, repo } = makeService({ repo: { findById: vi.fn().mockResolvedValue(joined({ userId: 2 })) } });
+    await service.cancel(10, moderator());
+    expect(repo.updateIf).toHaveBeenCalled();
+  });
+
+  it('refuses to cancel a request that already landed', async () => {
+    const { service } = makeService({ repo: { findById: vi.fn().mockResolvedValue(joined({ status: 'available' })) } });
+    await expect(service.cancel(10, user())).rejects.toThrow(BadRequestException);
+  });
+
+  it('reports a missing request as not found', async () => {
+    const { service } = makeService({ repo: { findById: vi.fn().mockResolvedValue(undefined) } });
+    await expect(service.cancel(10, user())).rejects.toThrow(NotFoundException);
+  });
+
+  /** The whole point of widening this: a request that stalled mid-pipeline had no exit at all. */
+  it.each(['searching', 'grabbed', 'downloading', 'importing', 'needs_review', 'failed'])('stops a request that is %s', async (status) => {
+    const { service, repo } = makeService({ repo: { findById: vi.fn().mockResolvedValue(joined({ status })) } });
+    await service.cancel(10, user());
+    expect(repo.updateIf).toHaveBeenCalledWith(10, expect.anything(), expect.objectContaining({ status: 'cancelled' }));
+  });
+
+  it.each(['rejected', 'cancelled'])('refuses to cancel a request that already settled as %s', async (status) => {
+    const { service } = makeService({ repo: { findById: vi.fn().mockResolvedValue(joined({ status })) } });
+    await expect(service.cancel(10, user())).rejects.toThrow(BadRequestException);
+  });
+
+  it('stops the torrent too, keeping the files the library may already be hardlinked to', async () => {
+    const { service, removal } = makeService({ repo: { findById: vi.fn().mockResolvedValue(joined({ status: 'downloading' })) } });
+
+    await service.cancel(10, user());
+
+    expect(removal.removeLatestForRequest).toHaveBeenCalledWith(10, false, 'reader');
+  });
+
+  /** A download client that is down must not be the reason a stuck request stays stuck. */
+  it('cancels anyway when the download client will not let go, and says so on the row', async () => {
+    const { service, repo } = makeService({
+      repo: { findById: vi.fn().mockResolvedValue(joined({ status: 'downloading' })) },
+      removal: { removeLatestForRequest: vi.fn().mockResolvedValue({ removed: false, error: 'connection refused' }) },
+    });
+
+    await service.cancel(10, user());
+
+    expect(repo.updateIf).toHaveBeenCalledWith(10, expect.anything(), expect.objectContaining({ status: 'cancelled' }));
+    expect(repo.updateIf).toHaveBeenCalledWith(10, ['cancelled'], { statusReason: expect.stringContaining('connection refused') });
+  });
+
+  /** The seed of a request that finished mid-click is not the cancellation's to take. */
+  it('leaves the download alone when the request settled before the cancellation landed', async () => {
+    const { service, removal } = makeService({
+      repo: {
+        findById: vi
+          .fn()
+          .mockResolvedValueOnce(joined({ status: 'downloading' }))
+          .mockResolvedValue(joined({ status: 'available' })),
+        updateIf: vi.fn().mockResolvedValue(undefined),
+      },
+    });
+
+    await expect(service.cancel(10, user())).rejects.toMatchObject({
+      response: {
+        errorCode: 'BOOK_REQUEST_STALE_TRANSITION',
+        errorMeta: { action: 'cancel', status: 'available' },
+      },
+    });
+    expect(removal.removeLatestForRequest).not.toHaveBeenCalled();
+  });
+
+  it('clears a stale failure reason when the stop went cleanly', async () => {
+    const { service, repo } = makeService({ repo: { findById: vi.fn().mockResolvedValue(joined({ status: 'failed', statusReason: 'no seeds' })) } });
+
+    await service.cancel(10, user());
+
+    expect(repo.updateIf).toHaveBeenCalledWith(10, expect.anything(), expect.objectContaining({ statusReason: null }));
+  });
+});
+
+describe('BookRequestService.cancelDownload', () => {
+  it('stops only the active transfer and leaves the request approved for another release', async () => {
+    const { service, repo, removal, gateway } = makeService({
+      repo: { findById: vi.fn().mockResolvedValue(joined({ status: 'downloading' })) },
+    });
+
+    await service.cancelDownload(10, 11, user());
+
+    expect(removal.removeAttempt).toHaveBeenCalledWith(10, 11, false, 'reader');
+    expect(repo.updateIf).toHaveBeenCalledWith(10, ['grabbed', 'downloading'], { status: 'approved', statusReason: null });
+    expect(repo.updateIf).not.toHaveBeenCalledWith(10, expect.anything(), expect.objectContaining({ status: 'cancelled' }));
+    expect(gateway.emitChanged).toHaveBeenCalled();
+  });
+
+  it('refuses someone who cannot drive the request', async () => {
+    const { service, removal } = makeService({
+      repo: { findById: vi.fn().mockResolvedValue(joined({ userId: 2, status: 'downloading' })) },
+    });
+
+    await expect(service.cancelDownload(10, 11, user())).rejects.toThrow(ForbiddenException);
+    expect(removal.removeAttempt).not.toHaveBeenCalled();
+  });
+
+  it('refuses an attempt from another request', async () => {
+    const { service, removal } = makeService({
+      repo: { findById: vi.fn().mockResolvedValue(joined({ status: 'downloading' })) },
+      downloads: { findById: vi.fn().mockResolvedValue({ id: 11, requestId: 99, status: 'downloading' }) },
+    });
+
+    await expect(service.cancelDownload(10, 11, user())).rejects.toThrow(NotFoundException);
+    expect(removal.removeAttempt).not.toHaveBeenCalled();
+  });
+
+  it('does not cancel a transfer that has already completed', async () => {
+    const { service, removal } = makeService({
+      repo: { findById: vi.fn().mockResolvedValue(joined({ status: 'importing' })) },
+      downloads: { findById: vi.fn().mockResolvedValue({ id: 11, requestId: 10, status: 'completed' }) },
+    });
+
+    await expect(service.cancelDownload(10, 11, user())).rejects.toThrow(BadRequestException);
+    expect(removal.removeAttempt).not.toHaveBeenCalled();
+  });
+
+  it('does not report a cancellation when completion wins the detach race', async () => {
+    const { service, repo } = makeService({
+      repo: { findById: vi.fn().mockResolvedValue(joined({ status: 'downloading' })) },
+      removal: { removeAttempt: vi.fn().mockResolvedValue(false) },
+    });
+
+    await expect(service.cancelDownload(10, 11, user())).rejects.toThrow('The download finished before it could be cancelled');
+    expect(repo.updateIf).not.toHaveBeenCalled();
+  });
+});
+
+describe('BookRequestService.setLanguage', () => {
+  it('lets the owner change what language the request asks for', async () => {
+    const { service, repo } = makeService();
+    await service.setLanguage(10, 'en', user());
+    expect(repo.updateIf).toHaveBeenCalledWith(10, expect.anything(), { language: 'en' });
+  });
+
+  /**
+   * The reason this exists. A provider states "spa" where a request compares "es", so storing it
+   * as given would hard-filter out every Spanish release for a request asking for Spanish.
+   */
+  it.each([
+    ['spa', 'es'],
+    ['English', 'en'],
+    ['EN', 'en'],
+    ['fre', 'fr'],
+    ['en-GB', 'en'],
+  ])('normalises %s to %s', async (given, stored) => {
+    const { service, repo } = makeService();
+    await service.setLanguage(10, given, user());
+    expect(repo.updateIf).toHaveBeenCalledWith(10, expect.anything(), { language: stored });
+  });
+
+  it('clears the language so any edition matches again', async () => {
+    const { service, repo } = makeService();
+    await service.setLanguage(10, null, user());
+    expect(repo.updateIf).toHaveBeenCalledWith(10, expect.anything(), { language: null });
+  });
+
+  it('refuses a language nothing could ever be matched against', async () => {
+    const { service } = makeService();
+    await expect(service.setLanguage(10, 'klingon', user())).rejects.toThrow(BadRequestException);
+  });
+
+  it('refuses a stranger', async () => {
+    const { service } = makeService({ repo: { findById: vi.fn().mockResolvedValue(joined({ userId: 2 })) } });
+    await expect(service.setLanguage(10, 'en', user())).rejects.toThrow(ForbiddenException);
+  });
+
+  it('lets an approver correct someone else request', async () => {
+    const { service, repo } = makeService({ repo: { findById: vi.fn().mockResolvedValue(joined({ userId: 2 })) } });
+    await service.setLanguage(10, 'en', moderator());
+    expect(repo.updateIf).toHaveBeenCalledWith(10, expect.anything(), { language: 'en' });
+  });
+
+  it('refuses once the book has been filed', async () => {
+    const { service } = makeService({ repo: { findById: vi.fn().mockResolvedValue(joined({ status: 'available' })) } });
+    await expect(service.setLanguage(10, 'en', user())).rejects.toThrow(BadRequestException);
+  });
+
+  /** A failed request re-searched in the right language is the case worth having this for. */
+  it.each(['pending', 'approved', 'searching', 'failed', 'needs_review'])('can still be changed while %s', async (status) => {
+    const { service, repo } = makeService({ repo: { findById: vi.fn().mockResolvedValue(joined({ status })) } });
+    await service.setLanguage(10, 'en', user());
+    expect(repo.updateIf).toHaveBeenCalledWith(10, expect.anything(), { language: 'en' });
+  });
+
+  it('reports a missing request as not found', async () => {
+    const { service } = makeService({ repo: { findById: vi.fn().mockResolvedValue(undefined) } });
+    await expect(service.setLanguage(10, 'en', user())).rejects.toThrow(NotFoundException);
+  });
+});
+
+describe('BookRequestService.dismiss', () => {
+  it.each(['rejected', 'cancelled', 'available', 'failed'])('hides a %s request from the caller only', async (status) => {
+    const { service, repo } = makeService({ repo: { findById: vi.fn().mockResolvedValue(joined({ status })) } });
+
+    await service.dismiss(10, user());
+
+    expect(repo.dismissIf).toHaveBeenCalledWith(10, 1, expect.arrayContaining([status]));
+    expect(repo.updateIf).not.toHaveBeenCalled();
+  });
+
+  it('refuses to sweep away work that is still running', async () => {
+    const { service } = makeService({ repo: { findById: vi.fn().mockResolvedValue(joined({ status: 'downloading' })) } });
+    await expect(service.dismiss(10, user())).rejects.toThrow(BadRequestException);
+  });
+
+  it('refuses someone with no business seeing the request', async () => {
+    const { service } = makeService({ repo: { findById: vi.fn().mockResolvedValue(joined({ userId: 2, status: 'available' })) } });
+    await expect(service.dismiss(10, user())).rejects.toThrow(ForbiddenException);
+  });
+
+  it('brings a hidden request back', async () => {
+    const { service, repo } = makeService({ repo: { findById: vi.fn().mockResolvedValue(joined({ status: 'available' })) } });
+
+    await service.restore(10, user());
+
+    expect(repo.restore).toHaveBeenCalledWith(10, 1);
+  });
+});
+
+describe('BookRequestService.remove', () => {
+  const approver = user({ permissions: [Permission.BookRequestAccess, Permission.ManageBookRequests] });
+
+  it.each(['rejected', 'cancelled', 'available', 'failed'])('deletes a %s request', async (status) => {
+    const { service, repo } = makeService({ repo: { findById: vi.fn().mockResolvedValue(joined({ status })) } });
+
+    await service.remove(10, approver);
+
+    expect(repo.remove).toHaveBeenCalledWith(10, expect.arrayContaining([status]));
+  });
+
+  it('refuses a requester who is not a moderator', async () => {
+    const { service } = makeService({ repo: { findById: vi.fn().mockResolvedValue(joined({ status: 'available' })) } });
+    await expect(service.remove(10, user())).rejects.toThrow(ForbiddenException);
+  });
+
+  it('refuses a request that is still being worked on', async () => {
+    const { service } = makeService({ repo: { findById: vi.fn().mockResolvedValue(joined({ status: 'downloading' })) } });
+    await expect(service.remove(10, approver)).rejects.toThrow(BadRequestException);
+  });
+
+  /** The download row cascades away with the request, so the torrent must go first or not at all. */
+  it('takes the seeding torrent out of the client before deleting the row', async () => {
+    const { service, repo, removal } = makeService({ repo: { findById: vi.fn().mockResolvedValue(joined({ status: 'available' })) } });
+
+    await service.remove(10, approver);
+
+    expect(removal.removeLatestForRequest).toHaveBeenCalledWith(10, false, 'reader');
+    expect(repo.remove).toHaveBeenCalled();
+  });
+
+  it('keeps the row when the torrent could not be removed, rather than orphaning it', async () => {
+    const { service, repo } = makeService({
+      repo: { findById: vi.fn().mockResolvedValue(joined({ status: 'available' })) },
+      removal: { removeLatestForRequest: vi.fn().mockResolvedValue({ removed: false, error: 'connection refused' }) },
+    });
+
+    await expect(service.remove(10, approver)).rejects.toThrow(BadRequestException);
+    expect(repo.remove).not.toHaveBeenCalled();
+  });
+
+  it('reserves a failed request before detaching so a concurrent retry cannot be stopped', async () => {
+    const order: string[] = [];
+    const { service, repo, removal } = makeService({
+      repo: {
+        findById: vi.fn().mockResolvedValue(joined({ status: 'failed' })),
+        updateIf: vi.fn().mockImplementation(() => {
+          order.push('reserve');
+          return Promise.resolve(row({ status: 'cancelled' }));
+        }),
+      },
+      removal: {
+        removeLatestForRequest: vi.fn().mockImplementation(() => {
+          order.push('detach');
+          return Promise.resolve({ removed: true, error: null });
+        }),
+      },
+    });
+
+    await service.remove(10, approver);
+
+    expect(order).toEqual(['reserve', 'detach']);
+    expect(repo.updateIf).toHaveBeenCalledWith(10, ['failed'], { status: 'cancelled' });
+    expect(removal.removeLatestForRequest).toHaveBeenCalled();
+  });
+
+  it('releases the failed-request reservation when the client refuses removal', async () => {
+    const { service, repo } = makeService({
+      repo: { findById: vi.fn().mockResolvedValue(joined({ status: 'failed' })) },
+      removal: { removeLatestForRequest: vi.fn().mockResolvedValue({ removed: false, error: 'connection refused' }) },
+    });
+
+    await expect(service.remove(10, approver)).rejects.toThrow(BadRequestException);
+
+    expect(repo.updateIf).toHaveBeenNthCalledWith(1, 10, ['failed'], { status: 'cancelled' });
+    expect(repo.updateIf).toHaveBeenNthCalledWith(2, 10, ['cancelled'], { status: 'failed' });
+    expect(repo.remove).not.toHaveBeenCalled();
+  });
+
+  it('reports a missing request as not found', async () => {
+    const { service } = makeService({ repo: { findById: vi.fn().mockResolvedValue(undefined) } });
+    await expect(service.remove(10, approver)).rejects.toThrow(NotFoundException);
+  });
+});
+
+describe('BookRequestService.approve', () => {
+  const approver = user({ permissions: [Permission.BookRequestAccess, Permission.ManageBookRequests] });
+
+  it('approves a pending request and notifies everyone attached', async () => {
+    const { service, repo, notifications } = makeService({ repo: { findInterestedUserIds: vi.fn().mockResolvedValue([1, 2]) } });
+    await service.approve(10, { targetLibraryId: 5 }, approver);
+
+    expect(repo.updateIf).toHaveBeenCalledWith(10, expect.anything(), expect.objectContaining({ status: 'approved', decidedByUserId: 1 }));
+    const approvals = notifications.notify.mock.calls.filter(([p]) => p.type === NotificationType.BookRequestApproved);
+    expect(approvals.map(([p]) => p.scope)).toEqual([
+      { kind: 'user', userId: 1 },
+      { kind: 'user', userId: 2 },
+    ]);
+  });
+
+  it('refuses to approve anything that is not pending', async () => {
+    const { service } = makeService({ repo: { findById: vi.fn().mockResolvedValue(joined({ status: 'approved' })) } });
+    await expect(service.approve(10, {}, approver)).rejects.toThrow(BadRequestException);
+  });
+
+  it('lets the approver reroute to a library they can reach', async () => {
+    const { service, repo } = makeService();
+    await service.approve(10, { targetLibraryId: 5 }, approver);
+    expect(repo.updateIf).toHaveBeenCalledWith(10, expect.anything(), expect.objectContaining({ targetLibraryId: 5 }));
+  });
+
+  it('refuses a reroute to a library the approver cannot reach', async () => {
+    const { service, repo, libraryService } = makeService();
+    libraryService.verifyUserAccess.mockRejectedValue(new ForbiddenException('No access to this library'));
+    await expect(service.approve(10, { targetLibraryId: 5 }, approver)).rejects.toThrow(ForbiddenException);
+    expect(repo.updateIf).not.toHaveBeenCalled();
+  });
+
+  it('keeps the requester chosen library when the approver does not reroute', async () => {
+    const { service, repo } = makeService({ repo: { findById: vi.fn().mockResolvedValue(joined({ targetLibraryId: 3 })) } });
+    await service.approve(10, {}, approver);
+    expect(repo.updateIf).toHaveBeenCalledWith(10, expect.anything(), expect.objectContaining({ targetLibraryId: 3 }));
+  });
+
+  it('refuses a folder that belongs to a different library', async () => {
+    const { service, repo } = makeService({ repo: { folderBelongsToLibrary: vi.fn().mockResolvedValue(false) } });
+    await expect(service.approve(10, { targetLibraryId: 5, targetFolderId: 8 }, approver)).rejects.toThrow(BadRequestException);
+    expect(repo.updateIf).not.toHaveBeenCalled();
+  });
+
+  it('refuses to approve a request with nowhere to file the book', async () => {
+    const { service, repo } = makeService();
+    await expect(service.approve(10, {}, approver)).rejects.toThrow(BadRequestException);
+    await expect(service.approve(10, { targetFolderId: 8 }, approver)).rejects.toThrow(BadRequestException);
+    expect(repo.updateIf).not.toHaveBeenCalled();
+  });
+
+  /** Requests made before a default was set carry none, and the approver should not retype one. */
+  it('falls back to the instance default for a request that names nowhere', async () => {
+    const { service, repo, automationSettings } = makeService({
+      automationSettings: { resolveDestinationFor: vi.fn().mockResolvedValue({ libraryId: 7, folderId: 21 }) },
+    });
+
+    await service.approve(10, {}, approver);
+
+    expect(automationSettings.resolveDestinationFor).toHaveBeenCalledWith('ebook');
+    expect(repo.updateIf).toHaveBeenCalledWith(10, expect.anything(), expect.objectContaining({ targetLibraryId: 7, targetFolderId: 21 }));
+  });
+
+  it('keeps what the approver picked over the instance default', async () => {
+    const { service, repo, automationSettings } = makeService({
+      automationSettings: { resolveDestinationFor: vi.fn().mockResolvedValue({ libraryId: 7, folderId: 21 }) },
+    });
+
+    await service.approve(10, { targetLibraryId: 5 }, approver);
+
+    expect(automationSettings.resolveDestinationFor).not.toHaveBeenCalled();
+    expect(repo.updateIf).toHaveBeenCalledWith(10, expect.anything(), expect.objectContaining({ targetLibraryId: 5 }));
+  });
+
+  it('refuses a folder that does not belong to the library the approver rerouted to', async () => {
+    const { service, repo } = makeService({
+      repo: {
+        findById: vi.fn().mockResolvedValue(joined({ targetLibraryId: 3, targetFolderId: 8 })),
+        folderBelongsToLibrary: vi.fn().mockResolvedValue(false),
+      },
+    });
+    await expect(service.approve(10, { targetLibraryId: 5 }, approver)).rejects.toThrow(BadRequestException);
+    expect(repo.updateIf).not.toHaveBeenCalled();
+  });
+
+  it('keeps a folder that does belong to the destination library', async () => {
+    const { service, repo } = makeService({ repo: { findById: vi.fn().mockResolvedValue(joined({ targetLibraryId: 3, targetFolderId: 8 })) } });
+    await service.approve(10, {}, approver);
+    expect(repo.folderBelongsToLibrary).toHaveBeenCalledWith(8, 3);
+    expect(repo.updateIf).toHaveBeenCalledWith(10, expect.anything(), expect.objectContaining({ targetFolderId: 8 }));
+  });
+});
+
+describe('BookRequestService.reject', () => {
+  const approver = user({ permissions: [Permission.BookRequestAccess, Permission.ManageBookRequests] });
+
+  it('rejects a pending request and carries the reason into the notification', async () => {
+    const { service, repo, notifications } = makeService();
+    await service.reject(10, { decisionNote: 'Already on order' }, approver);
+
+    expect(repo.updateIf).toHaveBeenCalledWith(
+      10,
+      expect.anything(),
+      expect.objectContaining({ status: 'rejected', decisionNote: 'Already on order' }),
+    );
+    expect(notifications.notify).toHaveBeenCalledWith(
+      expect.objectContaining({ type: NotificationType.BookRequestRejected, message: expect.stringContaining('Already on order') }),
+    );
+  });
+
+  it('refuses to reject anything that is not pending', async () => {
+    const { service } = makeService({ repo: { findById: vi.fn().mockResolvedValue(joined({ status: 'cancelled' })) } });
+    await expect(service.reject(10, {}, approver)).rejects.toThrow(BadRequestException);
+  });
+});
+
+/**
+ * Every refusal `submit` raises is a sentence this application wrote about a rule this instance
+ * applies, which makes it copy a translator has to be able to reach. Without a code the form can
+ * only repeat the English, and repeating the English in a toast is what these assert against.
+ */
+describe('BookRequestService.submit refusal codes', () => {
+  async function refusal(run: Promise<unknown>): Promise<{ errorCode?: string; errorMeta?: Record<string, unknown> }> {
+    await expect(run).rejects.toThrow(HttpException);
+    return run.then(
+      () => ({}),
+      (error: HttpException) => error.getResponse() as { errorCode?: string; errorMeta?: Record<string, unknown> },
+    );
+  }
+
+  const selfFulfiller = user({ permissions: [Permission.BookRequestAccess, Permission.BookRequestSelfFulfill] });
+
+  it('codes a blank title', async () => {
+    const { service } = makeService();
+    const body = await refusal(service.submit({ ...dto, title: '   ' }, user()));
+    expect(body.errorCode).toBe('SUBMIT_TITLE_REQUIRED');
+  });
+
+  it('codes self-fulfilment asked for without the permission', async () => {
+    const { service } = makeService();
+    const body = await refusal(service.submit({ ...dto, selfServe: true }, user()));
+    expect(body.errorCode).toBe('SUBMIT_SELF_FULFIL_FORBIDDEN');
+  });
+
+  it('codes a requester named by a caller who may not name one', async () => {
+    const { service } = makeService({ actingUser: user({ id: 42 }) });
+    const body = await refusal(service.submit({ ...dto, userId: 42 }, user()));
+    expect(body.errorCode).toBe('SUBMIT_ON_BEHALF_FORBIDDEN');
+  });
+
+  it('codes a requester that cannot be resolved', async () => {
+    const { service } = makeService({ actingUser: null });
+    const body = await refusal(service.submit({ ...dto, userId: 999 }, moderator()));
+    expect(body.errorCode).toBe('SUBMIT_ON_BEHALF_UNKNOWN_USER');
+  });
+
+  it('codes a destination library the caller cannot reach', async () => {
+    const { service, libraryService } = makeService();
+    libraryService.verifyUserAccess.mockRejectedValue(new ForbiddenException('No access to this library'));
+
+    const body = await refusal(service.submit({ ...dto, targetLibraryId: 9 }, user()));
+    expect(body.errorCode).toBe('SUBMIT_LIBRARY_FORBIDDEN');
+  });
+
+  it('codes a folder named with no library to sit in', async () => {
+    const { service } = makeService();
+    const body = await refusal(service.submit({ ...dto, targetFolderId: 4 }, user()));
+    expect(body.errorCode).toBe('SUBMIT_FOLDER_NEEDS_LIBRARY');
+  });
+
+  it('codes a folder belonging to some other library', async () => {
+    const { service } = makeService({ repo: { folderBelongsToLibrary: vi.fn().mockResolvedValue(false) } });
+    const body = await refusal(service.submit({ ...dto, targetLibraryId: 5, targetFolderId: 4 }, user()));
+    expect(body.errorCode).toBe('SUBMIT_FOLDER_NOT_IN_LIBRARY');
+  });
+
+  it('codes an instance default a self-server cannot reach', async () => {
+    const { service, libraryService } = makeService({
+      automationSettings: { resolveDestinationFor: vi.fn().mockResolvedValue({ libraryId: 9, folderId: null }) },
+    });
+    libraryService.findAccessibleLibraryIds.mockResolvedValue([1, 2]);
+
+    const body = await refusal(service.submit({ ...dto, selfServe: true }, selfFulfiller));
+    expect(body.errorCode).toBe('SUBMIT_DEFAULT_LIBRARY_UNREACHABLE');
+  });
+
+  it('codes a settled-on-create request with nowhere to file', async () => {
+    const { service } = makeService();
+    const autoApprover = user({ permissions: [Permission.BookRequestAccess, Permission.BookRequestAutoApprove] });
+
+    const body = await refusal(service.submit(dto, autoApprover));
+    expect(body.errorCode).toBe('SUBMIT_DESTINATION_REQUIRED');
+  });
+
+  /** The number is a message parameter rather than part of the code, so a translator can place it. */
+  it('codes a full self-serve cap and carries the limit', async () => {
+    const { service } = makeService({ repo: { createWithinSelfServeCap: vi.fn().mockResolvedValue(null) } });
+
+    const body = await refusal(service.submit({ ...dto, selfServe: true, targetLibraryId: 5 }, selfFulfiller));
+    expect(body.errorCode).toBe('SUBMIT_SELF_SERVE_LIMIT');
+    expect(body.errorMeta).toEqual({ limit: 10 });
+  });
+});
+
+describe('BookRequestService.markFulfilled', () => {
+  const approver = user({ permissions: [Permission.BookRequestAccess, Permission.ManageBookRequests] });
+
+  it.each(FULFILLABLE_BOOK_REQUEST_STATUSES)('allows an approver to close a %s request', async (status) => {
+    const { service, repo } = makeService({ repo: { findById: vi.fn().mockResolvedValue(joined({ status })) } });
+
+    await service.markFulfilled(10, { matchedBookId: 42 }, approver);
+
+    expect(repo.updateIf).toHaveBeenCalledWith(10, expect.anything(), expect.objectContaining({ status: 'available', matchedBookId: 42 }));
+  });
+
+  it('closes the request against a book and tells everyone attached', async () => {
+    const { service, repo, notifications } = makeService();
+    await service.markFulfilled(10, { matchedBookId: 42 }, approver);
+
+    expect(repo.updateIf).toHaveBeenCalledWith(10, expect.anything(), expect.objectContaining({ status: 'available', matchedBookId: 42 }));
+    expect(notifications.notify).toHaveBeenCalledWith(
+      // `/book/:bookId`, singular: the plural spelling is not a route and 404s from the notification.
+      expect.objectContaining({ type: NotificationType.BookRequestAvailable, actionUrl: '/book/42' }),
+    );
+  });
+
+  /**
+   * The approver has the book already, so a transfer still running is work nothing will use. It
+   * used to be left in the client with nothing in BookOrbit pointing at it: `failInFlightForRequest`
+   * settles the row, but nothing ever told the client to stop.
+   */
+  it('detaches a live transfer from its client, as cancelling and deleting do', async () => {
+    const { service, removal, downloads } = makeService({ repo: { findById: vi.fn().mockResolvedValue(joined({ status: 'downloading' })) } });
+
+    await service.markFulfilled(10, { matchedBookId: 42 }, approver);
+
+    expect(removal.removeLatestForRequest).toHaveBeenCalledWith(10, false, 'reader');
+    // Only the newest attempt is detached, so an older one still in flight is settled here.
+    expect(downloads.failInFlightForRequest).toHaveBeenCalledWith(10, expect.stringContaining('reader'));
+  });
+
+  it('records that a download client refused the detach rather than failing the fulfilment', async () => {
+    const { service, repo } = makeService({
+      repo: { findById: vi.fn().mockResolvedValue(joined({ status: 'downloading' })) },
+      removal: { removeLatestForRequest: vi.fn().mockResolvedValue({ removed: false, error: 'connection refused' }) },
+    });
+
+    await service.markFulfilled(10, { matchedBookId: 42 }, approver);
+
+    expect(repo.updateIf).toHaveBeenCalledWith(
+      10,
+      expect.anything(),
+      expect.objectContaining({ status: 'available', statusReason: expect.stringContaining('connection refused') }),
+    );
+  });
+
+  /** Every sibling transition stamps it, and without it who closed a hand-fulfilled request is lost. */
+  it('records who closed the request', async () => {
+    const { service, repo } = makeService();
+
+    await service.markFulfilled(10, { matchedBookId: 42 }, approver);
+
+    expect(repo.updateIf).toHaveBeenCalledWith(
+      10,
+      expect.anything(),
+      expect.objectContaining({ decidedByUserId: approver.id, decidedAt: expect.any(Date) }),
+    );
+  });
+
+  it('accepts a Book Dock file as the fulfilment instead', async () => {
+    const { service, repo } = makeService();
+    await service.markFulfilled(10, { bookDockFileId: 5 }, approver);
+    expect(repo.updateIf).toHaveBeenCalledWith(10, expect.anything(), expect.objectContaining({ status: 'available', bookDockFileId: 5 }));
+  });
+
+  it('requires something to point at', async () => {
+    const { service, repo } = makeService();
+    await expect(service.markFulfilled(10, {}, approver)).rejects.toThrow(BadRequestException);
+    expect(repo.updateIf).not.toHaveBeenCalled();
+  });
+
+  it('refuses a book id that no longer exists', async () => {
+    const { service, repo } = makeService({ repo: { bookExists: vi.fn().mockResolvedValue(false) } });
+    await expect(service.markFulfilled(10, { matchedBookId: 42 }, approver)).rejects.toThrow(BadRequestException);
+    expect(repo.updateIf).not.toHaveBeenCalled();
+  });
+
+  it('refuses a Book Dock file id that no longer exists', async () => {
+    const { service, repo } = makeService({ repo: { bookDockFileExists: vi.fn().mockResolvedValue(false) } });
+    await expect(service.markFulfilled(10, { bookDockFileId: 5 }, approver)).rejects.toThrow(BadRequestException);
+    expect(repo.updateIf).not.toHaveBeenCalled();
+  });
+
+  it('refuses to fulfil a rejected or cancelled request', async () => {
+    for (const status of ['rejected', 'cancelled']) {
+      const { service } = makeService({ repo: { findById: vi.fn().mockResolvedValue(joined({ status })) } });
+      await expect(service.markFulfilled(10, { matchedBookId: 42 }, approver)).rejects.toThrow(BadRequestException);
+    }
+  });
+
+  it('refuses to fulfil twice', async () => {
+    const { service } = makeService({ repo: { findById: vi.fn().mockResolvedValue(joined({ status: 'available' })) } });
+    await expect(service.markFulfilled(10, { matchedBookId: 42 }, approver)).rejects.toThrow(BadRequestException);
+  });
+
+  /**
+   * `ManageBookRequests` says an approver may close a request. It says nothing about which
+   * libraries they can read or whose dock items are theirs, and an unscoped id here writes a
+   * permanent reference to a resource they could never have opened.
+   */
+  it('looks the book up only within the libraries the approver can reach', async () => {
+    const { service, repo, libraryService } = makeService({ libraryService: { findAccessibleLibraryIds: vi.fn().mockResolvedValue([3, 4]) } });
+
+    await service.markFulfilled(10, { matchedBookId: 42 }, approver);
+
+    expect(repo.bookExists).toHaveBeenCalledExactlyOnceWith(42, [3, 4]);
+    expect(libraryService.findAccessibleLibraryIds).toHaveBeenCalled();
+  });
+
+  it('refuses a book in a library the approver cannot reach', async () => {
+    const { service, repo } = makeService({ repo: { bookExists: vi.fn().mockResolvedValue(false) } });
+
+    await expect(service.markFulfilled(10, { matchedBookId: 42 }, approver)).rejects.toThrow(BadRequestException);
+    expect(repo.updateIf).not.toHaveBeenCalled();
+  });
+
+  it('looks a superuser up across every library', async () => {
+    const { service, repo, libraryService } = makeService();
+
+    await service.markFulfilled(10, { matchedBookId: 42 }, user({ isSuperuser: true }));
+
+    expect(repo.bookExists).toHaveBeenCalledExactlyOnceWith(42, null);
+    expect(libraryService.findAccessibleLibraryIds).not.toHaveBeenCalled();
+  });
+
+  it('looks a dock file up only among the approver uploads without the dock permission', async () => {
+    const { service, repo } = makeService();
+
+    await service.markFulfilled(10, { bookDockFileId: 5 }, approver);
+
+    expect(repo.bookDockFileExists).toHaveBeenCalledExactlyOnceWith(5, approver.id);
+  });
+
+  it('looks a dock file up across the whole dock for somebody who manages it', async () => {
+    const { service, repo } = makeService();
+    const dockManager = user({ permissions: [Permission.BookRequestAccess, Permission.ManageBookRequests, Permission.ManageBookDock] });
+
+    await service.markFulfilled(10, { bookDockFileId: 5 }, dockManager);
+
+    expect(repo.bookDockFileExists).toHaveBeenCalledExactlyOnceWith(5, null);
+  });
+});
+
+/**
+ * The whole client model is "every page answers a broadcast with a fetch", so a transition that
+ * commits without one is invisible until something else happens to emit: a queue does not show a
+ * new submission, a requester never sees pending become approved, and a second moderator goes on
+ * looking at a row somebody already decided. With auto-grab off, approval has no downstream
+ * emitter either, so nothing else was ever going to cover for it.
+ */
+describe('BookRequestService change broadcasts', () => {
+  const approver = user({ permissions: [Permission.BookRequestAccess, Permission.ManageBookRequests] });
+
+  it('announces a new submission', async () => {
+    const { service, gateway } = makeService({ dedupe: { findActiveRequestFor: vi.fn().mockResolvedValue(null) } });
+
+    await service.submit(dto, user());
+
+    expect(gateway.emitChanged).toHaveBeenCalled();
+  });
+
+  it('announces an approval', async () => {
+    const { service, gateway } = makeService();
+
+    await service.approve(10, { targetLibraryId: 5 }, approver);
+
+    expect(gateway.emitChanged).toHaveBeenCalled();
+  });
+
+  it('announces a rejection', async () => {
+    const { service, gateway } = makeService();
+
+    await service.reject(10, { decisionNote: 'Already on order' }, approver);
+
+    expect(gateway.emitChanged).toHaveBeenCalled();
+  });
+
+  it('announces a request closed by hand', async () => {
+    const { service, gateway } = makeService({ repo: { bookExists: vi.fn().mockResolvedValue(true) } });
+
+    await service.markFulfilled(10, { matchedBookId: 4 }, approver);
+
+    expect(gateway.emitChanged).toHaveBeenCalled();
+  });
+
+  /** A transition that never committed is not one to announce; the loser of a race announces nothing. */
+  it('says nothing when the transition did not commit', async () => {
+    const { service, gateway } = makeService({ repo: { updateIf: vi.fn().mockResolvedValue(undefined) } });
+
+    await expect(service.approve(10, { targetLibraryId: 5 }, approver)).rejects.toThrow();
+
+    expect(gateway.emitChanged).not.toHaveBeenCalled();
+  });
+
+  it('announces a committed transition even when notification audience lookup fails afterwards', async () => {
+    const { service, gateway } = makeService({ repo: { findInterestedUserIds: vi.fn().mockRejectedValue(new Error('database unavailable')) } });
+
+    await expect(service.reject(10, {}, approver)).rejects.toThrow('database unavailable');
+
+    expect(gateway.emitChanged).toHaveBeenCalledTimes(1);
+  });
+
+  it('announces a hand fulfilment even when abandoning its live attempts fails afterwards', async () => {
+    const { service, gateway } = makeService({
+      repo: { bookExists: vi.fn().mockResolvedValue(true) },
+      downloads: { failInFlightForRequest: vi.fn().mockRejectedValue(new Error('database unavailable')) },
+    });
+
+    await expect(service.markFulfilled(10, { matchedBookId: 4 }, approver)).rejects.toThrow('database unavailable');
+
+    expect(gateway.emitChanged).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe('BookRequestService.listAll', () => {
+  it('refuses a caller without the manage permission', async () => {
+    const { service } = makeService();
+    await expect(service.listAll({}, user())).rejects.toThrow(ForbiddenException);
+  });
+
+  it('does not scope to the caller for an approver', async () => {
+    const { service, repo } = makeService();
+    await service.listAll({}, user({ permissions: [Permission.BookRequestAccess, Permission.ManageBookRequests] }));
+    expect(repo.findAll).toHaveBeenCalledWith(expect.not.objectContaining({ userId: expect.anything() }));
+  });
+
+  it('passes the exact requester filter to the repository', async () => {
+    const { service, repo } = makeService();
+    await service.listAll({ requesterUserId: 42 }, user({ permissions: [Permission.BookRequestAccess, Permission.ManageBookRequests] }));
+    expect(repo.findAll).toHaveBeenCalledWith(expect.objectContaining({ requesterUserId: 42 }));
+  });
+
+  it('returns the bounded requester options from the repository', async () => {
+    const options = [{ userId: 42, username: 'reader', name: 'Reader' }];
+    const { service, repo } = makeService({ repo: { findRequesterOptions: vi.fn().mockResolvedValue(options) } });
+
+    await expect(service.listRequesterOptions({})).resolves.toEqual(options);
+    expect(repo.findRequesterOptions).toHaveBeenCalledExactlyOnceWith(null);
+  });
+
+  it('passes a requester search through to the repository', async () => {
+    const { service, repo } = makeService();
+
+    await service.listRequesterOptions({ search: 'ada' });
+
+    expect(repo.findRequesterOptions).toHaveBeenCalledExactlyOnceWith('ada');
+  });
+});
+
+describe('BookRequestService.listMine', () => {
+  it('always scopes to the caller', async () => {
+    const { service, repo } = makeService();
+    await service.listMine({}, user({ permissions: [Permission.BookRequestAccess, Permission.ManageBookRequests] }));
+    expect(repo.findAll).toHaveBeenCalledWith(expect.objectContaining({ userId: 1 }));
+  });
+});
+
+describe('BookRequestService.getOne', () => {
+  it('lets the owner read their request', async () => {
+    const { service } = makeService();
+    await expect(service.getOne(10, user())).resolves.toMatchObject({ id: 10 });
+  });
+
+  it('lets a subscriber read it', async () => {
+    const { service } = makeService({
+      repo: { findById: vi.fn().mockResolvedValue(joined({ userId: 2 })), isSubscriber: vi.fn().mockResolvedValue(true) },
+    });
+    await expect(service.getOne(10, user())).resolves.toMatchObject({ id: 10 });
+  });
+
+  /** Whoever is driving the work can read it, without depending on the subscription that came with it. */
+  it('lets the fulfiller read a request somebody else asked for, unsubscribed', async () => {
+    const { service } = makeService({
+      repo: { findById: vi.fn().mockResolvedValue(joined({ userId: 2, fulfillerUserId: 1 })), isSubscriber: vi.fn().mockResolvedValue(false) },
+    });
+    const fulfiller = user({ permissions: [Permission.BookRequestAccess, Permission.BookRequestSelfFulfill] });
+
+    await expect(service.getOne(10, fulfiller)).resolves.toMatchObject({ id: 10 });
+  });
+
+  it('refuses a stranger', async () => {
+    const { service } = makeService({ repo: { findById: vi.fn().mockResolvedValue(joined({ userId: 2 })) } });
+    await expect(service.getOne(10, user())).rejects.toThrow(ForbiddenException);
+  });
+});
+
+/**
+ * Two moderators clicking at once, or one clicking while a background sweep is mid-flight. Every
+ * transition commits conditionally on the status it read, so exactly one of them lands; the loser
+ * is refused with the status the request is actually in rather than being told it succeeded.
+ */
+describe('BookRequestService lifecycle races', () => {
+  const approver = user({ permissions: [Permission.BookRequestAccess, Permission.ManageBookRequests] });
+
+  /** A reject that committed first: the approve must not announce, and must not start automation. */
+  it('refuses an approve that lost to a concurrent reject, and starts no automation', async () => {
+    const { service, repo, notifications, automation } = makeService({
+      repo: {
+        findById: vi
+          .fn()
+          .mockResolvedValueOnce(joined({ status: 'pending', targetLibraryId: 1 }))
+          .mockResolvedValue(joined({ status: 'rejected', targetLibraryId: 1 })),
+        updateIf: vi.fn().mockResolvedValue(undefined),
+      },
+    });
+
+    await expect(service.approve(10, {}, approver)).rejects.toMatchObject({
+      response: {
+        errorCode: 'BOOK_REQUEST_STALE_TRANSITION',
+        errorMeta: { action: 'approve', status: 'rejected' },
+      },
+    });
+
+    expect(repo.updateIf).toHaveBeenCalledTimes(1);
+    expect(notifications.notify).not.toHaveBeenCalled();
+    expect(automation.considerRequest).not.toHaveBeenCalled();
+  });
+
+  it('refuses a reject that lost to a concurrent approve, and tells nobody', async () => {
+    const { service, notifications } = makeService({
+      repo: {
+        findById: vi
+          .fn()
+          .mockResolvedValueOnce(joined({ status: 'pending' }))
+          .mockResolvedValue(joined({ status: 'approved' })),
+        updateIf: vi.fn().mockResolvedValue(undefined),
+      },
+    });
+
+    await expect(service.reject(10, {}, approver)).rejects.toMatchObject({
+      response: {
+        errorCode: 'BOOK_REQUEST_STALE_TRANSITION',
+        errorMeta: { action: 'reject', status: 'approved' },
+      },
+    });
+    expect(notifications.notify).not.toHaveBeenCalled();
+  });
+
+  /** The refusal names the status the request is in now, not the one the pre-read guard saw. */
+  it('refuses a cancel that lost to a concurrent approve and names the current status', async () => {
+    const { service } = makeService({
+      repo: {
+        findById: vi
+          .fn()
+          .mockResolvedValueOnce(joined({ status: 'pending' }))
+          .mockResolvedValue(joined({ status: 'available' })),
+        updateIf: vi.fn().mockResolvedValue(undefined),
+      },
+    });
+
+    await expect(service.cancel(10, user())).rejects.toMatchObject({
+      response: {
+        errorCode: 'BOOK_REQUEST_STALE_TRANSITION',
+        errorMeta: { action: 'cancel', status: 'available' },
+      },
+    });
+  });
+
+  it('refuses a fulfil that lost to a concurrent one rather than filing the book twice', async () => {
+    const { service, notifications } = makeService({
+      repo: {
+        findById: vi
+          .fn()
+          .mockResolvedValueOnce(joined({ status: 'downloading' }))
+          .mockResolvedValue(joined({ status: 'available' })),
+        updateIf: vi.fn().mockResolvedValue(undefined),
+      },
+    });
+
+    await expect(service.markFulfilled(10, { matchedBookId: 42 }, approver)).rejects.toThrow('This request is already fulfilled');
+    expect(notifications.notify).not.toHaveBeenCalled();
+  });
+
+  /**
+   * A manual fulfilment under a live transfer. The attempt is taken out of the in-flight set with
+   * the transition, or the poll loop would go on reporting progress for a request that is filed
+   * and would eventually import a second copy of the book.
+   */
+  it('abandons a live transfer when the request is fulfilled by hand', async () => {
+    const { service, downloads } = makeService({ repo: { findById: vi.fn().mockResolvedValue(joined({ status: 'downloading' })) } });
+
+    await service.markFulfilled(10, { matchedBookId: 42 }, approver);
+
+    expect(downloads.failInFlightForRequest).toHaveBeenCalledWith(10, expect.stringContaining('reader'));
+  });
+
+  it('does not touch the transfer when the fulfil lost its race', async () => {
+    const { service, downloads } = makeService({
+      repo: {
+        findById: vi
+          .fn()
+          .mockResolvedValueOnce(joined({ status: 'downloading' }))
+          .mockResolvedValue(joined({ status: 'cancelled' })),
+        updateIf: vi.fn().mockResolvedValue(undefined),
+      },
+    });
+
+    await expect(service.markFulfilled(10, { matchedBookId: 42 }, approver)).rejects.toThrow(BadRequestException);
+    expect(downloads.failInFlightForRequest).not.toHaveBeenCalled();
+  });
+
+  it('refuses to hide a request a retry re-grabbed between the check and the write', async () => {
+    const { service } = makeService({
+      repo: {
+        findById: vi
+          .fn()
+          .mockResolvedValueOnce(joined({ status: 'failed' }))
+          .mockResolvedValue(joined({ status: 'grabbed' })),
+        dismissIf: vi.fn().mockResolvedValue(false),
+      },
+    });
+
+    await expect(service.dismiss(10, user())).rejects.toThrow('A request that is grabbed is still being worked on; cancel it instead');
+  });
+
+  it('refuses to delete a request a retry re-grabbed between the check and the write', async () => {
+    const { service } = makeService({
+      repo: {
+        findById: vi
+          .fn()
+          .mockResolvedValueOnce(joined({ status: 'failed' }))
+          .mockResolvedValue(joined({ status: 'grabbed' })),
+        remove: vi.fn().mockResolvedValue(false),
+      },
+    });
+
+    await expect(service.remove(10, approver)).rejects.toThrow('A request that is grabbed is still being worked on; cancel it before deleting it');
+  });
+});
+
+describe('BookRequestService.checkAvailability', () => {
+  it('passes null library scope for a superuser so nothing is hidden', async () => {
+    const { service, dedupe } = makeService();
+    await service.checkAvailability([], user({ isSuperuser: true }));
+    expect(dedupe.checkAvailability).toHaveBeenCalledWith([], 1, null);
+  });
+
+  it('scopes an ordinary user to their accessible libraries', async () => {
+    const { service, dedupe } = makeService();
+    await service.checkAvailability([], user());
+    expect(dedupe.checkAvailability).toHaveBeenCalledWith([], 1, [1]);
+  });
+});
+
+describe('BookRequestService.getSummary', () => {
+  it('leaves the approver counts at zero for a plain requester', async () => {
+    const countForUser = vi.fn().mockResolvedValueOnce(4).mockResolvedValueOnce(9);
+    const { service, repo } = makeService({ repo: { countForUser } });
+    await expect(service.getSummary(user())).resolves.toEqual({ pending: 0, active: 0, mine: 4, mineTotal: 9, allTotal: 0 });
+    expect(countForUser).toHaveBeenNthCalledWith(2, 1, [], true);
+    expect(repo.countByStatuses).not.toHaveBeenCalled();
+  });
+
+  it('counts the queue for an approver', async () => {
+    const countByStatuses = vi.fn().mockResolvedValueOnce(3).mockResolvedValueOnce(5).mockResolvedValueOnce(12);
+    const countForUser = vi.fn().mockResolvedValueOnce(1).mockResolvedValueOnce(4);
+    const { service } = makeService({ repo: { countByStatuses, countForUser } });
+    await expect(service.getSummary(user({ permissions: [Permission.BookRequestAccess, Permission.ManageBookRequests] }))).resolves.toEqual({
+      pending: 3,
+      active: 5,
+      mine: 1,
+      mineTotal: 4,
+      allTotal: 12,
+    });
+    expect(countByStatuses).toHaveBeenNthCalledWith(3, [], 1);
+  });
+
+  /**
+   * Five counts, two of them over a subquery, asked again by every connected page every time the
+   * pipeline broadcasts a change. Keyed on the broadcast rather than a clock, so what comes back is
+   * never older than the change that prompted the ask.
+   */
+  describe('the read behind it', () => {
+    it('answers repeat asks between two changes from a single read', async () => {
+      const countForUser = vi.fn().mockResolvedValue(4);
+      const { service } = makeService({ repo: { countForUser } });
+
+      await service.getSummary(user());
+      await service.getSummary(user());
+
+      // `mine` and `mineTotal`, from one load rather than two.
+      expect(countForUser).toHaveBeenCalledTimes(2);
+    });
+
+    it('reads again once something has changed', async () => {
+      const countForUser = vi.fn().mockResolvedValue(4);
+      const { service, gateway } = makeService({ repo: { countForUser } });
+
+      await service.getSummary(user());
+      gateway.emitChanged();
+      await service.getSummary(user());
+
+      expect(countForUser).toHaveBeenCalledTimes(4);
+    });
+
+    it("never hands one person another person's counts", async () => {
+      const countForUser = vi.fn().mockResolvedValueOnce(4).mockResolvedValueOnce(9).mockResolvedValueOnce(1).mockResolvedValueOnce(2);
+      const { service } = makeService({ repo: { countForUser } });
+
+      await expect(service.getSummary(user({ id: 1 }))).resolves.toMatchObject({ mine: 4, mineTotal: 9 });
+      await expect(service.getSummary(user({ id: 2 }))).resolves.toMatchObject({ mine: 1, mineTotal: 2 });
+    });
+  });
+});
+
+describe('BookRequestService.approveMany', () => {
+  const approver = () => user({ id: 2, permissions: [Permission.BookRequestAccess, Permission.ManageBookRequests] });
+
+  it('approves every id and hands each one to automation', async () => {
+    const { service, repo, automation } = makeService({
+      repo: { findById: vi.fn().mockResolvedValue(joined({ status: 'pending', targetLibraryId: 1 })) },
+    });
+
+    const result = await service.approveMany({ ids: [10, 11] }, approver());
+
+    expect(result.updated).toHaveLength(2);
+    expect(result.failed).toEqual([]);
+    expect(automation.considerRequest).toHaveBeenCalledTimes(2);
+    expect(repo.updateIf).toHaveBeenCalledTimes(2);
+  });
+
+  it('reports the rows it could not approve by name instead of failing the whole batch', async () => {
+    const { service } = makeService({
+      repo: {
+        findById: vi
+          .fn()
+          .mockImplementation((id: number) =>
+            Promise.resolve(
+              id === 11 ? joined({ id: 11, status: 'available', title: 'Watchers' }) : joined({ status: 'pending', targetLibraryId: 1 }),
+            ),
+          ),
+      },
+    });
+
+    const result = await service.approveMany({ ids: [10, 11, 12] }, approver());
+
+    expect(result.updated).toHaveLength(2);
+    expect(result.failed).toEqual([
+      {
+        id: 11,
+        title: 'Watchers',
+        reason: 'Only a pending request can be approved; this one is available',
+        errorCode: 'BOOK_REQUEST_NOT_PENDING',
+        errorMeta: { action: 'approve', status: 'available' },
+      },
+    ]);
+  });
+
+  it('collapses a repeated id so one row cannot be approved twice in a batch', async () => {
+    const { service, repo } = makeService({
+      repo: { findById: vi.fn().mockResolvedValue(joined({ status: 'pending', targetLibraryId: 1 })) },
+    });
+
+    const result = await service.approveMany({ ids: [10, 10, 10] }, approver());
+
+    expect(result.updated).toHaveLength(1);
+    expect(repo.updateIf).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe('BookRequestService.dismissMany', () => {
+  it('hides every settled row and names the ones still being worked on', async () => {
+    const { service, repo } = makeService({
+      repo: {
+        findById: vi
+          .fn()
+          .mockImplementation((id: number) =>
+            Promise.resolve(id === 11 ? joined({ id: 11, status: 'downloading', title: 'Whistler' }) : joined({ status: 'available' })),
+          ),
+      },
+    });
+
+    const result = await service.dismissMany({ ids: [10, 11] }, user());
+
+    expect(result.updated).toHaveLength(1);
+    expect(repo.dismissIf).toHaveBeenCalledTimes(1);
+    expect(result.failed).toEqual([
+      {
+        id: 11,
+        title: 'Whistler',
+        reason: 'A request that is downloading is still being worked on; cancel it instead',
+        errorCode: null,
+        errorMeta: null,
+      },
+    ]);
+  });
+});
+
+/**
+ * The request form has to say where an unpicked request lands, or the requester submits into an
+ * empty select with no idea what happens next.
+ */
+describe('BookRequestService.getDefaultDestinations', () => {
+  it('names the library each medium would land in', async () => {
+    const { service } = makeService({
+      automationSettings: {
+        resolveDestinationFor: vi.fn((mediaKind: string) =>
+          Promise.resolve(mediaKind === 'audiobook' ? { libraryId: 7, folderId: 21 } : { libraryId: null, folderId: null }),
+        ),
+      },
+    });
+
+    await expect(service.getDefaultDestinations()).resolves.toEqual({
+      ebook: { libraryId: null, libraryName: null, folderId: null },
+      audiobook: { libraryId: 7, libraryName: 'Audiobooks', folderId: 21 },
+      comic: { libraryId: null, libraryName: null, folderId: null },
+    });
+  });
+
+  it('reports nothing for a medium with no default', async () => {
+    const { service, repo } = makeService();
+
+    await expect(service.getDefaultDestinations()).resolves.toMatchObject({
+      ebook: { libraryId: null, libraryName: null, folderId: null },
+    });
+    expect(repo.findLibraryNames).toHaveBeenCalledWith([]);
+  });
+
+  /** One query for all three, not one per medium. */
+  it('looks the names up in a single round trip', async () => {
+    const { service, repo } = makeService({
+      automationSettings: { resolveDestinationFor: vi.fn().mockResolvedValue({ libraryId: 7, folderId: 21 }) },
+    });
+
+    await service.getDefaultDestinations();
+
+    expect(repo.findLibraryNames).toHaveBeenCalledTimes(1);
+    expect(repo.findLibraryNames).toHaveBeenCalledWith([7, 7, 7]);
+  });
+
+  /**
+   * The setting is not rewritten when a library is deleted, so a name can come back missing. The
+   * destination is still reported: the id is what the server will actually use.
+   */
+  it('reports a destination whose library name could not be read', async () => {
+    const { service } = makeService({
+      repo: { findLibraryNames: vi.fn().mockResolvedValue(new Map()) },
+      automationSettings: { resolveDestinationFor: vi.fn().mockResolvedValue({ libraryId: 7, folderId: 21 }) },
+    });
+
+    await expect(service.getDefaultDestinations()).resolves.toMatchObject({
+      ebook: { libraryId: 7, libraryName: null, folderId: 21 },
+    });
+  });
+});
+
+describe('BookRequestService.assertCanFulfil', () => {
+  const owner = () => user({ id: 1, permissions: [Permission.BookRequestAccess, Permission.BookRequestSelfFulfill] });
+
+  it('lets a moderator fulfil a request that is not theirs', async () => {
+    const { service, repo } = makeService();
+    repo.findById.mockResolvedValue(joined({ userId: 99 }));
+
+    await expect(
+      service.assertCanFulfil(10, user({ id: 2, permissions: [Permission.BookRequestAccess, Permission.ManageBookRequests] })),
+    ).resolves.toBeDefined();
+  });
+
+  it('lets a self-server fulfil their own', async () => {
+    const { service, repo } = makeService();
+    repo.findById.mockResolvedValue(joined({ userId: 1 }));
+
+    await expect(service.assertCanFulfil(10, owner())).resolves.toBeDefined();
+  });
+
+  /** The permission is about fulfilling your own work, not about reaching into somebody else's. */
+  it('refuses a self-server on a request somebody else owns', async () => {
+    const { service, repo } = makeService();
+    repo.findById.mockResolvedValue(joined({ userId: 99 }));
+
+    await expect(service.assertCanFulfil(10, owner())).rejects.toThrow(ForbiddenException);
+  });
+
+  it('refuses an ordinary requester on their own request', async () => {
+    const { service, repo } = makeService();
+    repo.findById.mockResolvedValue(joined({ userId: 1 }));
+
+    await expect(service.assertCanFulfil(10, user())).rejects.toThrow(ForbiddenException);
+  });
+
+  /** A collision hands the row to somebody who is not its requester; the column is what records it. */
+  it('lets the self-server who took a request on fulfil it, though it names another requester', async () => {
+    const { service, repo } = makeService();
+    repo.findById.mockResolvedValue(joined({ userId: 99, selfServe: true, fulfillerUserId: 1 }));
+
+    await expect(service.assertCanFulfil(10, owner())).resolves.toBeDefined();
+  });
+
+  /** And the requester it was taken off is no longer the one driving it. */
+  it('refuses the original requester once somebody else has taken their request on', async () => {
+    const { service, repo } = makeService();
+    repo.findById.mockResolvedValue(joined({ userId: 1, selfServe: true, fulfillerUserId: 99 }));
+
+    await expect(service.assertCanFulfil(10, owner())).rejects.toThrow(ForbiddenException);
+  });
+
+  it('404s a request that is not there rather than reporting it as forbidden', async () => {
+    const { service, repo } = makeService();
+    repo.findById.mockResolvedValue(undefined);
+
+    await expect(service.assertCanFulfil(10, owner())).rejects.toThrow(NotFoundException);
+  });
+});
diff --git a/server/src/modules/book-request/book-request.service.ts b/server/src/modules/book-request/book-request.service.ts
new file mode 100644
index 000000000..81daa6543
--- /dev/null
+++ b/server/src/modules/book-request/book-request.service.ts
@@ -0,0 +1,1141 @@
+import { BadRequestException, ForbiddenException, HttpException, HttpStatus, Injectable, Logger, NotFoundException } from '@nestjs/common';
+import {
+  ACTIVE_BOOK_REQUEST_DOWNLOAD_STATUSES,
+  ACTIVE_BOOK_REQUEST_STATUSES,
+  BOOK_REQUEST_ACTION_ERROR_CODES,
+  BOOK_REQUEST_MEDIA_KINDS,
+  BOOK_REQUEST_STATUSES,
+  BOOK_REQUEST_SUBMIT_ERROR_CODES,
+  CANCELLABLE_BOOK_REQUEST_STATUSES,
+  emptyResolvedRequestDestinations,
+  FULFILLABLE_BOOK_REQUEST_STATUSES,
+  isBookRequestFulfiller,
+  isCancellableBookRequestStatus,
+  isFulfillableBookRequestStatus,
+  isSettledBookRequestStatus,
+  NotificationType,
+  Permission,
+  REQUEST_LANGUAGE_CODES,
+  SETTLED_BOOK_REQUEST_STATUSES,
+  toRequestLanguage,
+} from '@bookorbit/types';
+import type {
+  BookRequestAvailability,
+  BookRequestAvailabilityQuery,
+  BookRequestActionErrorCode,
+  BookRequestFailureMeta,
+  BookRequestSubmitErrorCode,
+  BookRequestItem,
+  BookRequestMetadataSource,
+  BookRequestPage,
+  BookRequestRequesterOption,
+  BookRequestStatus,
+  BookRequestSubmitResult,
+  BookRequestBulkFailure,
+  BookRequestBulkResult,
+  BookRequestSourceStatus,
+  BookRequestSummary,
+  ResolvedRequestDestinations,
+} from '@bookorbit/types';
+
+import { StatsCache } from '../../common/cache/stats-cache';
+import { isUniqueViolation } from '../../common/utils/db-error.utils';
+import { sanitizeLogValue } from '../../common/utils/log-sanitize.utils';
+import type { RequestUser } from '../../common/types/request-user';
+import type { BookRequestRow } from '../../db/schema';
+import { LibraryService } from '../library/library.service';
+import { BookRequestAttributionService } from './book-request-attribution.service';
+import { BookRequestDedupeService, dedupeKeyCandidates, primaryDedupeKey } from './book-request-dedupe.service';
+import { BookRequestGateway } from './book-request.gateway';
+import { BookRequestNotifier } from './book-request-notifier.service';
+import { mapBookRequestRow } from './book-request.mapper';
+import { BookRequestDownloadRepository } from './fulfillment/book-request-download.repository';
+import { DownloadRemovalService } from './fulfillment/download-removal.service';
+import { BookRequestRepository, type BookRequestJoinedRow } from './book-request.repository';
+import { RequestAutomationService } from './fulfillment/request-automation.service';
+import { RequestAutomationSettingsService } from './fulfillment/request-automation-settings.service';
+import { IndexerConfigService } from './indexers/indexer-config.service';
+import type { CreateBookRequestDto } from './dto/create-book-request.dto';
+import type { DecideBookRequestDto } from './dto/decide-book-request.dto';
+import type { FulfillBookRequestDto } from './dto/fulfill-book-request.dto';
+import type { BulkBookRequestsDto, BulkRejectBookRequestsDto } from './dto/bulk-book-requests.dto';
+import type { ListAllBookRequestsDto, ListBookRequestsDto } from './dto/list-book-requests.dto';
+import type { ListRequesterOptionsDto } from './dto/list-requester-options.dto';
+
+/**
+ * Statuses that still count as open work in the approver queue, which is exactly the set that
+ * holds a claim on the work. Aliased rather than restated so the two cannot drift apart.
+ */
+const OPEN_STATUSES = ACTIVE_BOOK_REQUEST_STATUSES;
+
+/**
+ * The summary is five counts, two of them over a subquery, and every connected page asks for it
+ * again on every change broadcast. Keyed on the gateway's change version, so a busy pipeline costs
+ * one read per change rather than one per connected page, and the answer is never older than the
+ * last change. The window is only what bounds a count that moved without a broadcast.
+ */
+const SUMMARY_CACHE_TTL_MS = 5_000;
+const SUMMARY_CACHE_MAX_ENTRIES = 200;
+
+/**
+ * Everything but `available`: once the book is filed, the language already decided what was
+ * imported, and changing it now would describe the request as having asked for something it did
+ * not get.
+ */
+const LANGUAGE_EDITABLE_STATUSES: readonly BookRequestStatus[] = BOOK_REQUEST_STATUSES.filter((status) => status !== 'available');
+
+/**
+ * How many times a submission will re-attempt its insert. Two, because the only reason a retry
+ * helps is a dedupe winner that disappeared in the same instant it was found, and a second
+ * disappearance is a caller looping against a queue that is being emptied faster than it fills.
+ */
+const SUBMIT_INSERT_ATTEMPTS = 2;
+
+/** The one status approve and reject may be reached from. */
+const PENDING_ONLY: readonly BookRequestStatus[] = ['pending'];
+
+/** Request states that can own a transfer which is still downloading bytes. */
+const ACTIVE_TRANSFER_REQUEST_STATUSES: readonly BookRequestStatus[] = ['grabbed', 'downloading'];
+
+/**
+ * How many self-serve requests one person may have in flight at once.
+ *
+ * Every live row is a release search that hits every enabled tracker, and an unbounded number of
+ * them is how one account gets an instance banned. Generous enough that queueing an evening's
+ * reading never touches it.
+ */
+const MAX_LIVE_SELF_SERVE_REQUESTS = 10;
+
+/**
+ * The statuses an existing request can be taken over from: nobody has decided on it, and nobody
+ * has grabbed anything for it. Anything further along is work somebody is already driving, and a
+ * self-fulfiller who collides with it is genuinely a subscriber.
+ */
+const CLAIMABLE_STATUSES: readonly BookRequestStatus[] = ['pending', 'approved'];
+
+/**
+ * A refusal the request form can say back in the reader's own language.
+ *
+ * Every sentence below is copy this application wrote about a rule this instance applies, so
+ * handing the client the English and nothing else is handing it something it cannot translate.
+ * The message stays as the fallback for a client that does not know the code yet, exactly as it
+ * does for a grab; the code is what the form renders.
+ */
+function submitRefusal(errorCode: BookRequestSubmitErrorCode, message: string, errorMeta?: BookRequestFailureMeta): BadRequestException {
+  return new BadRequestException({ message, errorCode, ...(errorMeta ? { errorMeta } : {}), statusCode: HttpStatus.BAD_REQUEST });
+}
+
+/** The same, for the refusals that are about what this person may do rather than what they sent. */
+function submitForbidden(errorCode: BookRequestSubmitErrorCode, message: string, errorMeta?: BookRequestFailureMeta): ForbiddenException {
+  return new ForbiddenException({ message, errorCode, ...(errorMeta ? { errorMeta } : {}), statusCode: HttpStatus.FORBIDDEN });
+}
+
+function actionRefusal(errorCode: BookRequestActionErrorCode, message: string, errorMeta?: BookRequestFailureMeta): BadRequestException {
+  return new BadRequestException({ message, errorCode, ...(errorMeta ? { errorMeta } : {}), statusCode: HttpStatus.BAD_REQUEST });
+}
+
+function actionForbidden(errorCode: BookRequestActionErrorCode, message: string, errorMeta?: BookRequestFailureMeta): ForbiddenException {
+  return new ForbiddenException({ message, errorCode, ...(errorMeta ? { errorMeta } : {}), statusCode: HttpStatus.FORBIDDEN });
+}
+
+function normalizeMetadataSources(sources: CreateBookRequestDto['metadataSources']): BookRequestMetadataSource[] {
+  const seen = new Set<string>();
+  const normalized: BookRequestMetadataSource[] = [];
+  for (const source of sources ?? []) {
+    const providerKey = source.providerKey.trim();
+    const providerId = source.providerId.trim();
+    if (!providerKey || !providerId) continue;
+    const key = `${providerKey}\u0000${providerId}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    normalized.push({
+      providerKey,
+      providerId,
+      providerLabel: source.providerLabel.trim() || providerKey,
+      isbn10: source.isbn10?.trim() || null,
+      isbn13: source.isbn13?.trim() || null,
+    });
+  }
+  return normalized;
+}
+
+@Injectable()
+export class BookRequestService {
+  private readonly logger = new Logger(BookRequestService.name);
+  private readonly summaryCache = new StatsCache({ ttlMs: SUMMARY_CACHE_TTL_MS, maxEntries: SUMMARY_CACHE_MAX_ENTRIES });
+
+  constructor(
+    private readonly repo: BookRequestRepository,
+    private readonly dedupe: BookRequestDedupeService,
+    private readonly libraryService: LibraryService,
+    private readonly notifier: BookRequestNotifier,
+    private readonly downloads: BookRequestDownloadRepository,
+    private readonly automation: RequestAutomationService,
+    private readonly automationSettings: RequestAutomationSettingsService,
+    private readonly removal: DownloadRemovalService,
+    private readonly gateway: BookRequestGateway,
+    private readonly attribution: BookRequestAttributionService,
+    private readonly indexers: IndexerConfigService,
+  ) {}
+
+  canManageAll(user: RequestUser): boolean {
+    return user.isSuperuser || user.permissions.includes(Permission.ManageBookRequests);
+  }
+
+  private canAutoApprove(user: RequestUser): boolean {
+    return user.isSuperuser || user.permissions.includes(Permission.BookRequestAutoApprove);
+  }
+
+  canSelfFulfil(user: RequestUser): boolean {
+    return user.isSuperuser || user.permissions.includes(Permission.BookRequestSelfFulfill);
+  }
+
+  /**
+   * The libraries a reference may point into, or null for somebody who reaches all of them.
+   *
+   * Null rather than the full list of ids so the query stays a plain lookup for a superuser on an
+   * instance with hundreds of libraries.
+   */
+  private async reachableLibraryIds(user: RequestUser): Promise<number[] | null> {
+    return user.isSuperuser ? null : this.libraryService.findAccessibleLibraryIds(user);
+  }
+
+  /**
+   * Whose dock items a reference may point at: null for somebody who manages the whole dock, and
+   * the caller's own id for everybody else. The same rule the Book Dock applies to itself, read
+   * from the same permission, so an approver cannot reach a file through a request that the dock
+   * would not have shown them.
+   */
+  private dockUploaderScope(user: RequestUser): number | null {
+    return user.isSuperuser || user.permissions.includes(Permission.ManageBookDock) ? null : user.id;
+  }
+
+  /**
+   * Who may drive fulfilment on one request: a moderator on any of them, or the self-server whose
+   * request it is to drive.
+   *
+   * Usually that is the requester, because a self-serve row is created by the person about to
+   * fulfil it. It is not always: one live request per work, so a self-fulfiller whose submission
+   * collides with somebody else's undriven request takes that row on instead of opening a second,
+   * and `fulfillerUserId` is what records that it is now theirs to drive.
+   */
+  async assertCanFulfil(requestId: number, user: RequestUser): Promise<BookRequestJoinedRow> {
+    const joined = await this.repo.findById(requestId);
+    if (!joined) throw new NotFoundException('Book request not found');
+    if (this.canManageAll(user)) return joined;
+    if (this.canSelfFulfil(user) && isBookRequestFulfiller(joined.request, user.id)) return joined;
+    throw new ForbiddenException('You cannot fulfil this book request');
+  }
+
+  async submit(dto: CreateBookRequestDto, actor: RequestUser): Promise<BookRequestSubmitResult> {
+    // Who this request is *for*, which is the caller unless an integration named somebody else.
+    // Everything below asks about the subject and never about the actor: their permissions, their
+    // libraries, their cap, their notifications. The actor stays the actor in the audit log.
+    const subject = await this.attribution.resolveSubject(actor, dto.userId);
+
+    const metadataSources = normalizeMetadataSources(dto.metadataSources);
+    const work = {
+      title: dto.title.trim(),
+      authors: dto.authors ?? [],
+      isbn13: dto.isbn13 ?? null,
+      providerKey: dto.providerKey ?? null,
+      providerId: dto.providerId ?? null,
+      metadataSources,
+      mediaKind: dto.mediaKind,
+    };
+
+    if (!work.title) throw submitRefusal('SUBMIT_TITLE_REQUIRED', 'A title is required');
+
+    // Explicit rather than inferred from the permission. Inferring it would silently turn
+    // `BookRequestSelfFulfill` into auto-approval for every ordinary request its holder makes.
+    const selfServe = dto.selfServe === true;
+    if (selfServe && !this.canSelfFulfil(subject)) {
+      throw submitForbidden('SUBMIT_SELF_FULFIL_FORBIDDEN', 'You cannot fulfil your own book requests');
+    }
+
+    // Fold into an existing live request rather than opening a second one. A second grab of the
+    // same torrent is exactly what the dedupe claim exists to prevent, so even a self-server is
+    // folded - but folded as the person who is going to fulfil it, not as a bystander.
+    const existing = await this.dedupe.findActiveRequestFor(work);
+    if (existing) return selfServe ? this.takeOnOrAttach(existing, subject) : this.attachTo(existing.id, subject);
+
+    const maySeeRequestedBooks = subject.contentFilters.exemptRequestsFromUserId === subject.id;
+    const existingBookId = maySeeRequestedBooks ? await this.dedupe.findOwnedBookFor(work, await this.reachableLibraryIds(subject)) : null;
+
+    let targetLibraryId: number | null = null;
+    let targetFolderId: number | null = null;
+
+    if (existingBookId === null) {
+      targetLibraryId = await this.resolveRequestedLibrary(dto.targetLibraryId ?? null, subject);
+      targetFolderId = await this.resolveDestinationFolder(dto.targetFolderId ?? null, targetLibraryId);
+
+      // The instance default for this medium, which is the last rung: the requester named nowhere,
+      // and the medium is the only thing about the eventual file that is known this early.
+      //
+      // Not checked against what this user can reach, unlike a library they named themselves. The
+      // operator chose it for the whole instance, and a requester who cannot see that library is
+      // exactly who the default exists for.
+      if (targetLibraryId === null) {
+        const fallback = await this.automationSettings.resolveDestinationFor(dto.mediaKind);
+
+        // The one exception to "the operator chose it for the instance". A self-server is the person
+        // filing the book, with nobody reviewing where it lands, so an unreachable default would let
+        // them write into a library they cannot even read. They are asked to name one instead.
+        if (selfServe && fallback.libraryId !== null) {
+          const reachable = await this.libraryService.findAccessibleLibraryIds(subject);
+          if (!reachable.includes(fallback.libraryId)) {
+            throw submitRefusal(
+              'SUBMIT_DEFAULT_LIBRARY_UNREACHABLE',
+              'Pick a destination library you can reach: the instance default for this medium is not one of yours',
+            );
+          }
+        }
+
+        targetLibraryId = fallback.libraryId;
+        targetFolderId = fallback.folderId;
+      }
+    }
+
+    const autoApproved = this.canAutoApprove(subject);
+    const availableOnCreate = existingBookId !== null;
+    // A self-serve request is approved by construction: its requester is the person about to fulfil
+    // it, so there is no decision left to make and nothing for an approver to see.
+    const approvedOnCreate = autoApproved || selfServe;
+    const settledOnCreate = availableOnCreate || approvedOnCreate;
+
+    // Nobody decides on this request after it is made, so there is no later point where a
+    // destination could be picked, and fulfilment refuses a request that has none.
+    if (!availableOnCreate && settledOnCreate && targetLibraryId === null) {
+      throw submitRefusal('SUBMIT_DESTINATION_REQUIRED', 'Pick a destination library: your own requests are approved without a second pair of eyes');
+    }
+
+    const insert = {
+      userId: subject.id,
+      createdByUserId: this.attribution.createdByUserIdFor(actor, subject),
+      mediaKind: dto.mediaKind,
+      status: availableOnCreate ? ('available' as const) : approvedOnCreate ? ('approved' as const) : ('pending' as const),
+      selfServe,
+      title: work.title,
+      subtitle: dto.subtitle ?? null,
+      authors: work.authors,
+      seriesName: dto.seriesName ?? null,
+      seriesIndex: dto.seriesIndex ?? null,
+      isbn10: dto.isbn10 ?? null,
+      isbn13: dto.isbn13 ?? null,
+      publishedYear: dto.publishedYear ?? null,
+      // Normalised on the way in, because providers state it every which way: "spa", "English",
+      // or nothing at all. The matcher compares codes, so anything else is a filter that either
+      // rejects everything or agrees by accident.
+      language: toRequestLanguage(dto.language),
+      coverUrl: dto.coverUrl ?? null,
+      providerKey: dto.providerKey ?? null,
+      providerId: dto.providerId ?? null,
+      metadataSources,
+      preferredFormats: dto.preferredFormats ?? [],
+      note: dto.note ?? null,
+      targetLibraryId,
+      targetFolderId,
+      matchedBookId: existingBookId,
+      dedupeKey: primaryDedupeKey(work),
+      decidedByUserId: approvedOnCreate ? subject.id : null,
+      decidedAt: approvedOnCreate ? new Date() : null,
+    };
+    // Every other key this work could have hashed to, so a later requester who reaches it a
+    // different way still collides with this row rather than opening a second one.
+    const aliasKeys = dedupeKeyCandidates(work);
+
+    let row: BookRequestRow | undefined;
+    // Two people hitting Request on the same book at once: the loser of the insert race is folded
+    // into the winner rather than shown a 500. The winner can be gone by the time we look for it -
+    // cancelled, rejected or deleted in that same instant - and then the claim it held is free
+    // again, so the insert that just lost would now succeed. One retry is the whole difference
+    // between that submission going through and a requester being told a book they can have does
+    // not exist.
+    for (let attempt = 0; row === undefined; attempt++) {
+      const lastAttempt = attempt >= SUBMIT_INSERT_ATTEMPTS - 1;
+      try {
+        row = await this.createRequest(selfServe && !availableOnCreate, insert, aliasKeys);
+      } catch (error: unknown) {
+        if (!isUniqueViolation(error)) throw error;
+        const winner = await this.dedupe.findActiveRequestFor(work);
+        if (!winner) {
+          if (lastAttempt) throw error;
+          continue;
+        }
+        try {
+          return selfServe ? await this.takeOnOrAttach(winner, subject) : await this.attachTo(winner.id, subject);
+        } catch (joinError: unknown) {
+          // The winner was deleted between finding it and reading it back. Same recovery.
+          if (!(joinError instanceof NotFoundException)) throw joinError;
+          if (lastAttempt) throw error;
+        }
+      }
+    }
+
+    this.logger.log(
+      `[book_request.create] [end] requestId=${row.id} userId=${row.userId} createdByUserId=${row.createdByUserId ?? '-'} mediaKind=${row.mediaKind} autoApproved=${autoApproved} selfServe=${selfServe} availableOnCreate=${availableOnCreate} title="${sanitizeLogValue(row.title)}" - book request created`,
+    );
+
+    // An auto-approving user never waits for a decision, so there is nobody to open the picker:
+    // if automation is on, this is the point their request goes looking for a release. The trigger
+    // says so, because a request nobody decided on is also a request nobody is watching, and
+    // automation has to announce it if it gives up.
+    //
+    // Never for a self-server, who is on their way to the picker right now. Automation would race
+    // them onto a release they did not choose, which is the opposite of what they asked for.
+    if (!availableOnCreate && autoApproved && !selfServe) this.automation.considerRequest(row.id, 'auto_approval');
+
+    // Every page answers this with a fetch, so it is what puts a new submission in front of the
+    // approvers without them reloading. After the create rather than after the notification: an
+    // approver whose queue is already open sees the row arrive whether or not they are notified.
+    this.gateway.emitChanged();
+
+    if (!settledOnCreate) {
+      await this.notifier.notifyApprovers(NotificationType.BookRequestSubmitted, {
+        title: 'New book request',
+        message: `${subject.name} requested "${row.title}"`,
+        actionUrl: '/requests?tab=all',
+        meta: { requestId: row.id },
+      });
+    }
+
+    const joined = await this.repo.findById(row.id);
+    if (!joined) throw new NotFoundException('Book request not found');
+    return { request: await this.toItem(joined, subject.id), subscribed: false };
+  }
+
+  /**
+   * The insert, with the self-serve cap enforced across it.
+   *
+   * A self-server holds no place in the moderation queue, so what is bounded instead is work in
+   * flight: a cap on how many downloads one person can have open at once, which is what stops a
+   * holder from queueing a hundred searches against every tracker. Counted inside the insert's own
+   * transaction, because counting first and inserting after is not a cap - two submissions for
+   * different works each see nine and both proceed.
+   */
+  private async createRequest(selfServe: boolean, data: Parameters<BookRequestRepository['create']>[0], aliasKeys: string[]) {
+    if (!selfServe) return this.repo.create(data, aliasKeys);
+
+    const row = await this.repo.createWithinSelfServeCap(data, aliasKeys, MAX_LIVE_SELF_SERVE_REQUESTS);
+    if (!row) {
+      throw submitForbidden(
+        'SUBMIT_SELF_SERVE_LIMIT',
+        `Finish or cancel some downloads first: ${MAX_LIVE_SELF_SERVE_REQUESTS} can be in flight at once`,
+        { limit: MAX_LIVE_SELF_SERVE_REQUESTS },
+      );
+    }
+    return row;
+  }
+
+  /**
+   * What a self-fulfiller's submission does when somebody has already asked for the same work.
+   *
+   * One live request per work, so their own row cannot be opened alongside it. Subscribing them
+   * and stopping there is what the dedupe fold does for everybody else, and for a self-fulfiller
+   * it is a dead end: they asked to fetch this book and are handed a request every fulfilment
+   * route then refuses them on. So an undriven request is taken on instead - approved, marked
+   * self-serve, and recorded as theirs to drive - which is the same outcome their own row would
+   * have had, minus the second grab of the same torrent.
+   *
+   * Taking one on is deliberately narrow. A request somebody has already grabbed a release for is
+   * work in progress, and a destination this caller cannot reach would let them file a book into
+   * a library they cannot even read - the same rule a fresh self-serve submission is held to.
+   * Either way they are subscribed, which is honest: somebody else is driving it.
+   */
+  private async takeOnOrAttach(existing: BookRequestRow, user: RequestUser): Promise<BookRequestSubmitResult> {
+    if (existing.userId === user.id) return this.attachTo(existing.id, user);
+    if (!(await this.canTakeOn(existing, user))) return this.attachTo(existing.id, user);
+
+    const claimed = await this.repo.claimForSelfServe(existing.id, user.id, CLAIMABLE_STATUSES, MAX_LIVE_SELF_SERVE_REQUESTS);
+    if (!claimed) return this.attachTo(existing.id, user);
+
+    this.logger.log(
+      `[book_request.take_on] [end] requestId=${existing.id} userId=${user.id} requesterId=${existing.userId} from=${existing.status} - a self-fulfiller took on a request somebody else had asked for`,
+    );
+
+    // Before the caller is subscribed, so the announcement reaches the person whose request this
+    // was rather than also telling the caller about their own action. A request that was waiting
+    // on a decision has effectively had one, and approval is announced everywhere else it happens.
+    await this.notifier.notifyInterested(existing.id, NotificationType.BookRequestApproved, {
+      title: 'Book request approved',
+      message: `"${existing.title}" was approved: ${user.name} is fetching it`,
+      actionUrl: '/requests',
+      meta: { requestId: existing.id },
+    });
+
+    this.gateway.emitChanged();
+    return this.attachTo(existing.id, user);
+  }
+
+  private async canTakeOn(existing: BookRequestRow, user: RequestUser): Promise<boolean> {
+    if (existing.selfServe || existing.fulfillerUserId !== null) return false;
+    if (!CLAIMABLE_STATUSES.includes(existing.status as BookRequestStatus)) return false;
+    // A grab that already happened is somebody driving it, whatever the status says.
+    if ((await this.downloads.findLatestForRequests([existing.id])).size > 0) return false;
+    if (existing.targetLibraryId === null) return false;
+
+    const reachable = await this.libraryService.findAccessibleLibraryIds(user);
+    return reachable.includes(existing.targetLibraryId);
+  }
+
+  /** Puts the caller's name against a request that already exists rather than making a second one. */
+  private async attachTo(requestId: number, user: RequestUser): Promise<BookRequestSubmitResult> {
+    const joined = await this.repo.findById(requestId);
+    if (!joined) throw new NotFoundException('Book request not found');
+
+    // Before toItem, which reads the subscriber list, so the caller sees themselves on it.
+    if (joined.request.userId !== user.id) await this.repo.addSubscriber(requestId, user.id);
+    return { request: await this.toItem(joined, user.id), subscribed: true };
+  }
+
+  /**
+   * Leaving a request somebody else made.
+   *
+   * Joining is how a second person asking for the same book is folded into one request, and until
+   * now it was one-way: the only way out was to wait for the thing to settle. Only the
+   * subscription is removed; the request itself is untouched, and the people still waiting on it
+   * are unaffected.
+   *
+   * The requester cannot leave, because there would be nothing left of the request to belong to
+   * them, and neither can a fulfiller who took the row on: their subscription is what makes their
+   * own work visible to them.
+   */
+  async unsubscribe(id: number, user: RequestUser): Promise<void> {
+    const joined = await this.requireVisible(id, user);
+    if (joined.request.userId === user.id) {
+      throw new BadRequestException('This is your own request, so cancel or hide it rather than leaving it');
+    }
+    if (isBookRequestFulfiller(joined.request, user.id)) {
+      throw new BadRequestException('You are fulfilling this request, so hand it back before leaving it');
+    }
+
+    if (!(await this.repo.removeSubscriber(id, user.id))) {
+      throw new NotFoundException('You are not following this book request');
+    }
+
+    this.gateway.emitChanged();
+  }
+
+  /**
+   * The requester picks from libraries they can actually reach. An unreachable id is rejected
+   * rather than quietly dropped, so a request never lands somewhere the requester cannot see.
+   */
+  private async resolveRequestedLibrary(targetLibraryId: number | null, user: RequestUser): Promise<number | null> {
+    if (targetLibraryId === null) return null;
+    try {
+      await this.libraryService.verifyUserAccess(user.id, targetLibraryId, user.isSuperuser);
+    } catch (error) {
+      // The rule belongs to the library service; only the sentence is ours, and the form has to be
+      // able to translate this the way it translates every other reason a submission is refused.
+      if (error instanceof ForbiddenException) throw submitForbidden('SUBMIT_LIBRARY_FORBIDDEN', error.message);
+      throw error;
+    }
+    return targetLibraryId;
+  }
+
+  /**
+   * Whether this instance can search for anything at all. Counts only, never names or addresses:
+   * this is read by everybody who may file a request, and the list it comes from is admin-only.
+   */
+  getSourceStatus(): Promise<BookRequestSourceStatus> {
+    return this.indexers.countSources();
+  }
+
+  /**
+   * Where an unpicked request of each medium would land, named so the form can say so.
+   *
+   * The request form has to state this: without it the destination select sits empty and the
+   * requester submits with no idea where the book goes. Not filtered by what this user can browse,
+   * for the same reason the default itself is not: the operator chose it for the instance, and a
+   * requester who cannot see that library is exactly who is looking at an empty select.
+   */
+  async getDefaultDestinations(): Promise<ResolvedRequestDestinations> {
+    const resolved = await Promise.all(
+      BOOK_REQUEST_MEDIA_KINDS.map(async (mediaKind) => [mediaKind, await this.automationSettings.resolveDestinationFor(mediaKind)] as const),
+    );
+    const names = await this.repo.findLibraryNames(resolved.map(([, destination]) => destination.libraryId).filter((id) => id !== null));
+
+    const destinations = emptyResolvedRequestDestinations();
+    for (const [mediaKind, destination] of resolved) {
+      if (destination.libraryId === null) continue;
+      destinations[mediaKind] = {
+        libraryId: destination.libraryId,
+        libraryName: names.get(destination.libraryId) ?? null,
+        folderId: destination.folderId,
+      };
+    }
+    return destinations;
+  }
+
+  async listMine(dto: ListBookRequestsDto, user: RequestUser): Promise<BookRequestPage> {
+    const { items, total } = await this.repo.findAll({
+      page: dto.page ?? 1,
+      limit: dto.limit ?? 20,
+      status: dto.status,
+      mediaKind: dto.mediaKind,
+      userId: user.id,
+      selfServe: dto.selfServe,
+      excludeDismissedFor: dto.includeDismissed ? undefined : user.id,
+      sortBy: dto.sortBy,
+      sortDir: dto.sortDir,
+    });
+    return { items: await this.toItems(items, user.id), total };
+  }
+
+  async listAll(dto: ListAllBookRequestsDto, user: RequestUser): Promise<BookRequestPage> {
+    if (!this.canManageAll(user)) throw new ForbiddenException('You cannot view all book requests');
+    const { items, total } = await this.repo.findAll({
+      page: dto.page ?? 1,
+      limit: dto.limit ?? 20,
+      status: dto.status,
+      mediaKind: dto.mediaKind,
+      requesterUserId: dto.requesterUserId,
+      selfServe: dto.selfServe,
+      excludeDismissedFor: dto.includeDismissed ? undefined : user.id,
+      sortBy: dto.sortBy,
+      sortDir: dto.sortDir,
+    });
+    return { items: await this.toItems(items, user.id), total };
+  }
+
+  listRequesterOptions(dto: ListRequesterOptionsDto): Promise<BookRequestRequesterOption[]> {
+    return this.repo.findRequesterOptions(dto.search ?? null);
+  }
+
+  async getOne(id: number, user: RequestUser): Promise<BookRequestItem> {
+    const joined = await this.requireVisible(id, user);
+    return this.toItem(joined, user.id);
+  }
+
+  /**
+   * The refusal a transition that lost its race should have raised.
+   *
+   * Every lifecycle method reads the request, checks the status it found, and commits
+   * conditionally on that status still holding. When the conditional write finds nothing, another
+   * decision landed in between; re-reading here means the message names the status the request is
+   * actually in now, which is exactly what the pre-read guard would have said had the winner
+   * committed a moment earlier.
+   */
+  private async staleTransition(id: number, describe: (status: BookRequestStatus) => string): Promise<HttpException> {
+    const joined = await this.repo.findById(id);
+    if (!joined) return new NotFoundException('Book request not found');
+    return new BadRequestException(describe(joined.request.status as BookRequestStatus));
+  }
+
+  private async staleLifecycleTransition(id: number, action: 'approve' | 'reject' | 'cancel'): Promise<HttpException> {
+    const joined = await this.repo.findById(id);
+    if (!joined) return new NotFoundException('Book request not found');
+    const status = joined.request.status as BookRequestStatus;
+    return actionRefusal('BOOK_REQUEST_STALE_TRANSITION', `The request changed before ${action} could be applied; it is now ${status}`, {
+      action,
+      status,
+    });
+  }
+
+  /**
+   * Who may steer or stop one request: its requester, a moderator, or the self-fulfiller who took
+   * it on. The last of those matters because a fulfiller who cannot cancel the transfer they
+   * started, or correct the language the picker is matching against, has taken on work they can
+   * only run forwards.
+   */
+  private canDrive(request: BookRequestRow, user: RequestUser): boolean {
+    if (request.userId === user.id || this.canManageAll(user)) return true;
+    return this.canSelfFulfil(user) && isBookRequestFulfiller(request, user.id);
+  }
+
+  /**
+   * Who may read one request. The fulfiller is named alongside the requester rather than left to
+   * the subscription that taking a request on also creates: whoever is driving the work can see
+   * it, and that must not depend on a side effect somebody could later undo.
+   */
+  private async requireVisible(id: number, user: RequestUser): Promise<BookRequestJoinedRow> {
+    const joined = await this.repo.findById(id);
+    if (!joined) throw new NotFoundException('Book request not found');
+    if (this.canManageAll(user)) return joined;
+    if (joined.request.userId === user.id) return joined;
+    if (this.canSelfFulfil(user) && isBookRequestFulfiller(joined.request, user.id)) return joined;
+    if (await this.repo.isSubscriber(id, user.id)) return joined;
+    throw new ForbiddenException('You cannot view this book request');
+  }
+
+  /**
+   * Stop, at any point before the request has settled. A request that is mid-download is stopped
+   * at its transfer handler too. Torrent data is kept because an import may hardlink from it;
+   * partial direct-download staging has no reuse and is deleted.
+   *
+   * The removal is best-effort on purpose. A download client that is unreachable must not be the
+   * reason a stuck request stays stuck, so the cancellation stands either way and the request
+   * carries a note that a transfer may still be sitting in the client.
+   */
+  async cancel(id: number, user: RequestUser): Promise<BookRequestItem> {
+    const joined = await this.repo.findById(id);
+    if (!joined) throw new NotFoundException('Book request not found');
+
+    if (!this.canDrive(joined.request, user)) {
+      throw actionForbidden('BOOK_REQUEST_ACTION_FORBIDDEN', 'You cannot cancel this book request', { action: 'cancel' });
+    }
+    if (!isCancellableBookRequestStatus(joined.request.status as BookRequestStatus)) {
+      throw actionRefusal('BOOK_REQUEST_NOT_CANCELLABLE', `A request that is ${joined.request.status} can no longer be cancelled`, {
+        status: joined.request.status,
+      });
+    }
+
+    // The transition first, and only then the client. Detaching first would hand the seed of a
+    // request that finished during the click to a cancellation that is then refused, and the
+    // ordering bought nothing: once the row says cancelled, the monitor's own writes are
+    // conditional on statuses it no longer holds, so there is no attempt left to revive.
+    const updated = await this.repo.updateIf(id, CANCELLABLE_BOOK_REQUEST_STATUSES, {
+      status: 'cancelled',
+      decidedByUserId: user.id,
+      decidedAt: new Date(),
+      statusReason: null,
+    });
+    if (!updated) throw await this.staleLifecycleTransition(id, 'cancel');
+
+    const outcome = await this.removal.removeLatestForRequest(id, false, user.username);
+    // The cancellation stands either way; the note is what tells the requester a transfer may
+    // still be sitting in the client. Conditional, so it cannot resurrect a row a delete removed.
+    if (outcome.error) {
+      await this.repo.updateIf(id, ['cancelled'], {
+        statusReason: `Cancelled, but the active download could not be stopped: ${outcome.error}`,
+      });
+    }
+
+    this.logger.log(
+      `[book_request.cancel] [end] requestId=${id} userId=${user.id} from=${joined.request.status} downloadRemoved=${outcome.removed} - book request cancelled`,
+    );
+
+    this.gateway.emitChanged();
+    return this.getOne(id, user);
+  }
+
+  /**
+   * Stop only the active transfer and put the request back where another release can be chosen.
+   * This is intentionally separate from `cancel`: the request, its subscribers, and its approval
+   * remain intact.
+   */
+  async cancelDownload(id: number, downloadId: number, user: RequestUser): Promise<BookRequestItem> {
+    const joined = await this.repo.findById(id);
+    if (!joined) throw new NotFoundException('Book request not found');
+    if (!this.canDrive(joined.request, user)) throw new ForbiddenException('You cannot cancel this book request download');
+
+    const download = await this.downloads.findById(downloadId);
+    if (!download || download.requestId !== id) throw new NotFoundException('That download attempt does not belong to this request');
+    if (!(ACTIVE_BOOK_REQUEST_DOWNLOAD_STATUSES as readonly string[]).includes(download.status)) {
+      throw new BadRequestException(`A download that is ${download.status} can no longer be cancelled`);
+    }
+
+    const stopped = await this.removal.removeAttempt(id, downloadId, false, user.username);
+    if (!stopped) throw new BadRequestException('The download finished before it could be cancelled');
+
+    await this.repo.updateIf(id, ACTIVE_TRANSFER_REQUEST_STATUSES, { status: 'approved', statusReason: null });
+    this.gateway.emitChanged();
+
+    return this.getOne(id, user);
+  }
+
+  /**
+   * The language a request asks for, changed after it was made.
+   *
+   * Worth being able to change, because this one field silently decides the outcome: it arrives
+   * from whichever edition was picked in the metadata results, so a request can end up asking for
+   * a translation nobody chose. Without this the only remedy is to cancel and start again, and an
+   * approver looking at a picker full of the wrong language has no way to correct it.
+   */
+  async setLanguage(id: number, language: string | null, user: RequestUser): Promise<BookRequestItem> {
+    const joined = await this.repo.findById(id);
+    if (!joined) throw new NotFoundException('Book request not found');
+
+    if (!this.canDrive(joined.request, user)) throw new ForbiddenException('You cannot change this book request');
+    // Once the book is filed the language already decided what was imported, and changing it now
+    // would describe the request as having asked for something it did not get.
+    if (joined.request.status === 'available') {
+      throw new BadRequestException('A request that has already been filed can no longer change language');
+    }
+
+    // Normalised rather than stored as given, because a request created before this existed may
+    // hold "spa" or "English", and the picker's facets compare codes.
+    // Stricter than the create path on purpose. This one is a person picking from a list, so a code
+    // outside it is a mistake worth reporting; a language a provider stated is data we already have
+    // and narrowing that would drop a filter that used to work.
+    const normalized = language === null ? null : toRequestLanguage(language);
+    if (language !== null && (normalized === null || !REQUEST_LANGUAGE_CODES.includes(normalized))) {
+      throw new BadRequestException(`"${language}" is not a language releases can be matched against`);
+    }
+
+    const updated = await this.repo.updateIf(id, LANGUAGE_EDITABLE_STATUSES, { language: normalized });
+    if (!updated) throw await this.staleTransition(id, () => 'A request that has already been filed can no longer change language');
+
+    this.logger.log(
+      `[book_request.set_language] [end] requestId=${id} userId=${user.id} from=${joined.request.language ?? 'any'} to=${normalized ?? 'any'} - request language changed`,
+    );
+
+    this.gateway.emitChanged();
+    return this.getOne(id, user);
+  }
+
+  /**
+   * "Stop showing me this." Personal to the caller, so tidying your own list never takes a row off
+   * the approver queue or off the other people who asked for the same book. Only a settled request
+   * can be hidden; open work is cancelled, not swept under the rug.
+   */
+  async dismiss(id: number, user: RequestUser): Promise<BookRequestItem> {
+    const joined = await this.requireVisible(id, user);
+    if (!isSettledBookRequestStatus(joined.request.status as BookRequestStatus)) {
+      throw new BadRequestException(`A request that is ${joined.request.status} is still being worked on; cancel it instead`);
+    }
+
+    if (!(await this.repo.dismissIf(id, user.id, SETTLED_BOOK_REQUEST_STATUSES))) {
+      throw await this.staleTransition(id, (status) => `A request that is ${status} is still being worked on; cancel it instead`);
+    }
+    return this.getOne(id, user);
+  }
+
+  async restore(id: number, user: RequestUser): Promise<BookRequestItem> {
+    await this.requireVisible(id, user);
+    await this.repo.restore(id, user.id);
+    return this.getOne(id, user);
+  }
+
+  /**
+   * The escape hatch, for rows that are worth nothing to anybody: the audit trail of who asked and
+   * who decided goes with them, which is why this is a moderator action and dismissal is what
+   * everyone else gets.
+   *
+   * A settled request can still own client state, especially a torrent that keeps seeding after
+   * import, so the attempt is detached first. Deleting the row before that would leave client work
+   * with nothing pointing at it. Torrent files are kept; direct-download staging is disposable.
+   */
+  async remove(id: number, user: RequestUser): Promise<void> {
+    const joined = await this.repo.findById(id);
+    if (!joined) throw new NotFoundException('Book request not found');
+    if (!this.canManageAll(user)) throw new ForbiddenException('You cannot delete book requests');
+    if (!isSettledBookRequestStatus(joined.request.status as BookRequestStatus)) {
+      throw new BadRequestException(`A request that is ${joined.request.status} is still being worked on; cancel it before deleting it`);
+    }
+
+    // Failed is the one settled status that can be grabbed again. Reserve it before touching the
+    // client so a concurrent retry cannot start a healthy transfer that this deletion then stops.
+    // The other settled statuses have no outgoing transition and need no temporary claim.
+    const reservedFailed = joined.request.status === 'failed';
+    if (reservedFailed && !(await this.repo.updateIf(id, ['failed'], { status: 'cancelled' }))) {
+      throw await this.staleTransition(id, (status) => `A request that is ${status} is still being worked on; cancel it before deleting it`);
+    }
+
+    const outcome = await this.removal.removeLatestForRequest(id, false, user.username);
+    if (outcome.error) {
+      if (reservedFailed) await this.repo.updateIf(id, ['cancelled'], { status: 'failed' });
+      throw new BadRequestException(`Remove the download from its client first: ${outcome.error}`);
+    }
+
+    if (!(await this.repo.remove(id, SETTLED_BOOK_REQUEST_STATUSES))) {
+      throw await this.staleTransition(id, (status) => `A request that is ${status} is still being worked on; cancel it before deleting it`);
+    }
+
+    this.logger.log(
+      `[book_request.delete] [end] requestId=${id} userId=${user.id} status=${joined.request.status} downloadRemoved=${outcome.removed} title="${sanitizeLogValue(joined.request.title)}" - book request deleted`,
+    );
+
+    this.gateway.emitChanged();
+  }
+
+  async approve(id: number, dto: DecideBookRequestDto, user: RequestUser): Promise<BookRequestItem> {
+    const joined = await this.repo.findById(id);
+    if (!joined) throw new NotFoundException('Book request not found');
+    if (joined.request.status !== 'pending') {
+      throw actionRefusal('BOOK_REQUEST_NOT_PENDING', `Only a pending request can be approved; this one is ${joined.request.status}`, {
+        action: 'approve',
+        status: joined.request.status,
+      });
+    }
+
+    // The approver may reroute, but only somewhere they can reach themselves.
+    let targetLibraryId = joined.request.targetLibraryId;
+    if (dto.targetLibraryId !== undefined && dto.targetLibraryId !== null) {
+      await this.libraryService.verifyUserAccess(user.id, dto.targetLibraryId, user.isSuperuser);
+      targetLibraryId = dto.targetLibraryId;
+    }
+
+    // Requests made before an instance default existed carry no destination at all, and there is
+    // no reason to make the approver retype one the operator has since set.
+    let carriedFolderId = dto.targetFolderId ?? joined.request.targetFolderId;
+    if (targetLibraryId === null) {
+      const fallback = await this.automationSettings.resolveDestinationFor(joined.request.mediaKind);
+      targetLibraryId = fallback.libraryId;
+      carriedFolderId ??= fallback.folderId;
+    }
+
+    // Fulfilment has nowhere to file the book without one, and an approval that skips it only
+    // fails much later, at the grab or after a whole download has already run.
+    if (targetLibraryId === null) {
+      throw actionRefusal('BOOK_REQUEST_DESTINATION_REQUIRED', 'Pick a destination library before approving this request');
+    }
+
+    const targetFolderId = await this.resolveDestinationFolder(carriedFolderId, targetLibraryId);
+
+    // Nothing below this line happens unless the approval is the one that committed. Two
+    // moderators deciding at once would otherwise both announce their decision and both hand the
+    // request to automation, for a request only one of them actually changed.
+    if (
+      !(await this.repo.updateIf(id, PENDING_ONLY, {
+        status: 'approved',
+        decidedByUserId: user.id,
+        decidedAt: new Date(),
+        decisionNote: dto.decisionNote ?? null,
+        targetLibraryId,
+        targetFolderId,
+      }))
+    ) {
+      throw await this.staleLifecycleTransition(id, 'approve');
+    }
+
+    this.gateway.emitChanged();
+
+    await this.notifier.notifyInterested(id, NotificationType.BookRequestApproved, {
+      title: 'Book request approved',
+      message: `"${joined.request.title}" was approved`,
+      actionUrl: '/requests',
+      meta: { requestId: id },
+    });
+
+    this.automation.considerRequest(id);
+
+    return this.getOne(id, user);
+  }
+
+  /**
+   * Runs one per-request action across a selection, one at a time.
+   *
+   * Sequential rather than concurrent on purpose: an approval hands the request to automation, and
+   * forty simultaneous searches against the same private tracker is what a rate limit looks like
+   * from the other side. Nothing is rolled back on a failure either, because an approval that has
+   * already reached automation cannot be taken back cleanly; the caller is told which ids fell out
+   * instead.
+   */
+  private async runBulk(
+    event: string,
+    ids: number[],
+    user: RequestUser,
+    fallbackReason: string,
+    run: (id: number) => Promise<BookRequestItem>,
+  ): Promise<BookRequestBulkResult> {
+    const startedAt = Date.now();
+    this.logger.log(`[${event}] [start] userId=${user.id} count=${ids.length} - applying an action to a selection of book requests`);
+
+    const updated: BookRequestItem[] = [];
+    const failed: BookRequestBulkFailure[] = [];
+
+    for (const id of ids) {
+      const itemStartedAt = Date.now();
+      try {
+        updated.push(await run(id));
+      } catch (error) {
+        // An HttpException is this service refusing on a rule it states, and the reason is the
+        // sentence the operator reads. Anything else is a defect, and folding it into the same
+        // generic per-item failure without a line here is what made one undiagnosable.
+        if (!(error instanceof HttpException)) {
+          this.logger.error(
+            `[${event}] [fail] userId=${user.id} requestId=${id} durationMs=${Date.now() - itemStartedAt} errorClass=${error instanceof Error ? error.constructor.name : typeof error} error="${sanitizeLogValue(error instanceof Error ? error.message : String(error))}" - a request in the selection failed unexpectedly`,
+          );
+        }
+        const reason = error instanceof HttpException ? error.message : fallbackReason;
+        const joined = await this.repo.findById(id);
+        const response = error instanceof HttpException ? error.getResponse() : null;
+        const body = typeof response === 'object' && response !== null ? (response as { errorCode?: unknown; errorMeta?: unknown }) : null;
+        const errorCode =
+          typeof body?.errorCode === 'string' &&
+          ([...BOOK_REQUEST_ACTION_ERROR_CODES, ...BOOK_REQUEST_SUBMIT_ERROR_CODES] as readonly string[]).includes(body.errorCode)
+            ? (body.errorCode as BookRequestActionErrorCode | BookRequestSubmitErrorCode)
+            : null;
+        const errorMeta = typeof body?.errorMeta === 'object' && body.errorMeta !== null ? (body.errorMeta as BookRequestFailureMeta) : null;
+        failed.push({ id, title: joined?.request.title ?? String(id), reason, errorCode, errorMeta });
+      }
+    }
+
+    this.logger.log(
+      `[${event}] [end] userId=${user.id} updated=${updated.length} failed=${failed.length} durationMs=${Date.now() - startedAt} - selection applied`,
+    );
+
+    return { updated, failed };
+  }
+
+  async approveMany(dto: BulkBookRequestsDto, user: RequestUser): Promise<BookRequestBulkResult> {
+    return this.runBulk('book_request.approve_many', [...new Set(dto.ids)], user, 'Could not approve that request', (id) =>
+      this.approve(id, {}, user),
+    );
+  }
+
+  /**
+   * Rejecting a selection, with one shared sentence. Unlike a reroute, a reason is exactly the
+   * kind of thing that applies to the whole batch: "not available anywhere" is one answer to
+   * forty requests, and making the approver type it forty times is why it went unwritten.
+   */
+  async rejectMany(dto: BulkRejectBookRequestsDto, user: RequestUser): Promise<BookRequestBulkResult> {
+    return this.runBulk('book_request.reject_many', [...new Set(dto.ids)], user, 'Could not reject that request', (id) =>
+      this.reject(id, { decisionNote: dto.decisionNote }, user),
+    );
+  }
+
+  /** Hiding is personal, so this needs no moderator permission and touches nobody else's list. */
+  async dismissMany(dto: BulkBookRequestsDto, user: RequestUser): Promise<BookRequestBulkResult> {
+    return this.runBulk('book_request.dismiss_many', [...new Set(dto.ids)], user, 'Could not hide that request', (id) => this.dismiss(id, user));
+  }
+
+  /**
+   * A folder only means anything alongside its own library. Rerouting the library while leaving
+   * a folder from the old one behind would carry the book back into that library at finalize
+   * time, and both ids are individually valid so no constraint would catch it.
+   */
+  private async resolveDestinationFolder(folderId: number | null, libraryId: number | null): Promise<number | null> {
+    if (folderId === null) return null;
+    if (libraryId === null) throw submitRefusal('SUBMIT_FOLDER_NEEDS_LIBRARY', 'A destination folder needs a destination library');
+    if (!(await this.repo.folderBelongsToLibrary(folderId, libraryId))) {
+      throw submitRefusal('SUBMIT_FOLDER_NOT_IN_LIBRARY', 'That folder is not part of the destination library');
+    }
+    return folderId;
+  }
+
+  async reject(id: number, dto: DecideBookRequestDto, user: RequestUser): Promise<BookRequestItem> {
+    const joined = await this.repo.findById(id);
+    if (!joined) throw new NotFoundException('Book request not found');
+    if (joined.request.status !== 'pending') {
+      throw actionRefusal('BOOK_REQUEST_NOT_PENDING', `Only a pending request can be rejected; this one is ${joined.request.status}`, {
+        action: 'reject',
+        status: joined.request.status,
+      });
+    }
+
+    if (
+      !(await this.repo.updateIf(id, PENDING_ONLY, {
+        status: 'rejected',
+        decidedByUserId: user.id,
+        decidedAt: new Date(),
+        decisionNote: dto.decisionNote ?? null,
+      }))
+    ) {
+      throw await this.staleLifecycleTransition(id, 'reject');
+    }
+
+    this.gateway.emitChanged();
+
+    await this.notifier.notifyInterested(id, NotificationType.BookRequestRejected, {
+      title: 'Book request rejected',
+      message: dto.decisionNote?.trim() ? `"${joined.request.title}": ${dto.decisionNote.trim()}` : `"${joined.request.title}" was rejected`,
+      actionUrl: '/requests',
+      meta: { requestId: id },
+    });
+
+    return this.getOne(id, user);
+  }
+
+  /**
+   * Phase 1 fulfilment: the approver went and got the book themselves and is closing the loop.
+   * Later phases drive the same transition from the download pipeline.
+   */
+  async markFulfilled(id: number, dto: FulfillBookRequestDto, user: RequestUser): Promise<BookRequestItem> {
+    const joined = await this.repo.findById(id);
+    if (!joined) throw new NotFoundException('Book request not found');
+    if (joined.request.status === 'available') throw new BadRequestException('This request is already fulfilled');
+    if (!isFulfillableBookRequestStatus(joined.request.status as BookRequestStatus)) {
+      throw new BadRequestException(`A ${joined.request.status} request cannot be fulfilled`);
+    }
+    if (dto.matchedBookId == null && dto.bookDockFileId == null) {
+      throw new BadRequestException('Provide either a book or a Book Dock file to close the request');
+    }
+
+    // Scoped to what this actor can reach, not merely to what exists. `ManageBookRequests` says
+    // they may close a request; it says nothing about which libraries they can read or whose dock
+    // items are theirs, and an unscoped id here files a permanent reference to a resource they
+    // could never have opened.
+    if (dto.matchedBookId != null && !(await this.repo.bookExists(dto.matchedBookId, await this.reachableLibraryIds(user)))) {
+      throw new BadRequestException('That book no longer exists');
+    }
+    if (dto.bookDockFileId != null && !(await this.repo.bookDockFileExists(dto.bookDockFileId, this.dockUploaderScope(user)))) {
+      throw new BadRequestException('That Book Dock file no longer exists');
+    }
+
+    // Before the transition, like cancel and delete: the person has the book already, so a transfer
+    // still running is work nothing will ever use. Detaching it after the row settled would leave
+    // a window where the poll loop still owns an attempt against a filed request; leaving it out
+    // altogether, as this used to, left a mid-download torrent running in the client with nothing
+    // in BookOrbit pointing at it. Best-effort, so a client that is down cannot block the filing.
+    const outcome = await this.removal.removeLatestForRequest(id, false, user.username);
+
+    if (
+      !(await this.repo.updateIf(id, FULFILLABLE_BOOK_REQUEST_STATUSES, {
+        status: 'available',
+        matchedBookId: dto.matchedBookId ?? null,
+        bookDockFileId: dto.bookDockFileId ?? null,
+        decisionNote: dto.note ?? joined.request.decisionNote,
+        decidedByUserId: user.id,
+        decidedAt: new Date(),
+        statusReason: outcome.error ? `Fulfilled by hand, but the active download could not be stopped: ${outcome.error}` : null,
+      }))
+    ) {
+      throw await this.staleTransition(id, (status) =>
+        status === 'available' ? 'This request is already fulfilled' : `A ${status} request cannot be fulfilled`,
+      );
+    }
+
+    // After the transition, not before: an attempt still running belongs to a request that is now
+    // filed, and one left in flight is one the poll loop would go on reporting progress for and
+    // would eventually import a second copy of the book from. `removeLatestForRequest` above only
+    // settles the newest attempt, so this is what catches an older one still in flight.
+    let abandoned: number;
+    try {
+      abandoned = await this.downloads.failInFlightForRequest(id, `Fulfilled by hand by ${user.username}`);
+    } finally {
+      this.gateway.emitChanged();
+    }
+
+    this.logger.log(
+      `[book_request.fulfill] [end] requestId=${id} userId=${user.id} bookId=${dto.matchedBookId ?? 'none'} dockFileId=${dto.bookDockFileId ?? 'none'} downloadRemoved=${outcome.removed} abandonedAttempts=${abandoned} - book request fulfilled`,
+    );
+
+    await this.notifier.notifyBookAvailable(id, dto.matchedBookId ?? null, {
+      title: 'Your requested book is available',
+      message: `"${joined.request.title}" is ready`,
+      meta: { requestId: id, bookId: dto.matchedBookId ?? null },
+    });
+
+    return this.getOne(id, user);
+  }
+
+  async checkAvailability(queries: BookRequestAvailabilityQuery[], user: RequestUser): Promise<BookRequestAvailability[]> {
+    const libraryIds = user.isSuperuser ? null : await this.libraryService.findAccessibleLibraryIds(user);
+    return this.dedupe.checkAvailability(queries, user.id, libraryIds);
+  }
+
+  getSummary(user: RequestUser): Promise<BookRequestSummary> {
+    return this.summaryCache.get('book-request-summary', `${user.id}:${this.gateway.changeVersion}`, () => this.loadSummary(user));
+  }
+
+  private async loadSummary(user: RequestUser): Promise<BookRequestSummary> {
+    const canManage = this.canManageAll(user);
+    const [pending, active, mine, mineTotal, allTotal] = await Promise.all([
+      canManage ? this.repo.countByStatuses(['pending']) : Promise.resolve(0),
+      canManage ? this.repo.countByStatuses(OPEN_STATUSES) : Promise.resolve(0),
+      this.repo.countForUser(user.id, OPEN_STATUSES),
+      this.repo.countForUser(user.id, [], true),
+      canManage ? this.repo.countByStatuses([], user.id) : Promise.resolve(0),
+    ]);
+    return { pending, active, mine, mineTotal, allTotal };
+  }
+
+  private async toItems(rows: BookRequestJoinedRow[], viewerId: number): Promise<BookRequestItem[]> {
+    const ids = rows.map((r) => r.request.id);
+    const [subscribers, downloads, dismissed] = await Promise.all([
+      this.repo.findSubscribers(ids),
+      this.downloads.findLatestForRequests(ids),
+      this.repo.findDismissedRequestIds(viewerId, ids),
+    ]);
+    return rows.map((row) =>
+      mapBookRequestRow(row, subscribers.get(row.request.id) ?? [], downloads.get(row.request.id) ?? null, dismissed.has(row.request.id)),
+    );
+  }
+
+  private async toItem(row: BookRequestJoinedRow, viewerId: number): Promise<BookRequestItem> {
+    const [item] = await this.toItems([row], viewerId);
+    return item;
+  }
+}
diff --git a/server/src/modules/book-request/download-clients/adapters/client-http.utils.test.ts b/server/src/modules/book-request/download-clients/adapters/client-http.utils.test.ts
new file mode 100644
index 000000000..b8fb60970
--- /dev/null
+++ b/server/src/modules/book-request/download-clients/adapters/client-http.utils.test.ts
@@ -0,0 +1,167 @@
+import { BadRequestException, ServiceUnavailableException } from '@nestjs/common';
+
+import { basicAuthHeader, endpointUrl, fetchClient, readClientJson, readClientText } from './client-http.utils';
+
+describe('endpointUrl', () => {
+  /**
+   * The whole reason this helper exists. `new URL('/api/v2/x', base)` discards the base's path,
+   * which silently breaks every deployment where the client sits behind a reverse proxy at a
+   * subpath: the request goes to the proxy root and comes back as somebody else's 404.
+   */
+  it('joins under the base path rather than replacing it', () => {
+    const url = endpointUrl(new URL('https://seedbox.example/qb/'), '/api/v2/torrents/info');
+
+    expect(url.href).toBe('https://seedbox.example/qb/api/v2/torrents/info');
+  });
+
+  it('does not double the separator when the base carries no trailing slash', () => {
+    const url = endpointUrl(new URL('https://seedbox.example/qb'), '/api/v2/app/version');
+
+    expect(url.pathname).toBe('/qb/api/v2/app/version');
+  });
+
+  it('leaves a root-hosted client alone', () => {
+    const url = endpointUrl(new URL('http://127.0.0.1:8080'), '/api/v2/auth/login');
+
+    expect(url.href).toBe('http://127.0.0.1:8080/api/v2/auth/login');
+  });
+
+  it('carries a query string through as the target search', () => {
+    const url = endpointUrl(new URL('https://seedbox.example/qb/'), '/api/v2/torrents/info?hashes=abc&filter=all');
+
+    expect(url.pathname).toBe('/qb/api/v2/torrents/info');
+    expect(url.search).toBe('?hashes=abc&filter=all');
+  });
+
+  /** A base's own query and fragment describe the base, not this call, and must not ride along. */
+  it('drops any query or fragment the base was carrying', () => {
+    const url = endpointUrl(new URL('https://seedbox.example/qb/?theme=dark#top'), '/api/v2/app/version');
+
+    expect(url.search).toBe('');
+    expect(url.hash).toBe('');
+  });
+
+  it('keeps the base intact so one URL object can serve many calls', () => {
+    const base = new URL('https://seedbox.example/qb/');
+
+    endpointUrl(base, '/api/v2/torrents/info');
+    endpointUrl(base, '/api/v2/app/version');
+
+    expect(base.href).toBe('https://seedbox.example/qb/');
+  });
+});
+
+describe('basicAuthHeader', () => {
+  it('encodes a username and password pair', () => {
+    expect(basicAuthHeader('admin', 'hunter2')).toEqual({ Authorization: `Basic ${Buffer.from('admin:hunter2').toString('base64')}` });
+  });
+
+  /**
+   * A client with authentication switched off answers an empty `Basic :` header with a 401, so the
+   * header has to be absent rather than empty.
+   */
+  it('sends no header at all when neither half is set', () => {
+    expect(basicAuthHeader(null, null)).toEqual({});
+    expect(basicAuthHeader('', '')).toEqual({});
+  });
+
+  it('still sends one when only half the pair is set, which some clients accept', () => {
+    expect(basicAuthHeader('admin', null)).toEqual({ Authorization: `Basic ${Buffer.from('admin:').toString('base64')}` });
+    expect(basicAuthHeader(null, 'hunter2')).toEqual({ Authorization: `Basic ${Buffer.from(':hunter2').toString('base64')}` });
+  });
+});
+
+describe('fetchClient', () => {
+  const url = new URL('http://127.0.0.1:8080/api/v2/app/version');
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+    vi.useRealTimers();
+  });
+
+  it('returns the response and never follows a redirect on its own', async () => {
+    const response = new Response('v4.6.0', { status: 200 });
+    const fetchMock = vi.fn().mockResolvedValue(response);
+    vi.stubGlobal('fetch', fetchMock);
+
+    await expect(fetchClient(url, { method: 'GET' }, 'qBittorrent')).resolves.toBe(response);
+    expect(fetchMock.mock.calls[0][1]).toMatchObject({ method: 'GET', redirect: 'manual' });
+  });
+
+  /** The daemon's own name, because an instance with three clients configured needs to say which. */
+  it('names the client when it cannot be reached', async () => {
+    vi.stubGlobal('fetch', vi.fn().mockRejectedValue(new TypeError('fetch failed')));
+
+    await expect(fetchClient(url, {}, 'Transmission')).rejects.toMatchObject({
+      constructor: ServiceUnavailableException,
+      message: expect.stringContaining('Transmission'),
+    });
+  });
+
+  /**
+   * `fetch` reports a timeout and a refusal as the same opaque `TypeError`, so the abort has to be
+   * told apart from every other failure here or the operator is handed "fetch failed" either way.
+   */
+  it('reports a timeout as a timeout rather than as an unreachable client', async () => {
+    const aborted = new Error('The operation was aborted');
+    aborted.name = 'AbortError';
+    vi.stubGlobal('fetch', vi.fn().mockRejectedValue(aborted));
+
+    await expect(fetchClient(url, {}, 'Deluge')).rejects.toMatchObject({ message: 'Deluge did not answer in time' });
+  });
+
+  it('aborts the request once the timeout elapses', async () => {
+    vi.useFakeTimers();
+    let seen: AbortSignal | undefined;
+    vi.stubGlobal(
+      'fetch',
+      vi.fn().mockImplementation(
+        (_input: unknown, init: RequestInit) =>
+          new Promise((_resolve, reject) => {
+            seen = init.signal as AbortSignal;
+            seen.addEventListener('abort', () => {
+              const error = new Error('aborted');
+              error.name = 'AbortError';
+              reject(error);
+            });
+          }),
+      ),
+    );
+
+    // The assertion is attached before the clock moves, so the rejection is never momentarily
+    // unhandled; otherwise this passes while the run reports an unhandled rejection alongside it.
+    const settled = expect(fetchClient(url, {}, 'qBittorrent')).rejects.toMatchObject({ message: 'qBittorrent did not answer in time' });
+    await vi.advanceTimersByTimeAsync(20_000);
+    await settled;
+
+    expect(seen?.aborted).toBe(true);
+  });
+
+  /** The timer is cleared on the way out, so a fast answer does not hold the process open. */
+  it('clears its timeout after a successful call', async () => {
+    vi.useFakeTimers();
+    const clear = vi.spyOn(globalThis, 'clearTimeout');
+    vi.stubGlobal('fetch', vi.fn().mockResolvedValue(new Response('ok')));
+
+    await fetchClient(url, {}, 'qBittorrent');
+
+    expect(clear).toHaveBeenCalled();
+  });
+});
+
+describe('readClientText and readClientJson', () => {
+  it('reads an ordinary answer', async () => {
+    await expect(readClientText(new Response('Ok.'), 'qBittorrent')).resolves.toBe('Ok.');
+    await expect(readClientJson<{ a: number }>(new Response('{"a":1}'), 'Transmission')).resolves.toEqual({ a: 1 });
+  });
+
+  /** A daemon behind a captive portal answers every call with a page; nothing obliges it to be small. */
+  it('refuses a body larger than the ceiling, naming the client', async () => {
+    const huge = new Response('x', { headers: { 'content-length': String(64 * 1024 * 1024) } });
+    await expect(readClientText(huge, 'Deluge')).rejects.toThrow(/Deluge answered with more data/);
+  });
+
+  it('reports a non-JSON answer as the client failing rather than a parse crash', async () => {
+    await expect(readClientJson(new Response('<html>login</html>'), 'qBittorrent')).rejects.toBeInstanceOf(BadRequestException);
+  });
+});
diff --git a/server/src/modules/book-request/download-clients/adapters/client-http.utils.ts b/server/src/modules/book-request/download-clients/adapters/client-http.utils.ts
new file mode 100644
index 000000000..32d9b4ba5
--- /dev/null
+++ b/server/src/modules/book-request/download-clients/adapters/client-http.utils.ts
@@ -0,0 +1,90 @@
+import { BadRequestException, ServiceUnavailableException } from '@nestjs/common';
+
+import { readBoundedText, ResponseTooLargeError } from '../../../../common/utils/bounded-response';
+
+/** Every adapter talks to somebody else's daemon over the network, so none of them may hang. */
+const CLIENT_REQUEST_TIMEOUT_MS = 20_000;
+
+/**
+ * How much of a daemon's answer BookOrbit is willing to hold in memory.
+ *
+ * The largest honest response any adapter asks for is a torrent listing, and even a client holding
+ * tens of thousands of torrents answers that in single-digit megabytes; the poll is also batched,
+ * so no single call sees the whole queue. What this bounds is the dishonest case: a daemon behind
+ * a captive portal answering every call with a page, or a compromised one streaming forever, both
+ * of which `response.json()` would read to the end whatever its size.
+ */
+const MAX_CLIENT_RESPONSE_BYTES = 32 * 1024 * 1024;
+
+/**
+ * `new URL('/api/v2/...', base)` throws away any path the base carries, which silently breaks
+ * every deployment where the client sits behind a reverse proxy at a subpath. Join under the
+ * base's own path instead.
+ */
+export function endpointUrl(base: URL, path: string): URL {
+  const prefix = base.pathname.replace(/\/+$/, '');
+  const target = new URL(base.href);
+  const [pathname, search] = path.split('?');
+  target.pathname = `${prefix}${pathname}`;
+  target.search = search ?? '';
+  target.hash = '';
+  return target;
+}
+
+/**
+ * A timeout and a refusal both have to reach the operator as something they can act on, and
+ * `fetch` reports them as the same opaque `TypeError`. `label` is the client's own name so the
+ * settings form says which daemon went quiet when several are configured.
+ */
+export async function fetchClient(url: URL, init: RequestInit, label: string): Promise<Response> {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), CLIENT_REQUEST_TIMEOUT_MS);
+  try {
+    return await fetch(url, { ...init, signal: controller.signal, redirect: 'manual' });
+  } catch (error) {
+    if (error instanceof Error && error.name === 'AbortError') {
+      throw new ServiceUnavailableException(`${label} did not answer in time`);
+    }
+    throw new ServiceUnavailableException(`Could not reach ${label}: ${error instanceof Error ? error.message : String(error)}`);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+/** Daemon-side failures are temporary; authentication and request refusals remain durable 4xx. */
+export function throwForClientServerError(response: Response, label: string, operation: string): void {
+  if (response.status >= 500) throw new ServiceUnavailableException(`${label} answered ${response.status} for ${operation}`);
+}
+
+/**
+ * The `Authorization` header for a client that authenticates per request rather than holding a
+ * session. Omitted entirely when neither half is set, since a client with authentication switched
+ * off answers an empty Basic header with a 401.
+ */
+export function basicAuthHeader(username: string | null, password: string | null): Record<string, string> {
+  if (!username && !password) return {};
+  return { Authorization: `Basic ${Buffer.from(`${username ?? ''}:${password ?? ''}`).toString('base64')}` };
+}
+
+/** A daemon's answer as text, bounded. `label` is the client's own name, for the operator. */
+export async function readClientText(response: Response, label: string): Promise<string> {
+  try {
+    return await readBoundedText(response, MAX_CLIENT_RESPONSE_BYTES);
+  } catch (error) {
+    if (error instanceof ResponseTooLargeError) throw new BadRequestException(`${label} answered with more data than BookOrbit will read`);
+    throw error;
+  }
+}
+
+/**
+ * The same, parsed. `response.json()` is deliberately not used: it reads the whole body first and
+ * only then decides it was not JSON, which is exactly the read this bounds.
+ */
+export async function readClientJson<T>(response: Response, label: string): Promise<T> {
+  const body = await readClientText(response, label);
+  try {
+    return JSON.parse(body) as T;
+  } catch {
+    throw new BadRequestException(`${label} answered with something that is not JSON`);
+  }
+}
diff --git a/server/src/modules/book-request/download-clients/adapters/deluge.adapter.test.ts b/server/src/modules/book-request/download-clients/adapters/deluge.adapter.test.ts
new file mode 100644
index 000000000..bef92d927
--- /dev/null
+++ b/server/src/modules/book-request/download-clients/adapters/deluge.adapter.test.ts
@@ -0,0 +1,469 @@
+import { BadRequestException } from '@nestjs/common';
+
+import type { ResolvedClientConfig } from '../download-client-adapter';
+import { DelugeAdapter } from './deluge.adapter';
+
+const INFO_HASH = 'c9e15763f722f23e98a29decdfae341b98d53056';
+const SESSION_COOKIE = '_session_id=abc123';
+
+function config(overrides: Partial<ResolvedClientConfig> = {}): ResolvedClientConfig {
+  return {
+    id: 1,
+    name: 'local deluge',
+    adapterType: 'deluge',
+    // 127.0.0.1 needs the per-row private opt-in, which is exactly how a LAN client is configured.
+    baseUrl: 'http://127.0.0.1:8112',
+    username: null,
+    password: 'deluge',
+    category: 'bookorbit',
+    allowPrivateAddress: true,
+    settings: null,
+    ...overrides,
+  };
+}
+
+function result(value: unknown, init: { setCookie?: string } = {}): Response {
+  const headers = new Headers();
+  if (init.setCookie) headers.append('set-cookie', init.setCookie);
+  return new Response(JSON.stringify({ id: 1, result: value, error: null }), { status: 200, headers });
+}
+
+function failure(message: string, code?: number): Response {
+  return new Response(JSON.stringify({ id: 1, result: null, error: { message, code } }), { status: 200 });
+}
+
+interface RpcCall {
+  url: string;
+  method: string;
+  params: unknown[];
+  cookie: string | null;
+}
+
+/** Every call is a POST to the same endpoint, so the mock dispatches on the RPC method instead. */
+function mockRpc() {
+  const calls: RpcCall[] = [];
+  const handlers = new Map<string, () => Response>([
+    ['auth.login', () => result(true, { setCookie: `${SESSION_COOKIE}; Path=/; HttpOnly` })],
+    ['web.connected', () => result(true)],
+    ['core.get_enabled_plugins', () => result([])],
+  ]);
+
+  const fetchMock = vi.fn((url: URL | string, init: RequestInit = {}) => {
+    const body = JSON.parse(init.body as string) as { method: string; params: unknown[] };
+    const headers = new Headers(init.headers as HeadersInit);
+    calls.push({ url: url.toString(), method: body.method, params: body.params, cookie: headers.get('cookie') });
+
+    const handler = handlers.get(body.method);
+    return Promise.resolve(handler ? handler() : result(null));
+  });
+
+  vi.stubGlobal('fetch', fetchMock);
+  return { calls, handlers };
+}
+
+describe('DelugeAdapter', () => {
+  let adapter: DelugeAdapter;
+
+  beforeEach(() => {
+    adapter = new DelugeAdapter();
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  describe('base URL', () => {
+    it('keeps a reverse-proxy path prefix on every call', async () => {
+      const { calls } = mockRpc();
+      await adapter.test(config({ baseUrl: 'http://127.0.0.1:8112/deluge' }));
+
+      expect(calls.at(-1)?.url).toBe('http://127.0.0.1:8112/deluge/json');
+    });
+
+    /** Pasting the JSON endpoint itself is at least as likely as pasting the Web UI root. */
+    it('does not append the JSON path twice when the base already carries it', async () => {
+      const { calls } = mockRpc();
+      await adapter.test(config({ id: 2, baseUrl: 'http://127.0.0.1:8112/json' }));
+
+      expect(calls.at(-1)?.url).toBe('http://127.0.0.1:8112/json');
+    });
+  });
+
+  describe('session', () => {
+    /** The Web UI authenticates with a password alone; a username belongs to the daemon. */
+    it('signs in with the password and reuses the session cookie', async () => {
+      const { calls, handlers } = mockRpc();
+      handlers.set('daemon.get_version', () => result('2.1.1'));
+
+      await adapter.test(config({ username: 'admin' }));
+
+      const login = calls.find((call) => call.method === 'auth.login');
+      expect(login?.params).toEqual(['deluge']);
+      expect(calls.find((call) => call.method === 'daemon.get_version')?.cookie).toBe(SESSION_COOKIE);
+    });
+
+    it('does not sign in again while the session holds', async () => {
+      const { calls, handlers } = mockRpc();
+      handlers.set('core.get_torrents_status', () => result({}));
+
+      await adapter.test(config());
+      await adapter.status([INFO_HASH], config());
+
+      expect(calls.filter((call) => call.method === 'auth.login')).toHaveLength(1);
+    });
+
+    it('signs in again after forget, so an edited password cannot reuse a stale session', async () => {
+      const { calls } = mockRpc();
+      await adapter.test(config());
+      adapter.forget(1);
+      await adapter.test(config());
+
+      expect(calls.filter((call) => call.method === 'auth.login')).toHaveLength(2);
+    });
+
+    it('reports a rejected password as a failed test', async () => {
+      const { handlers } = mockRpc();
+      handlers.set('auth.login', () => result(false));
+
+      await expect(adapter.test(config())).resolves.toEqual({ success: false, error: 'Deluge rejected that password' });
+    });
+
+    /**
+     * The Web UI is a separate process from the daemon that holds the torrents, and a freshly
+     * started one is attached to nothing. Every call then answers "not connected" while the
+     * password was perfectly good.
+     */
+    it('attaches the Web UI to a daemon when it is not already connected', async () => {
+      const { calls, handlers } = mockRpc();
+      handlers.set('web.connected', () => result(false));
+      handlers.set('web.get_hosts', () => result([['host-1', '127.0.0.1', 58846, 'localclient']]));
+
+      await adapter.test(config());
+
+      expect(calls.find((call) => call.method === 'web.connect')?.params).toEqual(['host-1']);
+    });
+
+    it('fails the test when no known host accepts a connection', async () => {
+      const { handlers } = mockRpc();
+      handlers.set('web.connected', () => result(false));
+      handlers.set('web.get_hosts', () => result([['host-1', '127.0.0.1', 58846, 'localclient']]));
+      handlers.set('web.connect', () => failure('Connection refused'));
+
+      const outcome = await adapter.test(config());
+      expect(outcome.success).toBe(false);
+      expect(outcome.error).toContain('not connected to a daemon');
+    });
+
+    /** An expired session is reported as an ordinary error on whatever call hit it. */
+    it('signs in again and retries when the session has lapsed', async () => {
+      const { calls, handlers } = mockRpc();
+      let asked = 0;
+      handlers.set('core.get_torrents_status', () => {
+        asked += 1;
+        return asked === 1 ? failure('Not authenticated', 1) : result({});
+      });
+
+      await expect(adapter.status([INFO_HASH], config())).resolves.toEqual([]);
+      expect(calls.filter((call) => call.method === 'auth.login')).toHaveLength(2);
+    });
+  });
+
+  describe('add', () => {
+    it('posts a magnet unpaused and returns the id the client answered with', async () => {
+      const { calls, handlers } = mockRpc();
+      handlers.set('core.add_torrent_magnet', () => result(INFO_HASH));
+
+      await expect(adapter.add({ magnet: `magnet:?xt=urn:btih:${INFO_HASH}`, infoHash: INFO_HASH }, config())).resolves.toEqual({
+        clientHash: INFO_HASH,
+      });
+
+      const add = calls.find((call) => call.method === 'core.add_torrent_magnet');
+      expect(add?.params[0]).toBe(`magnet:?xt=urn:btih:${INFO_HASH}`);
+      expect(add?.params[1]).toEqual({ add_paused: false });
+    });
+
+    it('uploads a .torrent as base64 alongside its name', async () => {
+      const { calls, handlers } = mockRpc();
+      handlers.set('core.add_torrent_file', () => result(INFO_HASH));
+
+      await adapter.add({ torrentFile: Buffer.from('d4:infod4:name4:duneee'), torrentFileName: 'dune.torrent', infoHash: INFO_HASH }, config());
+
+      const add = calls.find((call) => call.method === 'core.add_torrent_file');
+      expect(add?.params[0]).toBe('dune.torrent');
+      expect(add?.params[1]).toBe(Buffer.from('d4:infod4:name4:duneee').toString('base64'));
+    });
+
+    it('sets the seed ratio goal so the client, not BookOrbit, enforces it', async () => {
+      const { calls, handlers } = mockRpc();
+      handlers.set('core.add_torrent_magnet', () => result(INFO_HASH));
+
+      await adapter.add({ magnet: `magnet:?xt=urn:btih:${INFO_HASH}`, infoHash: INFO_HASH, seedRatioGoal: 2 }, config());
+
+      expect(calls.find((call) => call.method === 'core.add_torrent_magnet')?.params[1]).toEqual({
+        add_paused: false,
+        stop_at_ratio: true,
+        stop_ratio: 2,
+        remove_at_ratio: false,
+      });
+    });
+
+    /**
+     * An earlier attempt on this release leaves its torrent behind when the import fails. Deluge
+     * refuses it outright rather than adopting it, so without this every retry of that release
+     * would be refused forever.
+     */
+    it('adopts a torrent the client already holds', async () => {
+      const { handlers } = mockRpc();
+      handlers.set('core.add_torrent_magnet', () => failure('Torrent already in session'));
+      handlers.set('core.get_torrents_status', () => result({ [INFO_HASH]: { hash: INFO_HASH } }));
+
+      await expect(adapter.add({ magnet: `magnet:?xt=urn:btih:${INFO_HASH}`, infoHash: INFO_HASH }, config())).resolves.toEqual({
+        clientHash: INFO_HASH,
+      });
+    });
+
+    it('surfaces a refusal the client cannot account for with a held torrent', async () => {
+      const { handlers } = mockRpc();
+      handlers.set('core.add_torrent_magnet', () => failure('Unable to add torrent'));
+      handlers.set('core.get_torrents_status', () => result({}));
+
+      await expect(adapter.add({ magnet: `magnet:?xt=urn:btih:${INFO_HASH}`, infoHash: INFO_HASH }, config())).rejects.toThrow(BadRequestException);
+    });
+
+    it('rejects a grab carrying neither a magnet nor a file', async () => {
+      mockRpc();
+      await expect(adapter.add({ infoHash: INFO_HASH }, config())).rejects.toThrow(BadRequestException);
+    });
+
+    describe('labels', () => {
+      it('labels the torrent when the Label plugin is enabled', async () => {
+        const { calls, handlers } = mockRpc();
+        handlers.set('core.get_enabled_plugins', () => result(['Label']));
+        handlers.set('core.add_torrent_magnet', () => result(INFO_HASH));
+
+        await adapter.add({ magnet: `magnet:?xt=urn:btih:${INFO_HASH}`, infoHash: INFO_HASH }, config());
+
+        expect(calls.find((call) => call.method === 'label.add')?.params).toEqual(['bookorbit']);
+        expect(calls.find((call) => call.method === 'label.set_torrent')?.params).toEqual([INFO_HASH, 'bookorbit']);
+      });
+
+      /** The plugin accepts lowercase letters, digits, dashes and underscores only. */
+      it('folds a category the plugin would refuse into a usable label', async () => {
+        const { calls, handlers } = mockRpc();
+        handlers.set('core.get_enabled_plugins', () => result(['Label']));
+        handlers.set('core.add_torrent_magnet', () => result(INFO_HASH));
+
+        await adapter.add({ magnet: `magnet:?xt=urn:btih:${INFO_HASH}`, infoHash: INFO_HASH }, config({ category: 'Book Orbit v2.0' }));
+
+        expect(calls.find((call) => call.method === 'label.add')?.params).toEqual(['book-orbit-v2-0']);
+      });
+
+      it('skips labelling entirely when the plugin is not enabled', async () => {
+        const { calls, handlers } = mockRpc();
+        handlers.set('core.add_torrent_magnet', () => result(INFO_HASH));
+
+        await adapter.add({ magnet: `magnet:?xt=urn:btih:${INFO_HASH}`, infoHash: INFO_HASH }, config());
+
+        expect(calls.some((call) => call.method.startsWith('label.'))).toBe(false);
+      });
+
+      /**
+       * The torrent is already downloading by the time a label is applied, and nothing in the poll
+       * loop finds it by label, so a labelling failure must not lose the grab.
+       */
+      it('keeps the grab when the label cannot be applied', async () => {
+        const { handlers } = mockRpc();
+        handlers.set('core.get_enabled_plugins', () => result(['Label']));
+        handlers.set('core.add_torrent_magnet', () => result(INFO_HASH));
+        handlers.set('label.set_torrent', () => failure('Unknown label'));
+
+        await expect(adapter.add({ magnet: `magnet:?xt=urn:btih:${INFO_HASH}`, infoHash: INFO_HASH }, config())).resolves.toEqual({
+          clientHash: INFO_HASH,
+        });
+      });
+    });
+  });
+
+  describe('status', () => {
+    /** An empty id filter means every torrent to Deluge, not none of them. */
+    it('asks nothing when there is nothing in flight', async () => {
+      const { calls } = mockRpc();
+      await expect(adapter.status([], config())).resolves.toEqual([]);
+      expect(calls).toHaveLength(0);
+    });
+
+    it('maps a downloading torrent onto progress and a content path', async () => {
+      const { handlers } = mockRpc();
+      handlers.set('core.get_torrents_status', () =>
+        result({
+          [INFO_HASH]: {
+            hash: INFO_HASH,
+            name: 'Dune',
+            state: 'Downloading',
+            progress: 50,
+            total_done: 512,
+            total_wanted: 1024,
+            download_location: '/downloads',
+          },
+        }),
+      );
+
+      await expect(adapter.status([INFO_HASH], config())).resolves.toEqual([
+        expect.objectContaining({
+          infoHash: INFO_HASH,
+          state: 'downloading',
+          progressPercent: 50,
+          downloadedBytes: 512,
+          totalBytes: 1024,
+          contentPath: '/downloads/Dune',
+        }),
+      ]);
+    });
+
+    /** 1.3 knows only `save_path`, which is the same folder under the older spelling. */
+    it('falls back to the older save path spelling', async () => {
+      const { handlers } = mockRpc();
+      handlers.set('core.get_torrents_status', () =>
+        result({ [INFO_HASH]: { hash: INFO_HASH, name: 'Dune', state: 'Downloading', save_path: '/data' } }),
+      );
+
+      const [status] = await adapter.status([INFO_HASH], config());
+      expect(status.contentPath).toBe('/data/Dune');
+    });
+
+    it('reports a seeding torrent as completed with its ratio goal', async () => {
+      const { handlers } = mockRpc();
+      handlers.set('core.get_torrents_status', () =>
+        result({
+          [INFO_HASH]: {
+            hash: INFO_HASH,
+            state: 'Seeding',
+            progress: 100,
+            ratio: 1.5,
+            stop_at_ratio: true,
+            stop_ratio: 2,
+            seeding_time: 600,
+            total_uploaded: 2048,
+          },
+        }),
+      );
+
+      const [status] = await adapter.status([INFO_HASH], config());
+      expect(status.state).toBe('completed');
+      expect(status.seed).toEqual({
+        seeding: true,
+        ratio: 1.5,
+        ratioGoal: 2,
+        seedingTimeSeconds: 600,
+        // Deluge enforces no seed-time goal, and claiming one it does not hold to would be worse
+        // than reporting none.
+        seedingTimeGoalMinutes: null,
+        uploadedBytes: 2048,
+      });
+    });
+
+    it('does not report a ratio the client is not holding the torrent to', async () => {
+      const { handlers } = mockRpc();
+      handlers.set('core.get_torrents_status', () =>
+        result({ [INFO_HASH]: { hash: INFO_HASH, state: 'Seeding', stop_at_ratio: false, stop_ratio: 2 } }),
+      );
+
+      const [status] = await adapter.status([INFO_HASH], config());
+      expect(status.seed?.ratioGoal).toBeNull();
+    });
+
+    /** Paused covers a held download and a finished torrent alike. */
+    it('tells a finished paused torrent from a held one', async () => {
+      const { handlers } = mockRpc();
+      handlers.set('core.get_torrents_status', () =>
+        result({
+          [INFO_HASH]: { hash: INFO_HASH, state: 'Paused', progress: 100, is_finished: true },
+          ['b'.repeat(40)]: { hash: 'b'.repeat(40), state: 'Paused', progress: 30 },
+        }),
+      );
+
+      const statuses = await adapter.status([INFO_HASH, 'b'.repeat(40)], config());
+      expect(statuses.map((status) => status.state)).toEqual(['completed', 'queued']);
+    });
+
+    it('treats an error state as failed and carries its message', async () => {
+      const { handlers } = mockRpc();
+      handlers.set('core.get_torrents_status', () =>
+        result({ [INFO_HASH]: { hash: INFO_HASH, state: 'Error', message: 'No space left on device' } }),
+      );
+
+      const [status] = await adapter.status([INFO_HASH], config());
+      expect(status.state).toBe('failed');
+      expect(status.errorMessage).toBe('No space left on device');
+    });
+
+    /**
+     * A refused announce leaves the torrent in an ordinary downloading state that will never find
+     * a peer, so the tracker's own answer is the only thing that tells it apart.
+     */
+    it('reports a refused announce as a tracker error without failing the download', async () => {
+      const { handlers } = mockRpc();
+      handlers.set('core.get_torrents_status', () =>
+        result({ [INFO_HASH]: { hash: INFO_HASH, state: 'Downloading', tracker_status: 'tracker.example.com: Error: unregistered torrent' } }),
+      );
+
+      const [status] = await adapter.status([INFO_HASH], config());
+      expect(status.state).toBe('downloading');
+      expect(status.trackerError).toBe('tracker.example.com: Error: unregistered torrent');
+    });
+
+    it('says nothing about a tracker that is announcing normally', async () => {
+      const { handlers } = mockRpc();
+      handlers.set('core.get_torrents_status', () =>
+        result({ [INFO_HASH]: { hash: INFO_HASH, state: 'Downloading', tracker_status: 'Announce OK' } }),
+      );
+
+      const [status] = await adapter.status([INFO_HASH], config());
+      expect(status.trackerError).toBeUndefined();
+    });
+
+    it('ignores a torrent the poll did not ask about', async () => {
+      const { handlers } = mockRpc();
+      handlers.set('core.get_torrents_status', () => result({ ['f'.repeat(40)]: { hash: 'f'.repeat(40), state: 'Downloading' } }));
+
+      await expect(adapter.status([INFO_HASH], config())).resolves.toEqual([]);
+    });
+  });
+
+  describe('remove', () => {
+    it('leaves the files alone unless deletion was asked for', async () => {
+      const { calls, handlers } = mockRpc();
+      handlers.set('core.remove_torrent', () => result(true));
+
+      await adapter.remove(INFO_HASH.toUpperCase(), config(), { deleteFiles: false });
+
+      expect(calls.find((call) => call.method === 'core.remove_torrent')?.params).toEqual([INFO_HASH, false]);
+    });
+
+    /** Deluge answers a torrent it does not hold with `false` rather than an error. */
+    it('refuses to report a removal that did nothing as a success', async () => {
+      const { handlers } = mockRpc();
+      handlers.set('core.remove_torrent', () => result(false));
+
+      await expect(adapter.remove(INFO_HASH, config(), { deleteFiles: true })).rejects.toThrow(BadRequestException);
+    });
+  });
+
+  describe('test', () => {
+    it('reports the version the daemon answers with', async () => {
+      const { handlers } = mockRpc();
+      handlers.set('daemon.get_version', () => result('2.1.1'));
+
+      await expect(adapter.test(config())).resolves.toEqual({ success: true, version: '2.1.1' });
+    });
+
+    /** 1.3 answers only the older spelling, and a refusal there means nothing else. */
+    it('falls back to the 1.3 spelling of the version call', async () => {
+      const { handlers } = mockRpc();
+      handlers.set('daemon.get_version', () => failure('Unknown method'));
+      handlers.set('daemon.info', () => result('1.3.15'));
+
+      await expect(adapter.test(config())).resolves.toEqual({ success: true, version: '1.3.15' });
+    });
+  });
+});
diff --git a/server/src/modules/book-request/download-clients/adapters/deluge.adapter.ts b/server/src/modules/book-request/download-clients/adapters/deluge.adapter.ts
new file mode 100644
index 000000000..57d5d3906
--- /dev/null
+++ b/server/src/modules/book-request/download-clients/adapters/deluge.adapter.ts
@@ -0,0 +1,443 @@
+import { BadRequestException, Injectable, Logger } from '@nestjs/common';
+import type { DownloadClientTestResult } from '@bookorbit/types';
+
+import { ensureSafeUrl } from '../../../../common/utils/ssrf.utils';
+import { sanitizeLogValue } from '../../../../common/utils/log-sanitize.utils';
+import type {
+  DownloadClientAdapter,
+  DownloadState,
+  DownloadStatus,
+  GrabPayload,
+  OwnedDownloadClientInventory,
+  ResolvedClientConfig,
+  SeedInfo,
+} from '../download-client-adapter';
+import { endpointUrl, fetchClient, readClientJson, throwForClientServerError } from './client-http.utils';
+
+const LABEL = 'Deluge';
+const JSON_PATH = '/json';
+/** Deluge's web session lasts an hour by default; re-login well before it lapses. */
+const SESSION_TTL_MS = 30 * 60 * 1000;
+/** A Web UI with a long host list is misconfigured rather than interesting, so stop trying. */
+const HOST_ATTEMPT_LIMIT = 5;
+const RECONCILIATION_LIMIT = 1000;
+
+/**
+ * Asked for on every poll. Both spellings of the download folder are requested because 1.3 knows
+ * only `save_path` and 2.x moved it to `download_location`; an unknown key is simply absent.
+ */
+const STATUS_FIELDS = [
+  'hash',
+  'name',
+  'state',
+  'progress',
+  'total_done',
+  'total_size',
+  'total_wanted',
+  'download_location',
+  'save_path',
+  'ratio',
+  'stop_ratio',
+  'stop_at_ratio',
+  'seeding_time',
+  'total_uploaded',
+  'is_finished',
+  'message',
+  'tracker_status',
+  'label',
+];
+
+const STATE_BY_DELUGE: Record<string, DownloadState> = {
+  Downloading: 'downloading',
+  Seeding: 'completed',
+  Error: 'failed',
+  Queued: 'queued',
+  Checking: 'queued',
+  Allocating: 'queued',
+  Moving: 'queued',
+};
+
+interface DelugeTorrent {
+  hash?: string;
+  name?: string;
+  state?: string;
+  /** Already a percentage, unlike qBittorrent's fraction. */
+  progress?: number;
+  total_done?: number;
+  total_size?: number;
+  total_wanted?: number;
+  download_location?: string;
+  save_path?: string;
+  ratio?: number;
+  stop_ratio?: number;
+  stop_at_ratio?: boolean;
+  seeding_time?: number;
+  total_uploaded?: number;
+  is_finished?: boolean;
+  message?: string;
+  tracker_status?: string;
+  label?: string;
+}
+
+interface DelugeError {
+  message?: string;
+  code?: number;
+}
+
+interface DelugeReply<T> {
+  result?: T;
+  error?: DelugeError | null;
+  /** Only set by the login call, which is the one answer that establishes a session. */
+  cookie: string | null;
+}
+
+interface DelugeSession {
+  cookie: string;
+  expiresAt: number;
+  /** The Label plugin is optional and off by default, so labelling is conditional on it. */
+  labelPlugin: boolean;
+}
+
+@Injectable()
+export class DelugeAdapter implements DownloadClientAdapter {
+  readonly type = 'deluge' as const;
+  readonly label = LABEL;
+  readonly delivers = 'torrent' as const;
+
+  private readonly logger = new Logger(DelugeAdapter.name);
+  private readonly sessions = new Map<number, DelugeSession>();
+  private requestId = 0;
+
+  async add(release: GrabPayload, config: ResolvedClientConfig): Promise<{ clientHash: string }> {
+    if (!release.torrentFile && !release.magnet) {
+      throw new BadRequestException('A grab needs either a magnet link or a .torrent file');
+    }
+
+    const options: Record<string, unknown> = { add_paused: false };
+    // The client enforces the goal, BookOrbit never stops a seed itself. Deluge has no seed-time
+    // goal of any kind, so a tracker's minimum time is left seeding rather than stopped early.
+    if (release.seedRatioGoal !== undefined) {
+      options.stop_at_ratio = true;
+      options.stop_ratio = release.seedRatioGoal;
+      options.remove_at_ratio = false;
+    }
+
+    let hash: string;
+    try {
+      const added = release.torrentFile
+        ? await this.rpc<string | null>(config, 'core.add_torrent_file', [
+            release.torrentFileName ?? 'upload.torrent',
+            release.torrentFile.toString('base64'),
+            options,
+          ])
+        : await this.rpc<string | null>(config, 'core.add_torrent_magnet', [release.magnet, options]);
+      hash = (added ?? release.infoHash).toLowerCase();
+    } catch (error) {
+      // Deluge refuses a torrent it already holds outright rather than adopting it. An earlier
+      // attempt on this release leaves its torrent behind when the import fails, and without this
+      // every retry of that release is refused forever. Only the client can say which case it is.
+      if (!(await this.holds(release.infoHash, config))) throw error;
+      this.logger.log(
+        `[download_client.add] [end] clientId=${config.id} hash=${release.infoHash.toLowerCase()} adopted=true - the client already held this torrent`,
+      );
+      hash = release.infoHash.toLowerCase();
+    }
+
+    await this.applyLabel(hash, config);
+    return { clientHash: hash };
+  }
+
+  /**
+   * Whether the client is already holding this exact infohash. Any failure to find out answers
+   * "no", so an unreachable client surfaces the add failure rather than a false success.
+   */
+  private async holds(infoHash: string, config: ResolvedClientConfig): Promise<boolean> {
+    const hash = infoHash.toLowerCase();
+    try {
+      const result = await this.rpc<Record<string, DelugeTorrent> | null>(config, 'core.get_torrents_status', [{ id: [hash] }, ['hash']]);
+      return Object.keys(result ?? {}).some((key) => key.toLowerCase() === hash);
+    } catch {
+      return false;
+    }
+  }
+
+  /**
+   * Deluge has no categories. The Label plugin is the closest equivalent and is off by default,
+   * so this is best-effort: the torrent is already downloading by now, nothing in the poll loop
+   * finds it by label, and failing the grab over a missing plugin would help nobody.
+   */
+  private async applyLabel(hash: string, config: ResolvedClientConfig): Promise<void> {
+    const session = await this.session(config);
+    if (!session.labelPlugin) return;
+
+    const label = toLabelId(config.category);
+    if (!label) return;
+
+    try {
+      // Adding a label that already exists is an error rather than a no-op, and the plugin offers
+      // no "create if missing", so the refusal is the normal path from the second torrent onwards.
+      await this.rpc(config, 'label.add', [label]).catch(() => undefined);
+      await this.rpc(config, 'label.set_torrent', [hash, label]);
+    } catch (error) {
+      const detail = error instanceof Error ? error.message : String(error);
+      this.logger.warn(
+        `[download_client.label] [fail] clientId=${config.id} hash=${hash} error="${sanitizeLogValue(detail)}" - the torrent was added but could not be labelled`,
+      );
+    }
+  }
+
+  async status(hashes: string[], config: ResolvedClientConfig): Promise<DownloadStatus[]> {
+    // An empty id filter means every torrent to Deluge, and answering a poll about nothing with
+    // the entire queue would be worse than useless.
+    if (hashes.length === 0) return [];
+
+    const wanted = [...new Set(hashes.map((hash) => hash.toLowerCase()))];
+    // Unbatched on purpose: this is a POST body rather than a query string, so the URL length that
+    // forces qBittorrent to poll in chunks does not apply.
+    const result = await this.rpc<Record<string, DelugeTorrent> | null>(config, 'core.get_torrents_status', [{ id: wanted }, STATUS_FIELDS]);
+    const asked = new Set(wanted);
+
+    return Object.entries(result ?? {}).flatMap(([key, entry]) => {
+      const hash = (entry?.hash ?? key).toLowerCase();
+      if (!asked.has(hash)) return [];
+      return [toDownloadStatus(hash, entry ?? {})];
+    });
+  }
+
+  async listOwned(config: ResolvedClientConfig): Promise<OwnedDownloadClientInventory> {
+    const session = await this.session(config);
+    const label = toLabelId(config.category);
+    if (!session.labelPlugin || !label) return { supported: false, truncated: false, items: [] };
+
+    const result = await this.rpc<Record<string, DelugeTorrent> | null>(config, 'core.get_torrents_status', [{ label }, STATUS_FIELDS]);
+    const owned = Object.entries(result ?? {}).filter(([, entry]) => entry.label === undefined || entry.label === label);
+    return {
+      supported: true,
+      truncated: owned.length > RECONCILIATION_LIMIT,
+      items: owned.slice(0, RECONCILIATION_LIMIT).map(([key, entry]) => {
+        const hash = (entry.hash ?? key).toLowerCase();
+        return { ...toDownloadStatus(hash, entry), name: entry.name?.trim() || hash };
+      }),
+    };
+  }
+
+  async remove(hash: string, config: ResolvedClientConfig, opts: { deleteFiles: boolean }): Promise<void> {
+    const removed = await this.rpc<boolean>(config, 'core.remove_torrent', [hash.toLowerCase(), opts.deleteFiles]);
+    // Deluge answers a torrent it does not hold with `false` rather than an error, and a removal
+    // that silently did nothing must not read as a success to the caller cleaning up after it.
+    if (removed === false) throw new BadRequestException('Deluge did not remove that torrent');
+  }
+
+  async test(config: ResolvedClientConfig): Promise<DownloadClientTestResult> {
+    try {
+      return { success: true, version: await this.version(config) };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      this.logger.warn(`[download_client.test] [fail] clientId=${config.id} error="${sanitizeLogValue(message)}" - Deluge connection test failed`);
+      return { success: false, error: message };
+    }
+  }
+
+  /** Deluge 2 renamed this call; 1.3 answers only the old spelling. */
+  private async version(config: ResolvedClientConfig): Promise<string | undefined> {
+    try {
+      const modern = await this.rpc<string>(config, 'daemon.get_version', []);
+      if (typeof modern === 'string' && modern.trim()) return modern.trim();
+    } catch {
+      // Falls through to the 1.3 spelling, which is the only thing this refusal can mean.
+    }
+    const legacy = await this.rpc<string>(config, 'daemon.info', []);
+    return typeof legacy === 'string' ? legacy.trim() : undefined;
+  }
+
+  /** Drops the cached session so the next call re-authenticates against the current config. */
+  forget(clientId: number): void {
+    this.sessions.delete(clientId);
+  }
+
+  private async rpc<T>(config: ResolvedClientConfig, method: string, params: unknown[], retryOnAuthFailure = true): Promise<T> {
+    const session = await this.session(config);
+    const base = await this.resolveBaseUrl(config);
+    const reply = await this.post<T>(base, session.cookie, method, params);
+
+    if (reply.error) {
+      // An expired session is reported as an ordinary error on whatever call hit it, so it looks
+      // exactly like a refusal until the retry succeeds.
+      if (retryOnAuthFailure && isAuthFailure(reply.error)) {
+        this.sessions.delete(config.id);
+        return this.rpc<T>(config, method, params, false);
+      }
+      throw new BadRequestException(`Deluge refused ${method}: ${reply.error.message?.trim() || 'no reason given'}`);
+    }
+    return reply.result as T;
+  }
+
+  private async session(config: ResolvedClientConfig): Promise<DelugeSession> {
+    const cached = this.sessions.get(config.id);
+    if (cached && cached.expiresAt > Date.now()) return cached;
+
+    const base = await this.resolveBaseUrl(config);
+    // The Web UI authenticates with a password alone. Any username on the row belongs to the
+    // daemon rather than to this interface, so sending it here would only be refused.
+    const login = await this.post<boolean>(base, null, 'auth.login', [config.password ?? '']);
+    if (login.error) throw new BadRequestException(`Deluge refused the login: ${login.error.message?.trim() || 'no reason given'}`);
+    if (login.result !== true) throw new BadRequestException('Deluge rejected that password');
+    if (!login.cookie) throw new BadRequestException('Deluge accepted the password but issued no session');
+
+    await this.ensureDaemon(base, login.cookie);
+    const plugins = await this.post<string[]>(base, login.cookie, 'core.get_enabled_plugins', []);
+
+    const session: DelugeSession = {
+      cookie: login.cookie,
+      expiresAt: Date.now() + SESSION_TTL_MS,
+      labelPlugin: Array.isArray(plugins.result) && plugins.result.includes('Label'),
+    };
+    this.sessions.set(config.id, session);
+    return session;
+  }
+
+  /**
+   * The Web UI is a separate process from the daemon that holds the torrents, and a freshly
+   * started one is attached to nothing. Every call then answers "not connected" while the password
+   * was perfectly good, so a session is not usable until a daemon is attached to it.
+   */
+  private async ensureDaemon(base: URL, cookie: string): Promise<void> {
+    const connected = await this.post<boolean>(base, cookie, 'web.connected', []);
+    if (connected.result === true) return;
+
+    const hosts = await this.post<unknown[][]>(base, cookie, 'web.get_hosts', []);
+    const candidates = Array.isArray(hosts.result) ? hosts.result.slice(0, HOST_ATTEMPT_LIMIT) : [];
+    for (const host of candidates) {
+      const hostId = Array.isArray(host) ? host[0] : null;
+      if (typeof hostId !== 'string') continue;
+      const attempt = await this.post(base, cookie, 'web.connect', [hostId]);
+      if (!attempt.error) return;
+    }
+    throw new BadRequestException('Deluge is not connected to a daemon, and none of the hosts it knows about accepted a connection');
+  }
+
+  /** One JSON-RPC call. Deliberately below the session layer, so establishing one can use it. */
+  private async post<T>(base: URL, cookie: string | null, method: string, params: unknown[]): Promise<DelugeReply<T>> {
+    this.requestId += 1;
+    const response = await fetchClient(
+      endpointUrl(base, jsonPath(base)),
+      {
+        method: 'POST',
+        body: JSON.stringify({ method, params, id: this.requestId }),
+        headers: { 'Content-Type': 'application/json', ...(cookie ? { Cookie: cookie } : {}) },
+      },
+      LABEL,
+    );
+
+    if (!response.ok) {
+      throwForClientServerError(response, LABEL, method);
+      throw new BadRequestException(`Deluge answered ${response.status} for ${method}`);
+    }
+
+    const payload = await readClientJson<{ result?: T; error?: DelugeError | null }>(response, LABEL);
+    return { result: payload.result, error: payload.error ?? null, cookie: extractSessionCookie(response) };
+  }
+
+  private async resolveBaseUrl(config: ResolvedClientConfig): Promise<URL> {
+    return ensureSafeUrl(config.baseUrl, { allowPrivate: config.allowPrivateAddress });
+  }
+}
+
+/**
+ * An operator may paste the Web UI's root or the JSON endpoint itself, and appending the path to a
+ * URL that already carries it produces a 404 that reads like the client is down.
+ */
+function jsonPath(base: URL): string {
+  return /\/json\/?$/.test(base.pathname) ? '' : JSON_PATH;
+}
+
+/**
+ * The Label plugin accepts lowercase letters, digits, dashes and underscores only, while the
+ * category field allows spaces and dots. Folding rather than refusing: the category is already
+ * saved, and a label is a convenience the operator should not have to re-type to get.
+ */
+function toLabelId(category: string): string | null {
+  const label = category
+    .trim()
+    .toLowerCase()
+    .replace(/[^a-z0-9_-]+/g, '-')
+    .replace(/^-+|-+$/g, '');
+  return label || null;
+}
+
+/**
+ * Deluge reports an expired session as an ordinary RPC error on the call that hit it. The code is
+ * matched first because the message is localised in some builds.
+ */
+function isAuthFailure(error: DelugeError): boolean {
+  return error.code === 1 || /not authenticated|auth/i.test(error.message ?? '');
+}
+
+function extractSessionCookie(response: Response): string | null {
+  const headers = response.headers as Headers & { getSetCookie?: () => string[] };
+  const raw = headers.getSetCookie?.() ?? [response.headers.get('set-cookie') ?? ''];
+  for (const value of raw) {
+    const match = /(?:^|;\s*)(_session_id=[^;]+)/.exec(value);
+    if (match) return match[1];
+  }
+  return null;
+}
+
+function toDownloadStatus(hash: string, entry: DelugeTorrent): DownloadStatus {
+  const totalBytes = entry.total_wanted ?? entry.total_size ?? null;
+  const state = mapState(entry);
+  const tracker = trackerFailure(entry);
+  return {
+    infoHash: hash,
+    state,
+    progressPercent: Math.max(0, Math.min(100, Math.round(entry.progress ?? 0))),
+    downloadedBytes: entry.total_done ?? 0,
+    totalBytes: typeof totalBytes === 'number' && totalBytes > 0 ? totalBytes : null,
+    contentPath: contentPath(entry),
+    seed: toSeedInfo(entry),
+    errorMessage: state === 'failed' ? entry.message?.trim() || 'Deluge reported an error state' : undefined,
+    ...(tracker ? { trackerError: tracker } : {}),
+  };
+}
+
+/** Deluge reports the folder and the name apart; everything downstream wants the content. */
+function contentPath(entry: DelugeTorrent): string | null {
+  const dir = (entry.download_location ?? entry.save_path)?.trim();
+  if (!dir) return null;
+  const name = entry.name?.trim();
+  return name ? `${dir.replace(/\/+$/, '')}/${name}` : dir;
+}
+
+/**
+ * Deluge folds every tracker's answer into one string per torrent. A torrent whose announce is
+ * refused stays in `Downloading` indefinitely, looking exactly like one that has not found a peer
+ * yet, so this string is the only thing that tells the two apart.
+ */
+function trackerFailure(entry: DelugeTorrent): string | null {
+  const status = entry.tracker_status?.trim();
+  if (!status || !/error/i.test(status)) return null;
+  return status.slice(0, 200);
+}
+
+function toSeedInfo(entry: DelugeTorrent): SeedInfo {
+  return {
+    seeding: entry.state === 'Seeding',
+    ratio: typeof entry.ratio === 'number' && entry.ratio >= 0 ? entry.ratio : null,
+    // `stop_ratio` carries a number whether or not it is being enforced, so the flag beside it is
+    // what decides whether this torrent has a goal at all.
+    ratioGoal: entry.stop_at_ratio === true && typeof entry.stop_ratio === 'number' ? entry.stop_ratio : null,
+    seedingTimeSeconds: typeof entry.seeding_time === 'number' && entry.seeding_time >= 0 ? entry.seeding_time : null,
+    // Deluge has no seed-time goal to report, and claiming one it does not enforce would be worse
+    // than saying there is none.
+    seedingTimeGoalMinutes: null,
+    uploadedBytes: typeof entry.total_uploaded === 'number' && entry.total_uploaded >= 0 ? entry.total_uploaded : null,
+  };
+}
+
+function mapState(entry: DelugeTorrent): DownloadState {
+  if (!entry.state) return 'unknown';
+  // Paused covers a held download and a finished torrent that reached its goal alike, and only
+  // the completion tells the two apart.
+  if (entry.state === 'Paused') return entry.is_finished === true || (entry.progress ?? 0) >= 100 ? 'completed' : 'queued';
+  return STATE_BY_DELUGE[entry.state] ?? 'unknown';
+}
diff --git a/server/src/modules/book-request/download-clients/adapters/qbittorrent.adapter.test.ts b/server/src/modules/book-request/download-clients/adapters/qbittorrent.adapter.test.ts
new file mode 100644
index 000000000..b0099d186
--- /dev/null
+++ b/server/src/modules/book-request/download-clients/adapters/qbittorrent.adapter.test.ts
@@ -0,0 +1,401 @@
+import { BadRequestException } from '@nestjs/common';
+
+import type { ResolvedClientConfig } from '../download-client-adapter';
+import { QbittorrentAdapter } from './qbittorrent.adapter';
+
+const INFO_HASH = 'c9e15763f722f23e98a29decdfae341b98d53056';
+
+function config(overrides: Partial<ResolvedClientConfig> = {}): ResolvedClientConfig {
+  return {
+    id: 1,
+    name: 'local qbit',
+    adapterType: 'qbittorrent',
+    // 127.0.0.1 needs the per-row private opt-in, which is exactly how a LAN client is configured.
+    baseUrl: 'http://127.0.0.1:8080',
+    username: 'admin',
+    password: 'adminadmin',
+    category: 'bookorbit',
+    allowPrivateAddress: true,
+    settings: null,
+    ...overrides,
+  };
+}
+
+function response(body: string | object, init: { status?: number; setCookie?: string } = {}): Response {
+  const headers = new Headers();
+  if (init.setCookie) headers.append('set-cookie', init.setCookie);
+  const payload = typeof body === 'string' ? body : JSON.stringify(body);
+  return new Response(payload, { status: init.status ?? 200, headers });
+}
+
+function mockFetch() {
+  const calls: Array<{ url: string; init: RequestInit }> = [];
+  const handlers = new Map<string, () => Response>();
+  const fetchMock = vi.fn((url: URL | string, init: RequestInit = {}) => {
+    const href = url.toString();
+    calls.push({ url: href, init });
+    for (const [fragment, handler] of handlers) {
+      if (href.includes(fragment)) return Promise.resolve(handler());
+    }
+    return Promise.resolve(response('Ok.'));
+  });
+  vi.stubGlobal('fetch', fetchMock);
+  return { calls, handlers, fetchMock };
+}
+
+describe('QbittorrentAdapter', () => {
+  let adapter: QbittorrentAdapter;
+
+  beforeEach(() => {
+    adapter = new QbittorrentAdapter();
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  /**
+   * A reverse proxy at a subpath is an ordinary way to expose qBittorrent, and `new URL(path,
+   * base)` throws the prefix away without complaining: every call would quietly hit the wrong
+   * endpoint on the right host.
+   */
+  describe('base URL', () => {
+    it('keeps a reverse-proxy path prefix on every call', async () => {
+      const { calls } = mockFetch();
+      await adapter.test(config({ baseUrl: 'http://127.0.0.1:8080/qbt' }));
+
+      expect(calls.map((call) => call.url)).toEqual(['http://127.0.0.1:8080/qbt/api/v2/auth/login', 'http://127.0.0.1:8080/qbt/api/v2/app/version']);
+    });
+
+    it('tolerates a trailing slash without doubling it', async () => {
+      const { calls, handlers } = mockFetch();
+      handlers.set('torrents/info', () => response([]));
+      await adapter.status([INFO_HASH], config({ id: 2, baseUrl: 'http://127.0.0.1:8080/qbt/' }));
+
+      expect(calls.at(-1)?.url).toBe(`http://127.0.0.1:8080/qbt/api/v2/torrents/info?hashes=${INFO_HASH}`);
+    });
+
+    it('is unchanged for a client mounted at the root', async () => {
+      const { calls } = mockFetch();
+      await adapter.test(config({ id: 3 }));
+      expect(calls.at(-1)?.url).toBe('http://127.0.0.1:8080/api/v2/app/version');
+    });
+  });
+
+  describe('add', () => {
+    it('posts a magnet with the configured category and returns the caller-derived hash', async () => {
+      const { calls } = mockFetch();
+
+      await expect(adapter.add({ magnet: `magnet:?xt=urn:btih:${INFO_HASH}`, infoHash: INFO_HASH }, config())).resolves.toEqual({
+        clientHash: INFO_HASH,
+      });
+
+      const add = calls.find((call) => call.url.includes('/api/v2/torrents/add'));
+      const form = add?.init.body as FormData;
+      expect(form.get('urls')).toBe(`magnet:?xt=urn:btih:${INFO_HASH}`);
+      expect(form.get('category')).toBe('bookorbit');
+    });
+
+    it('passes seed goals through so the client, not BookOrbit, enforces them', async () => {
+      const { calls } = mockFetch();
+
+      await adapter.add({ magnet: `magnet:?xt=urn:btih:${INFO_HASH}`, infoHash: INFO_HASH, seedRatioGoal: 2, seedTimeMinutes: 4320 }, config());
+
+      const form = calls.find((call) => call.url.includes('/torrents/add'))?.init.body as FormData;
+      expect(form.get('ratioLimit')).toBe('2');
+      expect(form.get('seedingTimeLimit')).toBe('4320');
+    });
+
+    it('uploads a .torrent as a file part', async () => {
+      const { calls } = mockFetch();
+
+      await adapter.add({ torrentFile: Buffer.from('d4:infod4:name4:duneee'), torrentFileName: 'dune.torrent', infoHash: INFO_HASH }, config());
+
+      const form = calls.find((call) => call.url.includes('/torrents/add'))?.init.body as FormData;
+      expect(form.get('torrents')).toBeInstanceOf(Blob);
+      expect(form.get('urls')).toBeNull();
+    });
+
+    /** qBittorrent answers "Fails." with a 200, which is the one 200 that is not success. */
+    it('treats a "Fails." body as a rejection despite the 200', async () => {
+      const { handlers } = mockFetch();
+      handlers.set('/torrents/add', () => response('Fails.'));
+      handlers.set('/torrents/info', () => response([]));
+
+      await expect(adapter.add({ magnet: `magnet:?xt=urn:btih:${INFO_HASH}`, infoHash: INFO_HASH }, config())).rejects.toThrow(
+        /could not read that torrent/,
+      );
+    });
+
+    /**
+     * A failed import leaves its torrent in the client, so every later attempt at that release is
+     * answered with "Fails." forever. The torrent we asked for being present is the outcome we
+     * wanted, and reporting it as a rejection is what stranded the request in the first place.
+     */
+    it('adopts a torrent the client is already holding instead of failing the grab', async () => {
+      const { handlers } = mockFetch();
+      handlers.set('/torrents/add', () => response('Fails.'));
+      handlers.set('/torrents/info', () => response([{ hash: INFO_HASH, state: 'stalledUP', progress: 1 }]));
+
+      await expect(adapter.add({ magnet: `magnet:?xt=urn:btih:${INFO_HASH}`, infoHash: INFO_HASH }, config())).resolves.toEqual({
+        clientHash: INFO_HASH,
+      });
+    });
+
+    it('reports the rejection rather than a false success when it cannot ask the client', async () => {
+      const { handlers } = mockFetch();
+      handlers.set('/torrents/add', () => response('Fails.'));
+      handlers.set('/torrents/info', () => response('Forbidden', { status: 403 }));
+
+      await expect(adapter.add({ magnet: `magnet:?xt=urn:btih:${INFO_HASH}`, infoHash: INFO_HASH }, config())).rejects.toThrow(BadRequestException);
+    });
+
+    it('refuses a payload with neither a magnet nor a file', async () => {
+      mockFetch();
+      await expect(adapter.add({ infoHash: INFO_HASH }, config())).rejects.toThrow(BadRequestException);
+    });
+  });
+
+  describe('status', () => {
+    it('asks for every hash in one call and maps qBittorrent states', async () => {
+      const { calls, handlers } = mockFetch();
+      handlers.set('/torrents/info', () =>
+        response([
+          { hash: INFO_HASH, state: 'downloading', progress: 0.42, downloaded: 420, total_size: 1000, content_path: '/downloads/dune.epub' },
+          { hash: 'b'.repeat(40), state: 'stalledUP', progress: 1, downloaded: 900, total_size: 900, content_path: '/downloads/other.epub' },
+          { hash: 'c'.repeat(40), state: 'error', progress: 0.1, downloaded: 10, total_size: 100 },
+        ]),
+      );
+
+      const statuses = await adapter.status([INFO_HASH, 'B'.repeat(40), 'c'.repeat(40)], config());
+
+      expect(calls.filter((call) => call.url.includes('/torrents/info'))).toHaveLength(1);
+      expect(statuses).toEqual([
+        {
+          infoHash: INFO_HASH,
+          state: 'downloading',
+          progressPercent: 42,
+          downloadedBytes: 420,
+          totalBytes: 1000,
+          contentPath: '/downloads/dune.epub',
+          seed: { seeding: false, ratio: null, ratioGoal: null, seedingTimeSeconds: null, seedingTimeGoalMinutes: null, uploadedBytes: null },
+          errorMessage: undefined,
+        },
+        expect.objectContaining({ state: 'completed', progressPercent: 100 }),
+        expect.objectContaining({ state: 'failed', errorMessage: expect.stringContaining('error') }),
+      ]);
+    });
+
+    it('reports what a finished torrent is doing in the swarm, and the goals it was given', async () => {
+      const { handlers } = mockFetch();
+      handlers.set('/torrents/info', () =>
+        response([
+          {
+            hash: INFO_HASH,
+            state: 'uploading',
+            progress: 1,
+            downloaded: 1000,
+            total_size: 1000,
+            ratio: 1.75,
+            ratio_limit: 2,
+            seeding_time: 7200,
+            seeding_time_limit: 4320,
+            uploaded: 1750,
+          },
+        ]),
+      );
+
+      const [status] = await adapter.status([INFO_HASH], config());
+      expect(status.seed).toEqual({
+        seeding: true,
+        ratio: 1.75,
+        ratioGoal: 2,
+        seedingTimeSeconds: 7200,
+        seedingTimeGoalMinutes: 4320,
+        uploadedBytes: 1750,
+      });
+    });
+
+    it('reads a negative goal as no goal of its own rather than a goal of minus one', async () => {
+      const { handlers } = mockFetch();
+      handlers.set('/torrents/info', () =>
+        response([{ hash: INFO_HASH, state: 'stoppedUP', progress: 1, ratio: 0.4, ratio_limit: -2, seeding_time_limit: -1 }]),
+      );
+
+      const [status] = await adapter.status([INFO_HASH], config());
+      // Stopped is finished and idle, not seeding, whatever the ratio says.
+      expect(status.seed).toMatchObject({ seeding: false, ratio: 0.4, ratioGoal: null, seedingTimeGoalMinutes: null });
+    });
+
+    it('leaves a hash the client does not know about out of the result', async () => {
+      const { handlers } = mockFetch();
+      handlers.set('/torrents/info', () => response([]));
+
+      await expect(adapter.status([INFO_HASH], config())).resolves.toEqual([]);
+    });
+
+    it('treats checking states as still in progress rather than finished', async () => {
+      const { handlers } = mockFetch();
+      handlers.set('/torrents/info', () => response([{ hash: INFO_HASH, state: 'checkingDL', progress: 0.99, downloaded: 990, total_size: 1000 }]));
+
+      const [status] = await adapter.status([INFO_HASH], config());
+      expect(status.state).toBe('queued');
+    });
+  });
+
+  describe('session handling', () => {
+    it('reuses the session cookie across calls', async () => {
+      const { calls, handlers } = mockFetch();
+      handlers.set('/auth/login', () => response('Ok.', { setCookie: 'SID=abc123; HttpOnly; path=/' }));
+      handlers.set('/torrents/info', () => response([]));
+
+      await adapter.status([INFO_HASH], config());
+      await adapter.status([INFO_HASH], config());
+
+      expect(calls.filter((call) => call.url.includes('/auth/login'))).toHaveLength(1);
+      const infoCall = calls.find((call) => call.url.includes('/torrents/info'));
+      expect((infoCall?.init.headers as Record<string, string>).Cookie).toBe('SID=abc123');
+    });
+
+    /** An expired SID answers 403 on every endpoint and looks exactly like a permission problem. */
+    it('re-authenticates once on a 403 and then gives up', async () => {
+      const { calls, handlers } = mockFetch();
+      handlers.set('/auth/login', () => response('Ok.', { setCookie: 'SID=abc123' }));
+      handlers.set('/torrents/info', () => response('Forbidden', { status: 403 }));
+
+      await expect(adapter.status([INFO_HASH], config())).rejects.toThrow(BadRequestException);
+      expect(calls.filter((call) => call.url.includes('/auth/login'))).toHaveLength(2);
+    });
+
+    it('reports rejected credentials rather than retrying forever', async () => {
+      const { handlers } = mockFetch();
+      handlers.set('/auth/login', () => response('Fails.'));
+
+      await expect(adapter.test(config())).resolves.toMatchObject({ success: false });
+    });
+  });
+
+  describe('test', () => {
+    it('reports the client version on success', async () => {
+      const { handlers } = mockFetch();
+      handlers.set('/app/version', () => response('v5.0.3'));
+
+      await expect(adapter.test(config())).resolves.toEqual({ success: true, version: 'v5.0.3' });
+    });
+
+    it('turns an unreachable client into a failure result rather than an exception', async () => {
+      vi.stubGlobal(
+        'fetch',
+        vi.fn(() => Promise.reject(new Error('ECONNREFUSED'))),
+      );
+
+      await expect(adapter.test(config())).resolves.toMatchObject({ success: false, error: expect.stringContaining('ECONNREFUSED') });
+    });
+
+    it('refuses a private address when the row has not opted in', async () => {
+      mockFetch();
+      await expect(adapter.test(config({ allowPrivateAddress: false }))).resolves.toMatchObject({ success: false });
+    });
+  });
+
+  describe('remove', () => {
+    it('deletes by hash without touching the files on disk', async () => {
+      const { calls } = mockFetch();
+
+      await adapter.remove(INFO_HASH, config(), { deleteFiles: false });
+
+      const call = calls.find((entry) => entry.url.includes('/torrents/delete'));
+      expect((call?.init.body as URLSearchParams).get('hashes')).toBe(INFO_HASH);
+      expect((call?.init.body as URLSearchParams).get('deleteFiles')).toBe('false');
+    });
+  });
+  /**
+   * A tracker refusing the announce is not an error state as far as qBittorrent is concerned: the
+   * torrent sits in `stalledDL` looking exactly like one that simply has no peers yet, and the
+   * request would occupy the queue until the watchdog gave up on it half a day later.
+   */
+  describe('tracker errors', () => {
+    const REFUSED = 'Unrecognized host/PassKey. (97.117.96.134)';
+
+    function stalled(overrides: object = {}) {
+      return [{ hash: INFO_HASH, state: 'stalledDL', progress: 0, downloaded: 0, total_size: 1000, ...overrides }];
+    }
+
+    it("reports the tracker's own message for a torrent that is getting nowhere", async () => {
+      const { handlers } = mockFetch();
+      handlers.set('/torrents/info', () => response(stalled()));
+      handlers.set('/torrents/trackers', () => response([{ url: 'https://t.myanonamouse.net/tracker.php/abc', status: 4, msg: REFUSED }]));
+
+      const [status] = await adapter.status([INFO_HASH], config());
+
+      expect(status.trackerError).toBe(REFUSED);
+      // The state itself is untouched: only the monitor decides what a refused announce costs.
+      expect(status.state).toBe('downloading');
+    });
+
+    /** Disabled for a private torrent and reporting so is not a tracker failure. */
+    it('ignores the DHT, PeX and LSD pseudo-entries when judging whether anything works', async () => {
+      const { handlers } = mockFetch();
+      handlers.set('/torrents/info', () => response(stalled()));
+      handlers.set('/torrents/trackers', () =>
+        response([
+          { url: '** [DHT] **', status: 0, msg: 'This torrent is private' },
+          { url: '** [PeX] **', status: 0, msg: 'This torrent is private' },
+          { url: '** [LSD] **', status: 0, msg: 'This torrent is private' },
+          { url: 'https://t.myanonamouse.net/tracker.php/abc', status: 4, msg: REFUSED },
+        ]),
+      );
+
+      const [status] = await adapter.status([INFO_HASH], config());
+      expect(status.trackerError).toBe(REFUSED);
+    });
+
+    it('stays quiet while any real tracker is still working', async () => {
+      const { handlers } = mockFetch();
+      handlers.set('/torrents/info', () => response(stalled()));
+      handlers.set('/torrents/trackers', () =>
+        response([
+          { url: 'https://dead.example/announce', status: 4, msg: 'Connection failed' },
+          { url: 'https://live.example/announce', status: 2, msg: '' },
+        ]),
+      );
+
+      const [status] = await adapter.status([INFO_HASH], config());
+      expect(status.trackerError).toBeUndefined();
+    });
+
+    it('does not ask about a torrent that is actually moving', async () => {
+      const { calls, handlers } = mockFetch();
+      handlers.set('/torrents/info', () => response(stalled({ state: 'downloading', downloaded: 4096 })));
+
+      await adapter.status([INFO_HASH], config());
+
+      expect(calls.filter((call) => call.url.includes('/torrents/trackers'))).toHaveLength(0);
+    });
+
+    it('keeps the poll alive when the client will not answer the trackers endpoint', async () => {
+      const { handlers } = mockFetch();
+      handlers.set('/torrents/info', () => response(stalled()));
+      handlers.set('/torrents/trackers', () => response('Not Found', { status: 404 }));
+
+      const [status] = await adapter.status([INFO_HASH], config());
+
+      expect(status.trackerError).toBeUndefined();
+      expect(status.state).toBe('downloading');
+    });
+
+    /** A queue where everything is stalled is a client-wide fault, not 200 separate diagnoses. */
+    it('caps how many stuck torrents it asks about in one tick', async () => {
+      const hashes = Array.from({ length: 30 }, (_, index) => index.toString(16).padStart(40, '0'));
+      const { calls, handlers } = mockFetch();
+      handlers.set('/torrents/info', () =>
+        response(hashes.map((hash) => ({ hash, state: 'stalledDL', progress: 0, downloaded: 0, total_size: 1000 }))),
+      );
+      handlers.set('/torrents/trackers', () => response([{ url: 'https://t.example/announce', status: 4, msg: REFUSED }]));
+
+      await adapter.status(hashes, config());
+
+      expect(calls.filter((call) => call.url.includes('/torrents/trackers'))).toHaveLength(20);
+    });
+  });
+});
diff --git a/server/src/modules/book-request/download-clients/adapters/qbittorrent.adapter.ts b/server/src/modules/book-request/download-clients/adapters/qbittorrent.adapter.ts
new file mode 100644
index 000000000..921ece9ea
--- /dev/null
+++ b/server/src/modules/book-request/download-clients/adapters/qbittorrent.adapter.ts
@@ -0,0 +1,341 @@
+import { BadRequestException, Injectable, Logger } from '@nestjs/common';
+import type { DownloadClientTestResult } from '@bookorbit/types';
+
+import { ensureSafeUrl } from '../../../../common/utils/ssrf.utils';
+import { sanitizeLogValue } from '../../../../common/utils/log-sanitize.utils';
+import type {
+  DownloadClientAdapter,
+  DownloadState,
+  DownloadStatus,
+  GrabPayload,
+  OwnedDownloadClientInventory,
+  ResolvedClientConfig,
+  SeedInfo,
+} from '../download-client-adapter';
+import { endpointUrl, fetchClient, readClientJson, readClientText, throwForClientServerError } from './client-http.utils';
+
+const LABEL = 'qBittorrent';
+/** qBittorrent's SID cookie lasts an hour by default; re-login well before it lapses. */
+const SESSION_TTL_MS = 30 * 60 * 1000;
+/** One `torrents/info` URL has to stay a sane length, so very large fleets poll in chunks. */
+const STATUS_BATCH_SIZE = 100;
+/**
+ * `torrents/trackers` takes one hash at a time, so it is only asked about torrents that already
+ * look stuck, and only about this many of them per tick. A queue where everything is stalled is a
+ * client-wide problem, and hammering the client with one call per torrent would not diagnose it.
+ */
+const TRACKER_PROBE_LIMIT = 20;
+const RECONCILIATION_LIMIT = 1000;
+
+interface QbTracker {
+  url?: string;
+  /** 0 disabled, 1 not contacted, 2 working, 3 updating, 4 not working. */
+  status?: number;
+  msg?: string;
+}
+
+interface QbTorrentInfo {
+  hash?: string;
+  name?: string;
+  state?: string;
+  progress?: number;
+  downloaded?: number;
+  size?: number;
+  total_size?: number;
+  content_path?: string;
+  save_path?: string;
+  ratio?: number;
+  ratio_limit?: number;
+  seeding_time?: number;
+  seeding_time_limit?: number;
+  uploaded?: number;
+}
+
+/**
+ * qBittorrent reports a state machine, not a boolean. Only the seeding and paused-after-complete
+ * states mean the bytes are on disk; `checking*` in particular looks idle but is not finished.
+ */
+const COMPLETED_STATES = new Set(['uploading', 'stalledUP', 'queuedUP', 'forcedUP', 'pausedUP', 'stoppedUP', 'checkingUP']);
+/** Finished and still working the swarm. The paused and stopped spellings are finished and idle. */
+const SEEDING_STATES = new Set(['uploading', 'stalledUP', 'queuedUP', 'forcedUP', 'checkingUP']);
+const FAILED_STATES = new Set(['error', 'missingFiles']);
+const QUEUED_STATES = new Set(['queuedDL', 'allocating', 'metaDL', 'checkingDL', 'checkingResumeData', 'moving', 'pausedDL', 'stoppedDL']);
+/**
+ * Not an error state as far as qBittorrent is concerned: a torrent whose tracker refuses the
+ * announce sits here indefinitely, looking exactly like one that simply has no peers yet.
+ */
+const STUCK_STATES = new Set(['stalledDL', 'metaDL']);
+/** qBittorrent's own pseudo-trackers, which report their own status and are not tracker failures. */
+const PSEUDO_TRACKER = /^\*\*/;
+
+@Injectable()
+export class QbittorrentAdapter implements DownloadClientAdapter {
+  readonly type = 'qbittorrent' as const;
+  readonly label = 'qBittorrent';
+  readonly delivers = 'torrent' as const;
+
+  private readonly logger = new Logger(QbittorrentAdapter.name);
+  private readonly sessions = new Map<number, { cookie: string; expiresAt: number }>();
+
+  async add(release: GrabPayload, config: ResolvedClientConfig): Promise<{ clientHash: string }> {
+    const form = new FormData();
+    if (release.torrentFile) {
+      form.append('torrents', new Blob([new Uint8Array(release.torrentFile)]), release.torrentFileName ?? 'upload.torrent');
+    } else if (release.magnet) {
+      form.append('urls', release.magnet);
+    } else {
+      throw new BadRequestException('A grab needs either a magnet link or a .torrent file');
+    }
+
+    form.append('category', config.category);
+    // Torrent-level goals: the client enforces them, BookOrbit never stops a seed itself.
+    if (release.seedRatioGoal !== undefined) form.append('ratioLimit', String(release.seedRatioGoal));
+    if (release.seedTimeMinutes !== undefined) form.append('seedingTimeLimit', String(release.seedTimeMinutes));
+
+    const response = await this.call(config, '/api/v2/torrents/add', { method: 'POST', body: form });
+    const body = (await readClientText(response, LABEL)).trim();
+    // "Fails." with a 200 is the one 200 that is not success, and it covers two unrelated cases:
+    // a torrent the client already holds, and one it could not read. Only the client can tell them
+    // apart, so ask rather than hand the operator both guesses at once.
+    if (body.toLowerCase().startsWith('fail')) {
+      if (await this.holds(release.infoHash, config)) {
+        // An earlier attempt on this release leaves its torrent behind when the import fails, and
+        // without this every retry of that release is rejected by the client forever. The torrent
+        // we asked for being present is the outcome we wanted, not a failure.
+        this.logger.log(
+          `[download_client.add] [end] clientId=${config.id} hash=${release.infoHash.toLowerCase()} adopted=true - the client already held this torrent`,
+        );
+        return { clientHash: release.infoHash.toLowerCase() };
+      }
+      throw new BadRequestException('qBittorrent could not read that torrent. The file may be corrupt, or the magnet link invalid.');
+    }
+
+    return { clientHash: release.infoHash.toLowerCase() };
+  }
+
+  /**
+   * Whether the client is already holding this exact infohash. Any failure to find out answers
+   * "no", so an unreachable client surfaces the add failure rather than a false success.
+   */
+  private async holds(infoHash: string, config: ResolvedClientConfig): Promise<boolean> {
+    const hash = infoHash.toLowerCase();
+    try {
+      const response = await this.call(config, `/api/v2/torrents/info?hashes=${encodeURIComponent(hash)}`, { method: 'GET' });
+      const payload = await readClientJson<unknown>(response, LABEL);
+      return Array.isArray(payload) && (payload as QbTorrentInfo[]).some((entry) => entry.hash?.toLowerCase() === hash);
+    } catch {
+      return false;
+    }
+  }
+
+  async status(hashes: string[], config: ResolvedClientConfig): Promise<DownloadStatus[]> {
+    const wanted = new Set(hashes.map((hash) => hash.toLowerCase()));
+    const results: DownloadStatus[] = [];
+    const stuck: DownloadStatus[] = [];
+
+    for (let index = 0; index < hashes.length; index += STATUS_BATCH_SIZE) {
+      const batch = hashes.slice(index, index + STATUS_BATCH_SIZE).map((hash) => hash.toLowerCase());
+      const response = await this.call(config, `/api/v2/torrents/info?hashes=${encodeURIComponent(batch.join('|'))}`, { method: 'GET' });
+      const payload = await readClientJson<unknown>(response, LABEL);
+      if (!Array.isArray(payload)) continue;
+
+      for (const entry of payload as QbTorrentInfo[]) {
+        const hash = entry.hash?.toLowerCase();
+        if (!hash || !wanted.has(hash)) continue;
+        const status = toDownloadStatus(hash, entry);
+        results.push(status);
+        // Collected here rather than derived from `status`: which qBittorrent states are worth
+        // asking about is this adapter's business, and does not belong in the shared shape.
+        if (entry.state !== undefined && STUCK_STATES.has(entry.state) && status.downloadedBytes === 0) stuck.push(status);
+      }
+    }
+
+    await this.attachTrackerErrors(stuck.slice(0, TRACKER_PROBE_LIMIT), config);
+    return results;
+  }
+
+  async listOwned(config: ResolvedClientConfig): Promise<OwnedDownloadClientInventory> {
+    const response = await this.call(config, `/api/v2/torrents/info?category=${encodeURIComponent(config.category)}`, { method: 'GET' });
+    const payload = await readClientJson<unknown>(response, LABEL);
+    if (!Array.isArray(payload)) return { supported: true, truncated: false, items: [] };
+
+    const entries = payload as QbTorrentInfo[];
+    return {
+      supported: true,
+      truncated: entries.length > RECONCILIATION_LIMIT,
+      items: entries.slice(0, RECONCILIATION_LIMIT).flatMap((entry) => {
+        const hash = entry.hash?.toLowerCase();
+        if (!hash) return [];
+        return [{ ...toDownloadStatus(hash, entry), name: entry.name?.trim() || hash }];
+      }),
+    };
+  }
+
+  /**
+   * Fills in `trackerError` for the torrents that are getting nowhere. qBittorrent reports a
+   * rejected announce as `stalledDL`, which maps to a perfectly ordinary in-flight state, so the
+   * tracker's own message is the only thing that distinguishes "no peers yet" from "this tracker
+   * will never accept us".
+   */
+  private async attachTrackerErrors(stuck: DownloadStatus[], config: ResolvedClientConfig): Promise<void> {
+    for (const status of stuck) {
+      try {
+        const response = await this.call(config, `/api/v2/torrents/trackers?hash=${encodeURIComponent(status.infoHash)}`, { method: 'GET' });
+        const payload = await readClientJson<unknown>(response, LABEL);
+        if (!Array.isArray(payload)) continue;
+        const message = trackerFailure(payload as QbTracker[]);
+        if (message) status.trackerError = message;
+      } catch (error) {
+        // A client that will not answer this endpoint must not take the whole poll down with it;
+        // the torrent keeps its state and the watchdog remains the backstop.
+        const detail = error instanceof Error ? error.message : String(error);
+        this.logger.warn(
+          `[download_client.trackers] [fail] clientId=${config.id} hash=${status.infoHash} error="${sanitizeLogValue(detail)}" - could not read tracker status`,
+        );
+      }
+    }
+  }
+
+  async remove(hash: string, config: ResolvedClientConfig, opts: { deleteFiles: boolean }): Promise<void> {
+    const body = new URLSearchParams({ hashes: hash.toLowerCase(), deleteFiles: String(opts.deleteFiles) });
+    await this.call(config, '/api/v2/torrents/delete', {
+      method: 'POST',
+      body,
+      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+    });
+  }
+
+  async test(config: ResolvedClientConfig): Promise<DownloadClientTestResult> {
+    try {
+      const response = await this.call(config, '/api/v2/app/version', { method: 'GET' });
+      return { success: true, version: (await readClientText(response, LABEL)).trim() };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      this.logger.warn(
+        `[download_client.test] [fail] clientId=${config.id} error="${sanitizeLogValue(message)}" - qBittorrent connection test failed`,
+      );
+      return { success: false, error: message };
+    }
+  }
+
+  /** Drops the cached session so the next call re-authenticates against the current config. */
+  forget(clientId: number): void {
+    this.sessions.delete(clientId);
+  }
+
+  private async call(config: ResolvedClientConfig, path: string, init: RequestInit, retryOnAuthFailure = true): Promise<Response> {
+    const cookie = await this.session(config);
+    const base = await this.resolveBaseUrl(config);
+    const response = await fetchClient(
+      endpointUrl(base, path),
+      { ...init, headers: { ...(init.headers ?? {}), Cookie: cookie, Referer: base.origin } },
+      LABEL,
+    );
+
+    // An expired SID answers 403 on every endpoint, and looks identical to a permission problem.
+    if (response.status === 403 && retryOnAuthFailure) {
+      this.sessions.delete(config.id);
+      return this.call(config, path, init, false);
+    }
+    if (!response.ok) {
+      throwForClientServerError(response, LABEL, path.split('?')[0]!);
+      throw new BadRequestException(`qBittorrent answered ${response.status} for ${path.split('?')[0]}`);
+    }
+    return response;
+  }
+
+  private async session(config: ResolvedClientConfig): Promise<string> {
+    const cached = this.sessions.get(config.id);
+    if (cached && cached.expiresAt > Date.now()) return cached.cookie;
+
+    const base = await this.resolveBaseUrl(config);
+    const body = new URLSearchParams({ username: config.username ?? '', password: config.password ?? '' });
+    const response = await fetchClient(
+      endpointUrl(base, '/api/v2/auth/login'),
+      { method: 'POST', body, headers: { 'Content-Type': 'application/x-www-form-urlencoded', Referer: base.origin } },
+      LABEL,
+    );
+
+    if (!response.ok) {
+      throwForClientServerError(response, LABEL, 'login');
+      throw new BadRequestException(`qBittorrent refused the login with ${response.status}`);
+    }
+    const text = (await readClientText(response, LABEL)).trim();
+    if (text.toLowerCase().startsWith('fail')) throw new BadRequestException('qBittorrent rejected those credentials');
+
+    const cookie = extractSidCookie(response);
+    // A client with authentication disabled for the local subnet answers "Ok." and sets nothing.
+    const resolved = cookie ?? '';
+    this.sessions.set(config.id, { cookie: resolved, expiresAt: Date.now() + SESSION_TTL_MS });
+    return resolved;
+  }
+
+  private async resolveBaseUrl(config: ResolvedClientConfig): Promise<URL> {
+    return ensureSafeUrl(config.baseUrl, { allowPrivate: config.allowPrivateAddress });
+  }
+}
+
+function toDownloadStatus(hash: string, entry: QbTorrentInfo): DownloadStatus {
+  const totalBytes = entry.total_size ?? entry.size ?? null;
+  const state = mapState(entry.state);
+  return {
+    infoHash: hash,
+    state,
+    progressPercent: Math.max(0, Math.min(100, Math.round((entry.progress ?? 0) * 100))),
+    downloadedBytes: entry.downloaded ?? 0,
+    totalBytes: typeof totalBytes === 'number' && totalBytes > 0 ? totalBytes : null,
+    contentPath: entry.content_path ?? entry.save_path ?? null,
+    seed: toSeedInfo(entry),
+    errorMessage: state === 'failed' ? `qBittorrent reported state "${entry.state ?? 'unknown'}"` : undefined,
+  };
+}
+
+/**
+ * The tracker's message, but only when every real tracker on the torrent has given up. One dead
+ * tracker in a multi-tracker torrent is normal and says nothing about whether it can download, so
+ * a single working or still-updating entry means there is nothing to report.
+ */
+function trackerFailure(trackers: QbTracker[]): string | null {
+  const real = trackers.filter((tracker) => tracker.url && !PSEUDO_TRACKER.test(tracker.url));
+  if (real.length === 0) return null;
+  if (real.some((tracker) => tracker.status === 2 || tracker.status === 3)) return null;
+
+  const failing = real.find((tracker) => tracker.status === 4 && tracker.msg?.trim());
+  // The tracker writes this, so it is bounded before it reaches a database column, a notification
+  // and the request list.
+  return failing?.msg?.trim().slice(0, 200) ?? null;
+}
+
+/**
+ * qBittorrent spells "no limit of my own" as a negative number on both goals, which is a goal the
+ * torrent does not have rather than a goal of -1.
+ */
+function toSeedInfo(entry: QbTorrentInfo): SeedInfo {
+  const seedingTimeLimit = entry.seeding_time_limit;
+  return {
+    seeding: entry.state !== undefined && SEEDING_STATES.has(entry.state),
+    ratio: typeof entry.ratio === 'number' && entry.ratio >= 0 ? entry.ratio : null,
+    ratioGoal: typeof entry.ratio_limit === 'number' && entry.ratio_limit >= 0 ? entry.ratio_limit : null,
+    seedingTimeSeconds: typeof entry.seeding_time === 'number' && entry.seeding_time >= 0 ? entry.seeding_time : null,
+    seedingTimeGoalMinutes: typeof seedingTimeLimit === 'number' && seedingTimeLimit >= 0 ? seedingTimeLimit : null,
+    uploadedBytes: typeof entry.uploaded === 'number' && entry.uploaded >= 0 ? entry.uploaded : null,
+  };
+}
+
+function mapState(state: string | undefined): DownloadState {
+  if (!state) return 'unknown';
+  if (FAILED_STATES.has(state)) return 'failed';
+  if (COMPLETED_STATES.has(state)) return 'completed';
+  if (QUEUED_STATES.has(state)) return 'queued';
+  return 'downloading';
+}
+
+function extractSidCookie(response: Response): string | null {
+  const headers = response.headers as Headers & { getSetCookie?: () => string[] };
+  const raw = headers.getSetCookie?.() ?? [response.headers.get('set-cookie') ?? ''];
+  for (const value of raw) {
+    const match = /(?:^|;\s*)(SID=[^;]+)/.exec(value);
+    if (match) return match[1];
+  }
+  return null;
+}
diff --git a/server/src/modules/book-request/download-clients/adapters/transmission.adapter.test.ts b/server/src/modules/book-request/download-clients/adapters/transmission.adapter.test.ts
new file mode 100644
index 000000000..e41e0a320
--- /dev/null
+++ b/server/src/modules/book-request/download-clients/adapters/transmission.adapter.test.ts
@@ -0,0 +1,403 @@
+import { BadRequestException } from '@nestjs/common';
+
+import type { ResolvedClientConfig } from '../download-client-adapter';
+import { TransmissionAdapter } from './transmission.adapter';
+
+const INFO_HASH = 'c9e15763f722f23e98a29decdfae341b98d53056';
+
+function config(overrides: Partial<ResolvedClientConfig> = {}): ResolvedClientConfig {
+  return {
+    id: 1,
+    name: 'local transmission',
+    adapterType: 'transmission',
+    // 127.0.0.1 needs the per-row private opt-in, which is exactly how a LAN client is configured.
+    baseUrl: 'http://127.0.0.1:9091',
+    username: 'admin',
+    password: 'adminadmin',
+    category: 'bookorbit',
+    allowPrivateAddress: true,
+    settings: null,
+    ...overrides,
+  };
+}
+
+function success(args: object): Response {
+  return new Response(JSON.stringify({ result: 'success', arguments: args }), { status: 200 });
+}
+
+interface RpcCall {
+  url: string;
+  method: string;
+  args: Record<string, unknown>;
+  sessionId: string | null;
+  authorization: string | null;
+}
+
+/** Every call is a POST to the same endpoint, so the mock dispatches on the RPC method instead. */
+function mockRpc() {
+  const calls: RpcCall[] = [];
+  const handlers = new Map<string, () => Response>();
+  let demanded: string | null = null;
+
+  const fetchMock = vi.fn((url: URL | string, init: RequestInit = {}) => {
+    const body = JSON.parse(init.body as string) as { method: string; arguments: Record<string, unknown> };
+    const headers = new Headers(init.headers as HeadersInit);
+    calls.push({
+      url: url.toString(),
+      method: body.method,
+      args: body.arguments,
+      sessionId: headers.get('x-transmission-session-id'),
+      authorization: headers.get('authorization'),
+    });
+
+    if (demanded !== null && headers.get('x-transmission-session-id') !== demanded) {
+      return Promise.resolve(new Response('', { status: 409, headers: { 'X-Transmission-Session-Id': demanded } }));
+    }
+    const handler = handlers.get(body.method);
+    return Promise.resolve(handler ? handler() : success({}));
+  });
+
+  vi.stubGlobal('fetch', fetchMock);
+  return { calls, handlers, demandSession: (token: string) => (demanded = token) };
+}
+
+describe('TransmissionAdapter', () => {
+  let adapter: TransmissionAdapter;
+
+  beforeEach(() => {
+    adapter = new TransmissionAdapter();
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  describe('base URL', () => {
+    it('keeps a reverse-proxy path prefix on every call', async () => {
+      const { calls } = mockRpc();
+      await adapter.test(config({ baseUrl: 'http://127.0.0.1:9091/tr' }));
+
+      expect(calls.at(-1)?.url).toBe('http://127.0.0.1:9091/tr/transmission/rpc');
+    });
+
+    /** Pasting the RPC endpoint itself is at least as likely as pasting the root. */
+    it('does not append the RPC path twice when the base already carries it', async () => {
+      const { calls } = mockRpc();
+      await adapter.test(config({ id: 2, baseUrl: 'http://127.0.0.1:9091/transmission/rpc' }));
+
+      expect(calls.at(-1)?.url).toBe('http://127.0.0.1:9091/transmission/rpc');
+    });
+
+    it('sends the credentials as Basic auth', async () => {
+      const { calls } = mockRpc();
+      await adapter.test(config({ id: 3 }));
+
+      expect(calls.at(-1)?.authorization).toBe(`Basic ${Buffer.from('admin:adminadmin').toString('base64')}`);
+    });
+  });
+
+  /**
+   * Transmission refuses every call that arrives without the current CSRF token and hands out the
+   * one to use in the same 409. It is the handshake rather than a failure, and it recurs on every
+   * daemon restart, so it cannot be done once at startup.
+   */
+  describe('session handshake', () => {
+    it('retries the call with the token the 409 issued', async () => {
+      const { calls, handlers, demandSession } = mockRpc();
+      demandSession('token-abc');
+      handlers.set('session-get', () => success({ version: '4.0.5' }));
+
+      await expect(adapter.test(config())).resolves.toEqual({ success: true, version: '4.0.5' });
+      expect(calls.map((call) => call.sessionId)).toEqual([null, 'token-abc']);
+    });
+
+    it('reuses the token on later calls rather than handshaking every time', async () => {
+      const { calls, handlers, demandSession } = mockRpc();
+      demandSession('token-abc');
+      handlers.set('torrent-get', () => success({ torrents: [] }));
+
+      await adapter.test(config());
+      await adapter.status([INFO_HASH], config());
+
+      expect(calls.filter((call) => call.sessionId === null)).toHaveLength(1);
+    });
+
+    it('re-handshakes after forget, so an edited address cannot reuse a stale token', async () => {
+      const { calls, handlers, demandSession } = mockRpc();
+      demandSession('token-abc');
+      handlers.set('session-get', () => success({ version: '4.0.5' }));
+
+      await adapter.test(config());
+      adapter.forget(1);
+      await adapter.test(config());
+
+      expect(calls.filter((call) => call.sessionId === null)).toHaveLength(2);
+    });
+  });
+
+  describe('add', () => {
+    it('posts a magnet under the category subfolder of the download directory', async () => {
+      const { calls, handlers } = mockRpc();
+      handlers.set('session-get', () => success({ 'download-dir': '/downloads' }));
+      handlers.set('torrent-add', () => success({ 'torrent-added': { hashString: INFO_HASH } }));
+
+      await expect(adapter.add({ magnet: `magnet:?xt=urn:btih:${INFO_HASH}`, infoHash: INFO_HASH }, config())).resolves.toEqual({
+        clientHash: INFO_HASH,
+      });
+
+      const add = calls.find((call) => call.method === 'torrent-add');
+      expect(add?.args.filename).toBe(`magnet:?xt=urn:btih:${INFO_HASH}`);
+      expect(add?.args['download-dir']).toBe('/downloads/bookorbit');
+      expect(add?.args.paused).toBe(false);
+    });
+
+    it('uploads a .torrent as base64 metainfo', async () => {
+      const { calls, handlers } = mockRpc();
+      handlers.set('torrent-add', () => success({ 'torrent-added': { hashString: INFO_HASH } }));
+
+      await adapter.add({ torrentFile: Buffer.from('d4:infod4:name4:duneee'), torrentFileName: 'dune.torrent', infoHash: INFO_HASH }, config());
+
+      const add = calls.find((call) => call.method === 'torrent-add');
+      expect(add?.args.metainfo).toBe(Buffer.from('d4:infod4:name4:duneee').toString('base64'));
+      expect(add?.args.filename).toBeUndefined();
+    });
+
+    /**
+     * An earlier attempt on this release leaves its torrent behind when the import fails. Without
+     * adopting it, every retry of that release would be refused by the client forever.
+     */
+    it('adopts a torrent the client already holds', async () => {
+      const { handlers } = mockRpc();
+      handlers.set('torrent-add', () => success({ 'torrent-duplicate': { hashString: INFO_HASH } }));
+
+      await expect(adapter.add({ magnet: `magnet:?xt=urn:btih:${INFO_HASH}`, infoHash: INFO_HASH }, config())).resolves.toEqual({
+        clientHash: INFO_HASH,
+      });
+    });
+
+    it('sets the seed ratio goal so the client, not BookOrbit, enforces it', async () => {
+      const { calls, handlers } = mockRpc();
+      handlers.set('torrent-add', () => success({ 'torrent-added': { hashString: INFO_HASH } }));
+
+      await adapter.add({ magnet: `magnet:?xt=urn:btih:${INFO_HASH}`, infoHash: INFO_HASH, seedRatioGoal: 2 }, config());
+
+      const set = calls.find((call) => call.method === 'torrent-set');
+      expect(set?.args).toEqual({ ids: [INFO_HASH], seedRatioLimit: 2, seedRatioMode: 1 });
+    });
+
+    /**
+     * The torrent is already running by the time the goal is set, so throwing here failed a grab
+     * whose download had started: automation moved to the next release while the orphan carried on
+     * with nothing in BookOrbit pointing at it. Best-effort, like Deluge's labelling.
+     */
+    it('keeps the grab when the client refuses the seed ratio goal', async () => {
+      const { handlers } = mockRpc();
+      handlers.set('torrent-add', () => success({ 'torrent-added': { hashString: INFO_HASH } }));
+      handlers.set('torrent-set', () => new Response('', { status: 500 }));
+
+      await expect(adapter.add({ magnet: `magnet:?xt=urn:btih:${INFO_HASH}`, infoHash: INFO_HASH, seedRatioGoal: 2 }, config())).resolves.toEqual({
+        clientHash: INFO_HASH,
+      });
+    });
+
+    /**
+     * Transmission's only time limit stops a torrent after it goes quiet, which would cut a seed
+     * short of a tracker's minimum rather than hold it there. Silently mapping the goal onto it
+     * would under-seed exactly the private trackers the goal exists to satisfy.
+     */
+    it('does not turn a seed-time goal into an idle limit', async () => {
+      const { calls, handlers } = mockRpc();
+      handlers.set('torrent-add', () => success({ 'torrent-added': { hashString: INFO_HASH } }));
+
+      await adapter.add({ magnet: `magnet:?xt=urn:btih:${INFO_HASH}`, infoHash: INFO_HASH, seedTimeMinutes: 4320 }, config());
+
+      expect(calls.find((call) => call.method === 'torrent-set')).toBeUndefined();
+    });
+
+    it('rejects a grab carrying neither a magnet nor a file', async () => {
+      mockRpc();
+      await expect(adapter.add({ infoHash: INFO_HASH }, config())).rejects.toThrow(BadRequestException);
+    });
+
+    /** `..` is inside the category's permitted character set and would escape the download root. */
+    it('ignores a category that is only dots rather than building a path out of it', async () => {
+      const { calls, handlers } = mockRpc();
+      handlers.set('session-get', () => success({ 'download-dir': '/downloads' }));
+      handlers.set('torrent-add', () => success({ 'torrent-added': { hashString: INFO_HASH } }));
+
+      await adapter.add({ magnet: `magnet:?xt=urn:btih:${INFO_HASH}`, infoHash: INFO_HASH }, config({ category: '..' }));
+
+      expect(calls.find((call) => call.method === 'torrent-add')?.args['download-dir']).toBeUndefined();
+    });
+  });
+
+  describe('status', () => {
+    /** An empty `ids` is not reliably "no torrents" to Transmission, and may mean all of them. */
+    it('asks nothing when there is nothing in flight', async () => {
+      const { calls } = mockRpc();
+      await expect(adapter.status([], config())).resolves.toEqual([]);
+      expect(calls).toHaveLength(0);
+    });
+
+    it('maps a downloading torrent onto progress and a content path', async () => {
+      const { handlers } = mockRpc();
+      handlers.set('torrent-get', () =>
+        success({
+          torrents: [
+            {
+              hashString: INFO_HASH.toUpperCase(),
+              name: 'Dune',
+              status: 4,
+              percentDone: 0.5,
+              downloadedEver: 512,
+              sizeWhenDone: 1024,
+              downloadDir: '/downloads/bookorbit',
+              error: 0,
+            },
+          ],
+        }),
+      );
+
+      await expect(adapter.status([INFO_HASH], config())).resolves.toEqual([
+        expect.objectContaining({
+          infoHash: INFO_HASH,
+          state: 'downloading',
+          progressPercent: 50,
+          downloadedBytes: 512,
+          totalBytes: 1024,
+          contentPath: '/downloads/bookorbit/Dune',
+        }),
+      ]);
+    });
+
+    it('reports a seeding torrent as completed with its ratio goal', async () => {
+      const { handlers } = mockRpc();
+      handlers.set('torrent-get', () =>
+        success({
+          torrents: [
+            {
+              hashString: INFO_HASH,
+              status: 6,
+              percentDone: 1,
+              uploadRatio: 1.5,
+              seedRatioLimit: 2,
+              seedRatioMode: 1,
+              secondsSeeding: 600,
+              uploadedEver: 2048,
+            },
+          ],
+        }),
+      );
+
+      const [status] = await adapter.status([INFO_HASH], config());
+      expect(status.state).toBe('completed');
+      expect(status.seed).toEqual({
+        seeding: true,
+        ratio: 1.5,
+        ratioGoal: 2,
+        seedingTimeSeconds: 600,
+        seedingTimeGoalMinutes: null,
+        uploadedBytes: 2048,
+      });
+    });
+
+    /** Mode 0 defers to the global limit, so the number beside it is a leftover, not a goal. */
+    it('does not report a global ratio limit as this torrent goal', async () => {
+      const { handlers } = mockRpc();
+      handlers.set('torrent-get', () => success({ torrents: [{ hashString: INFO_HASH, status: 6, seedRatioLimit: 2, seedRatioMode: 0 }] }));
+
+      const [status] = await adapter.status([INFO_HASH], config());
+      expect(status.seed?.ratioGoal).toBeNull();
+    });
+
+    /** Stopped covers a paused download and a finished torrent alike. */
+    it('tells a finished stopped torrent from a paused one', async () => {
+      const { handlers } = mockRpc();
+      handlers.set('torrent-get', () =>
+        success({
+          torrents: [
+            { hashString: INFO_HASH, status: 0, percentDone: 1, isFinished: true },
+            { hashString: 'b'.repeat(40), status: 0, percentDone: 0.3 },
+          ],
+        }),
+      );
+
+      const statuses = await adapter.status([INFO_HASH, 'b'.repeat(40)], config());
+      expect(statuses.map((status) => status.state)).toEqual(['completed', 'queued']);
+    });
+
+    it('treats a local error as failed and carries its message', async () => {
+      const { handlers } = mockRpc();
+      handlers.set('torrent-get', () => success({ torrents: [{ hashString: INFO_HASH, status: 0, error: 3, errorString: 'No data found!' }] }));
+
+      const [status] = await adapter.status([INFO_HASH], config());
+      expect(status.state).toBe('failed');
+      expect(status.errorMessage).toBe('No data found!');
+    });
+
+    /**
+     * A refused announce leaves an ordinary-looking torrent that will never find a peer, so it has
+     * to reach the poll loop as a tracker problem rather than as a healthy download.
+     */
+    it('reports a refused announce as a tracker error without failing the download', async () => {
+      const { handlers } = mockRpc();
+      handlers.set('torrent-get', () =>
+        success({ torrents: [{ hashString: INFO_HASH, status: 4, error: 2, errorString: 'Tracker gave HTTP response code 403' }] }),
+      );
+
+      const [status] = await adapter.status([INFO_HASH], config());
+      expect(status.state).toBe('downloading');
+      expect(status.trackerError).toBe('Tracker gave HTTP response code 403');
+    });
+
+    it('ignores a torrent the poll did not ask about', async () => {
+      const { handlers } = mockRpc();
+      handlers.set('torrent-get', () => success({ torrents: [{ hashString: 'f'.repeat(40), status: 4 }] }));
+
+      await expect(adapter.status([INFO_HASH], config())).resolves.toEqual([]);
+    });
+  });
+
+  describe('remove', () => {
+    it('leaves the files alone unless deletion was asked for', async () => {
+      const { calls } = mockRpc();
+      await adapter.remove(INFO_HASH.toUpperCase(), config(), { deleteFiles: false });
+
+      const remove = calls.find((call) => call.method === 'torrent-remove');
+      expect(remove?.args).toEqual({ ids: [INFO_HASH], 'delete-local-data': false });
+    });
+
+    it('deletes the data when asked', async () => {
+      const { calls } = mockRpc();
+      await adapter.remove(INFO_HASH, config(), { deleteFiles: true });
+
+      expect(calls.find((call) => call.method === 'torrent-remove')?.args['delete-local-data']).toBe(true);
+    });
+  });
+
+  describe('test', () => {
+    it('reports the version the daemon answers with', async () => {
+      const { handlers } = mockRpc();
+      handlers.set('session-get', () => success({ version: '4.0.5' }));
+
+      await expect(adapter.test(config())).resolves.toEqual({ success: true, version: '4.0.5' });
+    });
+
+    it('turns a rejected login into a failed test rather than throwing', async () => {
+      const { handlers } = mockRpc();
+      handlers.set('session-get', () => new Response('', { status: 401 }));
+
+      await expect(adapter.test(config())).resolves.toEqual({ success: false, error: 'Transmission rejected those credentials' });
+    });
+
+    /** A body-level refusal arrives with a 200, which is the one 200 that is not success. */
+    it('treats a non-success result as a refusal despite the 200', async () => {
+      const { handlers } = mockRpc();
+      handlers.set('session-get', () => new Response(JSON.stringify({ result: 'method name not recognized' }), { status: 200 }));
+
+      const result = await adapter.test(config());
+      expect(result.success).toBe(false);
+      expect(result.error).toContain('method name not recognized');
+    });
+  });
+});
diff --git a/server/src/modules/book-request/download-clients/adapters/transmission.adapter.ts b/server/src/modules/book-request/download-clients/adapters/transmission.adapter.ts
new file mode 100644
index 000000000..a6b80e885
--- /dev/null
+++ b/server/src/modules/book-request/download-clients/adapters/transmission.adapter.ts
@@ -0,0 +1,348 @@
+import { BadRequestException, Injectable, Logger } from '@nestjs/common';
+import type { DownloadClientTestResult } from '@bookorbit/types';
+
+import { ensureSafeUrl } from '../../../../common/utils/ssrf.utils';
+import { sanitizeLogValue } from '../../../../common/utils/log-sanitize.utils';
+import type {
+  DownloadClientAdapter,
+  DownloadState,
+  DownloadStatus,
+  GrabPayload,
+  OwnedDownloadClientInventory,
+  ResolvedClientConfig,
+  SeedInfo,
+} from '../download-client-adapter';
+import { basicAuthHeader, endpointUrl, fetchClient, readClientJson, throwForClientServerError } from './client-http.utils';
+
+const LABEL = 'Transmission';
+const RPC_PATH = '/transmission/rpc';
+/** Transmission's CSRF header, spelled lowercase because `Headers` matches case-insensitively. */
+const SESSION_HEADER = 'x-transmission-session-id';
+
+/** Transmission's `status` enum, which is a position in its queue rather than a description. */
+const STATUS_STOPPED = 0;
+const STATUS_CHECK_WAIT = 1;
+const STATUS_CHECK = 2;
+const STATUS_DOWNLOAD_WAIT = 3;
+const STATUS_DOWNLOAD = 4;
+const STATUS_SEED_WAIT = 5;
+const STATUS_SEED = 6;
+
+/** A torrent's `error`: 1 tracker warning, 2 tracker error, 3 local error. */
+const ERROR_TRACKER = 2;
+const ERROR_LOCAL = 3;
+
+/** `seedRatioMode`: 0 follows the global limit, 1 is this torrent's own, 2 is unlimited. */
+const RATIO_MODE_SINGLE = 1;
+const RECONCILIATION_LIMIT = 1000;
+
+/**
+ * Asked for on every poll. `error` and `errorString` are what make a refused announce visible:
+ * Transmission reports it on the torrent itself, so unlike qBittorrent there is no second
+ * per-torrent call to make.
+ */
+const STATUS_FIELDS = [
+  'hashString',
+  'name',
+  'status',
+  'percentDone',
+  'downloadedEver',
+  'sizeWhenDone',
+  'totalSize',
+  'downloadDir',
+  'error',
+  'errorString',
+  'uploadRatio',
+  'seedRatioLimit',
+  'seedRatioMode',
+  'secondsSeeding',
+  'uploadedEver',
+  'isFinished',
+];
+
+interface TransmissionTorrent {
+  hashString?: string;
+  name?: string;
+  status?: number;
+  percentDone?: number;
+  downloadedEver?: number;
+  sizeWhenDone?: number;
+  totalSize?: number;
+  downloadDir?: string;
+  error?: number;
+  errorString?: string;
+  uploadRatio?: number;
+  seedRatioLimit?: number;
+  seedRatioMode?: number;
+  secondsSeeding?: number;
+  uploadedEver?: number;
+  isFinished?: boolean;
+}
+
+interface TransmissionAddResult {
+  'torrent-added'?: { hashString?: string };
+  'torrent-duplicate'?: { hashString?: string };
+}
+
+@Injectable()
+export class TransmissionAdapter implements DownloadClientAdapter {
+  readonly type = 'transmission' as const;
+  readonly label = LABEL;
+  readonly delivers = 'torrent' as const;
+
+  private readonly logger = new Logger(TransmissionAdapter.name);
+  /** The CSRF token the daemon issued, per client row. Not a login: it survives no restart. */
+  private readonly sessions = new Map<number, string>();
+
+  async add(release: GrabPayload, config: ResolvedClientConfig): Promise<{ clientHash: string }> {
+    const args: Record<string, unknown> = { paused: false };
+    if (release.torrentFile) {
+      args.metainfo = release.torrentFile.toString('base64');
+    } else if (release.magnet) {
+      args.filename = release.magnet;
+    } else {
+      throw new BadRequestException('A grab needs either a magnet link or a .torrent file');
+    }
+
+    const downloadDir = await this.categoryDir(config);
+    if (downloadDir) args['download-dir'] = downloadDir;
+
+    const result = await this.rpc<TransmissionAddResult>(config, 'torrent-add', args);
+    // A torrent the daemon already holds comes back as `torrent-duplicate` with a success result
+    // rather than an error. An earlier attempt on this release leaves its torrent behind when the
+    // import fails, and the torrent we asked for being present is the outcome we wanted.
+    const duplicate = result['torrent-duplicate'];
+    const added = result['torrent-added'] ?? duplicate;
+    const hash = added?.hashString?.toLowerCase();
+    if (!hash) throw new BadRequestException('Transmission accepted the torrent but named no infohash');
+
+    if (duplicate) {
+      this.logger.log(`[download_client.adopt] [end] clientId=${config.id} hash=${hash} - the client already held this torrent`);
+    }
+    // The poll loop asks about the hash the grab was recorded under, so a client that named a
+    // different one would leave the download sitting in `queued` until the watchdog gave up.
+    if (hash !== release.infoHash.toLowerCase()) {
+      this.logger.warn(
+        `[download_client.add] [fail] clientId=${config.id} hash=${hash} expected=${release.infoHash.toLowerCase()} - Transmission named a different infohash`,
+      );
+    }
+
+    await this.applySeedGoal(hash, release, config);
+    return { clientHash: hash };
+  }
+
+  /**
+   * Transmission takes no limits on the add itself, so the goal is a second call. Only the ratio:
+   * its one time limit is an *idle* limit, which stops a quiet torrent early rather than holding
+   * it for a tracker's minimum, so honouring a seed-time goal with it would under-seed exactly
+   * the private trackers the goal exists to satisfy.
+   *
+   * Best-effort, like Deluge's labelling: the torrent is already running by the time this is
+   * called, so throwing here fails a grab whose download has started. Automation would move on to
+   * the next release while the orphan went on downloading with nothing in BookOrbit pointing at
+   * it. A missed ratio limit is a seeding policy the operator has to set by hand; the orphan is
+   * a download nobody can see.
+   */
+  private async applySeedGoal(hash: string, release: GrabPayload, config: ResolvedClientConfig): Promise<void> {
+    if (release.seedRatioGoal === undefined) return;
+    const started = Date.now();
+    try {
+      await this.rpc(config, 'torrent-set', { ids: [hash], seedRatioLimit: release.seedRatioGoal, seedRatioMode: RATIO_MODE_SINGLE });
+    } catch (error) {
+      const detail = error instanceof Error ? error.message : String(error);
+      this.logger.warn(
+        `[download_client.seed_goal] [fail] clientId=${config.id} hash=${hash} ratio=${release.seedRatioGoal} durationMs=${Date.now() - started} errorClass=${error instanceof Error ? error.constructor.name : 'UnknownError'} error="${sanitizeLogValue(detail)}" - the torrent was added but its seed ratio goal could not be set`,
+      );
+    }
+  }
+
+  /**
+   * Transmission has no categories, so the category becomes a subfolder of the daemon's own
+   * download directory. Read per add rather than cached, so moving that directory does not need
+   * BookOrbit restarted to take effect.
+   */
+  private async categoryDir(config: ResolvedClientConfig): Promise<string | null> {
+    const category = config.category.trim();
+    // The DTO bounds the character set, but `..` sits inside it and this becomes a path segment
+    // on the client's own filesystem.
+    if (!category || /^\.+$/.test(category)) return null;
+
+    const session = await this.rpc<{ 'download-dir'?: string }>(config, 'session-get', {});
+    const base = session['download-dir']?.trim();
+    if (!base) return null;
+    return `${base.replace(/\/+$/, '')}/${category}`;
+  }
+
+  async status(hashes: string[], config: ResolvedClientConfig): Promise<DownloadStatus[]> {
+    // An empty `ids` array is not the same as no torrents to Transmission on every version in the
+    // wild, and answering a poll about nothing with the entire queue would be worse than useless.
+    if (hashes.length === 0) return [];
+
+    const wanted = [...new Set(hashes.map((hash) => hash.toLowerCase()))];
+    // Unbatched on purpose: this is a POST body rather than a query string, so the URL length that
+    // forces qBittorrent to poll in chunks does not apply.
+    const result = await this.rpc<{ torrents?: TransmissionTorrent[] }>(config, 'torrent-get', { ids: wanted, fields: STATUS_FIELDS });
+    const asked = new Set(wanted);
+
+    return (result.torrents ?? []).flatMap((entry) => {
+      const hash = entry.hashString?.toLowerCase();
+      if (!hash || !asked.has(hash)) return [];
+      return [toDownloadStatus(hash, entry)];
+    });
+  }
+
+  async listOwned(config: ResolvedClientConfig): Promise<OwnedDownloadClientInventory> {
+    const ownedDir = await this.categoryDir(config);
+    if (!ownedDir) return { supported: false, truncated: false, items: [] };
+
+    const result = await this.rpc<{ torrents?: TransmissionTorrent[] }>(config, 'torrent-get', { fields: STATUS_FIELDS });
+    const owned = (result.torrents ?? []).filter((entry) => entry.downloadDir?.replace(/\/+$/, '') === ownedDir.replace(/\/+$/, ''));
+    return {
+      supported: true,
+      truncated: owned.length > RECONCILIATION_LIMIT,
+      items: owned.slice(0, RECONCILIATION_LIMIT).flatMap((entry) => {
+        const hash = entry.hashString?.toLowerCase();
+        if (!hash) return [];
+        return [{ ...toDownloadStatus(hash, entry), name: entry.name?.trim() || hash }];
+      }),
+    };
+  }
+
+  async remove(hash: string, config: ResolvedClientConfig, opts: { deleteFiles: boolean }): Promise<void> {
+    await this.rpc(config, 'torrent-remove', { ids: [hash.toLowerCase()], 'delete-local-data': opts.deleteFiles });
+  }
+
+  async test(config: ResolvedClientConfig): Promise<DownloadClientTestResult> {
+    try {
+      const session = await this.rpc<{ version?: string }>(config, 'session-get', {});
+      return { success: true, version: session.version?.trim() };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      this.logger.warn(
+        `[download_client.test] [fail] clientId=${config.id} error="${sanitizeLogValue(message)}" - Transmission connection test failed`,
+      );
+      return { success: false, error: message };
+    }
+  }
+
+  /** Drops the CSRF token so the next call takes a fresh one from the current address. */
+  forget(clientId: number): void {
+    this.sessions.delete(clientId);
+  }
+
+  private async rpc<T>(config: ResolvedClientConfig, method: string, args: Record<string, unknown>, retryOnHandshake = true): Promise<T> {
+    const base = await this.resolveBaseUrl(config);
+    const token = this.sessions.get(config.id);
+    const response = await fetchClient(
+      endpointUrl(base, rpcPath(base)),
+      {
+        method: 'POST',
+        body: JSON.stringify({ method, arguments: args }),
+        headers: {
+          'Content-Type': 'application/json',
+          ...basicAuthHeader(config.username, config.password),
+          ...(token ? { [SESSION_HEADER]: token } : {}),
+        },
+      },
+      LABEL,
+    );
+
+    // A 409 is the handshake rather than a failure: Transmission refuses any call without the
+    // current CSRF token and hands out the one to use in the same answer. It recurs on every
+    // daemon restart, so it cannot be done once at startup.
+    if (response.status === 409 && retryOnHandshake) {
+      const issued = response.headers.get(SESSION_HEADER);
+      if (!issued) throw new BadRequestException('Transmission asked for a session id but issued none');
+      this.sessions.set(config.id, issued);
+      return this.rpc<T>(config, method, args, false);
+    }
+    if (response.status === 401) throw new BadRequestException('Transmission rejected those credentials');
+    if (!response.ok) {
+      throwForClientServerError(response, LABEL, method);
+      throw new BadRequestException(`Transmission answered ${response.status} for ${method}`);
+    }
+
+    const payload = await readClientJson<{ result?: string; arguments?: T }>(response, LABEL);
+    // The one 200 that is not success: Transmission reports a refusal in the body with the reason
+    // as a string, and an empty queue and a rejected request look identical without it.
+    if (payload.result !== 'success') {
+      throw new BadRequestException(`Transmission refused ${method}: ${payload.result ?? 'no reason given'}`);
+    }
+    return (payload.arguments ?? ({} as T)) as T;
+  }
+
+  private async resolveBaseUrl(config: ResolvedClientConfig): Promise<URL> {
+    return ensureSafeUrl(config.baseUrl, { allowPrivate: config.allowPrivateAddress });
+  }
+}
+
+/**
+ * An operator may paste the daemon's root or the RPC endpoint itself, and appending the path to a
+ * URL that already carries it produces a 404 that reads like the client is down.
+ */
+function rpcPath(base: URL): string {
+  return /\/transmission\/rpc\/?$/.test(base.pathname) ? '' : RPC_PATH;
+}
+
+function toDownloadStatus(hash: string, entry: TransmissionTorrent): DownloadStatus {
+  const totalBytes = entry.sizeWhenDone ?? entry.totalSize ?? null;
+  const state = mapState(entry);
+  return {
+    infoHash: hash,
+    state,
+    progressPercent: Math.max(0, Math.min(100, Math.round((entry.percentDone ?? 0) * 100))),
+    downloadedBytes: entry.downloadedEver ?? 0,
+    totalBytes: typeof totalBytes === 'number' && totalBytes > 0 ? totalBytes : null,
+    contentPath: contentPath(entry),
+    seed: toSeedInfo(entry),
+    errorMessage: state === 'failed' ? entry.errorString?.trim() || 'Transmission reported a local error' : undefined,
+    // Transmission separates a refused announce from a local failure, and only the local one means
+    // the download is over. A refused announce leaves a healthy-looking torrent that will never
+    // find a peer, which is the case this field exists for.
+    ...(entry.error === ERROR_TRACKER && entry.errorString?.trim() ? { trackerError: entry.errorString.trim().slice(0, 200) } : {}),
+  };
+}
+
+/** Transmission reports the folder and the name apart; everything downstream wants the content. */
+function contentPath(entry: TransmissionTorrent): string | null {
+  const dir = entry.downloadDir?.trim();
+  if (!dir) return null;
+  const name = entry.name?.trim();
+  return name ? `${dir.replace(/\/+$/, '')}/${name}` : dir;
+}
+
+function toSeedInfo(entry: TransmissionTorrent): SeedInfo {
+  return {
+    seeding: entry.status === STATUS_SEED || entry.status === STATUS_SEED_WAIT,
+    ratio: typeof entry.uploadRatio === 'number' && entry.uploadRatio >= 0 ? entry.uploadRatio : null,
+    // Any other mode defers to the global limit or to no limit at all, and the number sitting
+    // beside it is then a leftover rather than the goal this torrent is held to.
+    ratioGoal: entry.seedRatioMode === RATIO_MODE_SINGLE && typeof entry.seedRatioLimit === 'number' ? entry.seedRatioLimit : null,
+    seedingTimeSeconds: typeof entry.secondsSeeding === 'number' && entry.secondsSeeding >= 0 ? entry.secondsSeeding : null,
+    // Transmission's only time limit is an idle one, so it has no goal to report here. Claiming
+    // the idle limit as a seed-time goal would promise a minimum it does not enforce.
+    seedingTimeGoalMinutes: null,
+    uploadedBytes: typeof entry.uploadedEver === 'number' && entry.uploadedEver >= 0 ? entry.uploadedEver : null,
+  };
+}
+
+function mapState(entry: TransmissionTorrent): DownloadState {
+  if (entry.error === ERROR_LOCAL) return 'failed';
+  switch (entry.status) {
+    case STATUS_SEED:
+    case STATUS_SEED_WAIT:
+      return 'completed';
+    case STATUS_DOWNLOAD:
+      return 'downloading';
+    case STATUS_CHECK:
+    case STATUS_CHECK_WAIT:
+    case STATUS_DOWNLOAD_WAIT:
+      return 'queued';
+    // Stopped says nothing by itself: it covers a paused download and a torrent that finished and
+    // reached its goal alike, and only the completion tells the two apart.
+    case STATUS_STOPPED:
+      return entry.isFinished === true || entry.percentDone === 1 ? 'completed' : 'queued';
+    default:
+      return 'unknown';
+  }
+}
diff --git a/server/src/modules/book-request/download-clients/download-client-adapter.ts b/server/src/modules/book-request/download-clients/download-client-adapter.ts
new file mode 100644
index 000000000..c7000b448
--- /dev/null
+++ b/server/src/modules/book-request/download-clients/download-client-adapter.ts
@@ -0,0 +1,108 @@
+import type { DownloadClientTestResult, DownloadClientType, DownloadDelivery } from '@bookorbit/types';
+
+/** A client row with its credentials already decrypted. Never logged, never returned over HTTP. */
+export interface ResolvedClientConfig {
+  id: number;
+  name: string;
+  adapterType: DownloadClientType;
+  baseUrl: string;
+  username: string | null;
+  password: string | null;
+  category: string;
+  allowPrivateAddress: boolean;
+  settings: Record<string, unknown> | null;
+}
+
+export interface GrabPayload {
+  /** Exactly one of these three is set. */
+  magnet?: string;
+  torrentFile?: Buffer;
+  torrentFileName?: string;
+  /** A source that serves the file itself, resolved by the indexer adapter to one direct URL. */
+  fileUrl?: string;
+  fileName?: string;
+  /**
+   * How the client and the poll loop identify this download. An infohash for a torrent; for a
+   * direct download there is no such thing, so the caller derives a stable digest of the URL,
+   * which keeps the same shape and keeps the duplicate-grab unique index meaningful.
+   */
+  infoHash: string;
+  /**
+   * Passed to the client at add time so the client, not BookOrbit, enforces the seed goal.
+   * Unset in phase 2: there is no indexer to take a goal from yet.
+   */
+  seedRatioGoal?: number;
+  seedTimeMinutes?: number;
+}
+
+export type DownloadState = 'queued' | 'downloading' | 'completed' | 'failed' | 'unknown';
+
+/**
+ * What the client is doing with a torrent it has finished. Read live when an approver asks, not
+ * stored: a seed outlives the import by weeks and polling every finished download forever would
+ * grow without bound.
+ */
+export interface SeedInfo {
+  /** False once the client has stopped it, whether by reaching a goal, by pause or by error. */
+  seeding: boolean;
+  ratio: number | null;
+  /** The goal the client is enforcing, when it reports one back rather than deferring to global. */
+  ratioGoal: number | null;
+  seedingTimeSeconds: number | null;
+  seedingTimeGoalMinutes: number | null;
+  uploadedBytes: number | null;
+}
+
+export interface DownloadStatus {
+  infoHash: string;
+  state: DownloadState;
+  /** 0-100. */
+  progressPercent: number;
+  downloadedBytes: number;
+  totalBytes: number | null;
+  /** Where the finished content sits, in the client's own filesystem namespace. */
+  contentPath: string | null;
+  /** Only meaningful once the bytes are down; the poll loop ignores it. */
+  seed?: SeedInfo;
+  errorMessage?: string;
+  /**
+   * The tracker's own refusal, where every tracker on a torrent that is getting nowhere reports
+   * one. A private tracker rejecting the announce leaves the torrent in a perfectly healthy-looking
+   * stalled state, so without this the only symptom is a download that never starts.
+   */
+  trackerError?: string;
+}
+
+export interface OwnedDownloadClientItem extends DownloadStatus {
+  name: string;
+}
+
+export interface OwnedDownloadClientInventory {
+  supported: boolean;
+  truncated: boolean;
+  items: OwnedDownloadClientItem[];
+}
+
+export interface DownloadClientAdapter {
+  readonly type: DownloadClientType;
+  readonly label: string;
+  /** What this client can be handed, which is what decides whether a given grab may go to it. */
+  readonly delivers: DownloadDelivery;
+
+  add(release: GrabPayload, config: ResolvedClientConfig): Promise<{ clientHash: string }>;
+  /**
+   * Batched deliberately: one poll tick is one HTTP call per client however many downloads are
+   * in flight. A hash the client no longer knows about is simply absent from the result.
+   */
+  status(hashes: string[], config: ResolvedClientConfig): Promise<DownloadStatus[]>;
+  listOwned(config: ResolvedClientConfig): Promise<OwnedDownloadClientInventory>;
+  remove(hash: string, config: ResolvedClientConfig, opts: { deleteFiles: boolean }): Promise<void>;
+  test(config: ResolvedClientConfig): Promise<DownloadClientTestResult>;
+  /**
+   * Drop anything cached against this client id. Called whenever a row's URL or credentials
+   * change, so a stale session cannot outlive the config it was opened with.
+   */
+  forget?(clientId: number): void;
+}
+
+export const DOWNLOAD_CLIENT_ADAPTERS = Symbol('DOWNLOAD_CLIENT_ADAPTERS');
diff --git a/server/src/modules/book-request/download-clients/download-client-config.service.test.ts b/server/src/modules/book-request/download-clients/download-client-config.service.test.ts
new file mode 100644
index 000000000..96f4425ed
--- /dev/null
+++ b/server/src/modules/book-request/download-clients/download-client-config.service.test.ts
@@ -0,0 +1,361 @@
+import { BadRequestException, ConflictException, HttpStatus, NotFoundException } from '@nestjs/common';
+
+import type { DownloadClientRow } from '../../../db/schema';
+import { DownloadClientConfigService } from './download-client-config.service';
+
+function clientRow(overrides: Partial<DownloadClientRow> = {}): DownloadClientRow {
+  return {
+    id: 4,
+    name: 'qbit',
+    color: null,
+    adapterType: 'qbittorrent',
+    enabled: true,
+    priority: 1,
+    baseUrl: 'http://203.0.113.10:8080',
+    username: 'admin',
+    credentialsEnc: 'cipher',
+    category: 'bookorbit',
+    useHardlinks: true,
+    allowPrivateAddress: false,
+    settings: null,
+    lastTestedAt: null,
+    lastTestOk: null,
+    lastErrorMessage: null,
+    createdAt: new Date('2026-08-18T00:00:00Z'),
+    updatedAt: new Date('2026-08-18T00:00:00Z'),
+    ...overrides,
+  };
+}
+
+function makeService(overrides: { repo?: Record<string, unknown>; credentials?: Record<string, unknown>; downloads?: Record<string, unknown> } = {}) {
+  const repo = {
+    findAll: vi.fn().mockResolvedValue([{ client: clientRow(), pathMappings: [] }]),
+    findById: vi.fn().mockResolvedValue({ client: clientRow(), pathMappings: [] }),
+    findPreferredEnabled: vi.fn().mockResolvedValue(clientRow()),
+    create: vi.fn().mockResolvedValue(clientRow()),
+    createWithPathMappings: vi.fn().mockResolvedValue(clientRow()),
+    update: vi.fn().mockResolvedValue(clientRow()),
+    delete: vi.fn().mockResolvedValue(undefined),
+    recordTestResult: vi.fn().mockResolvedValue(undefined),
+    replacePathMappings: vi.fn().mockResolvedValue(undefined),
+    findAllEnabled: vi.fn().mockResolvedValue([clientRow()]),
+    ...overrides.repo,
+  };
+  const credentials = {
+    encrypt: vi.fn().mockReturnValue('cipher'),
+    decrypt: vi.fn().mockReturnValue('secret'),
+    isConfigured: vi.fn().mockReturnValue(true),
+    ...overrides.credentials,
+  };
+  const adapter = { test: vi.fn().mockResolvedValue({ success: true, version: 'v5.0.3' }), forget: vi.fn() };
+  const registry = { require: vi.fn().mockReturnValue(adapter), find: vi.fn().mockReturnValue(adapter) };
+  const pathMappings = { testHardlink: vi.fn().mockResolvedValue({ localPathExists: true, bookDockPathExists: true, hardlinkWorks: true }) };
+  const config = { getOrThrow: vi.fn().mockReturnValue('/data/book-dock') };
+  const downloads = { countInFlightForClient: vi.fn().mockResolvedValue(0), ...overrides.downloads };
+
+  const service = new DownloadClientConfigService(
+    repo as never,
+    credentials as never,
+    registry as never,
+    pathMappings as never,
+    downloads as never,
+    config as never,
+  );
+  return { service, repo, credentials, registry, adapter, pathMappings, downloads };
+}
+
+// TEST-NET-3 literal: no DNS lookup in tests, and not a private address.
+/**
+ * The mapping is not optional decoration: it declares the directory the import may read out of, so
+ * every save the tests make has to carry one the way a real one does.
+ */
+const createDto = {
+  name: 'qbit',
+  adapterType: 'qbittorrent' as const,
+  baseUrl: 'http://203.0.113.10:8080',
+  pathMappings: [{ remotePath: '/downloads', localPath: '/data/torrents' }],
+};
+
+describe('DownloadClientConfigService', () => {
+  it('never returns the stored credential, only whether one exists', async () => {
+    const { service } = makeService();
+    const {
+      clients: [item],
+    } = await service.findAll();
+
+    expect(item).not.toHaveProperty('credentialsEnc');
+    expect(item.hasPassword).toBe(true);
+  });
+
+  /** Told up front, because a missing key is what refuses the save rather than a bad value. */
+  it('reports whether credentials can be stored at all', async () => {
+    const { service } = makeService({ credentials: { isConfigured: vi.fn().mockReturnValue(false) } });
+    await expect(service.findAll()).resolves.toMatchObject({ encryptionConfigured: false });
+  });
+
+  /** An approver may pick a client without being trusted with how to reach it. */
+  it('summarises only compatible enabled clients as names and ids', async () => {
+    const { service } = makeService({
+      repo: {
+        findAllEnabled: vi.fn().mockResolvedValue([clientRow()]),
+      },
+    });
+
+    await expect(service.findEnabledSummaries('torrent')).resolves.toEqual([{ id: 4, name: 'qbit', color: null }]);
+    // Direct files are fetched by BookOrbit itself, so there is never a client row to pick.
+    await expect(service.findEnabledSummaries('file')).resolves.toEqual([]);
+  });
+
+  it('answers with nothing rather than inventing a client when none is configured', async () => {
+    const { service, repo } = makeService({ repo: { findPreferredEnabled: vi.fn().mockResolvedValue(undefined) } });
+
+    await expect(service.findPreferredEnabled(['qbittorrent'])).resolves.toBeUndefined();
+    expect(repo.findAll).not.toHaveBeenCalled();
+    expect(repo.create).not.toHaveBeenCalled();
+  });
+
+  it('drops any cached session when the way we reach the client changes', async () => {
+    const { service, adapter } = makeService();
+    await service.update(4, { username: 'operator' });
+    expect(adapter.forget).toHaveBeenCalledWith(4);
+  });
+
+  it('leaves the cached session alone for an edit that cannot affect it', async () => {
+    const { service, adapter } = makeService();
+    await service.update(4, { priority: 9 });
+    expect(adapter.forget).not.toHaveBeenCalled();
+  });
+
+  it('persists an assigned color without reopening the client connection', async () => {
+    const { service, repo, adapter } = makeService();
+    await service.update(4, { color: 'green' });
+
+    expect(repo.update).toHaveBeenCalledWith(4, { color: 'green' });
+    expect(adapter.forget).not.toHaveBeenCalled();
+  });
+
+  /**
+   * A relative path would resolve against the server process's working directory at import time,
+   * which is neither what the operator typed nor anywhere they can predict.
+   */
+  it('refuses a path mapping that is not absolute on both sides', async () => {
+    const { service } = makeService();
+    await expect(service.create({ ...createDto, pathMappings: [{ remotePath: 'downloads', localPath: '/data/downloads' }] })).rejects.toThrow(
+      BadRequestException,
+    );
+    await expect(service.create({ ...createDto, pathMappings: [{ remotePath: '/downloads', localPath: 'data' }] })).rejects.toThrow(
+      BadRequestException,
+    );
+  });
+
+  /**
+   * Rejecting after the insert leaves a client the operator cannot save over, because the second
+   * attempt collides with the name the first one took.
+   */
+  it('writes nothing at all when a path mapping is rejected', async () => {
+    const { service, repo } = makeService();
+
+    await expect(service.create({ ...createDto, pathMappings: [{ remotePath: 'downloads', localPath: '/data/downloads' }] })).rejects.toThrow(
+      BadRequestException,
+    );
+
+    expect(repo.createWithPathMappings).not.toHaveBeenCalled();
+  });
+
+  it('leaves an existing client untouched when its edit carries a bad mapping', async () => {
+    const { service, repo } = makeService();
+
+    await expect(service.update(4, { priority: 3, pathMappings: [{ remotePath: '/downloads', localPath: 'relative' }] })).rejects.toThrow(
+      BadRequestException,
+    );
+
+    expect(repo.update).not.toHaveBeenCalled();
+    expect(repo.replacePathMappings).not.toHaveBeenCalled();
+  });
+
+  it('accepts a Windows client path against a POSIX local one', async () => {
+    const { service, repo } = makeService();
+    const remotePath = ['D:', 'downloads'].join('\\');
+    await service.create({ ...createDto, pathMappings: [{ remotePath, localPath: '/data/downloads' }] });
+    expect(repo.createWithPathMappings).toHaveBeenCalledWith(expect.anything(), [{ remotePath, localPath: '/data/downloads' }]);
+  });
+
+  it('encrypts a password on the way in', async () => {
+    const { service, credentials, repo } = makeService();
+    await service.create({ ...createDto, password: 'hunter2' });
+
+    expect(credentials.encrypt).toHaveBeenCalledWith('hunter2');
+    expect(repo.createWithPathMappings).toHaveBeenCalledWith(expect.objectContaining({ credentialsEnc: 'cipher' }), expect.anything());
+  });
+
+  it('lets the credential service refuse a save when no encryption key is set', async () => {
+    const { service } = makeService({
+      credentials: {
+        encrypt: vi.fn().mockImplementation(() => {
+          throw new BadRequestException('Set BOOK_REQUEST_ENCRYPTION_KEY');
+        }),
+      },
+    });
+
+    await expect(service.create({ ...createDto, password: 'hunter2' })).rejects.toThrow(BadRequestException);
+  });
+
+  it('keeps the stored password when the update omits one', async () => {
+    const { service, repo } = makeService();
+    await service.update(4, { name: 'renamed' });
+
+    expect(repo.update).toHaveBeenCalledWith(4, { name: 'renamed' });
+  });
+
+  it('clears the password when the update sends an empty one', async () => {
+    const { service, repo } = makeService();
+    await service.update(4, { password: '' });
+
+    expect(repo.update).toHaveBeenCalledWith(4, { credentialsEnc: null });
+  });
+
+  /** Indexer URLs are user-supplied; a client on the LAN has to be opted in per row. */
+  it('refuses a private base URL unless the row opts in, and says how to fix it', async () => {
+    const { service } = makeService();
+    await expect(service.create({ ...createDto, baseUrl: 'http://127.0.0.1:8080', allowPrivateAddress: false })).rejects.toThrow(
+      /Allow private addresses/,
+    );
+  });
+
+  it('accepts a private base URL once the row opts in', async () => {
+    const { service, repo } = makeService();
+    await service.create({ ...createDto, baseUrl: 'http://127.0.0.1:8080', allowPrivateAddress: true });
+    expect(repo.createWithPathMappings).toHaveBeenCalled();
+  });
+
+  it('reports a duplicate name as a conflict', async () => {
+    const { service } = makeService({
+      repo: {
+        createWithPathMappings: vi.fn().mockRejectedValue(new Error('Failed query', { cause: Object.assign(new Error('dup'), { code: '23505' }) })),
+      },
+    });
+    await expect(service.create(createDto)).rejects.toThrow(ConflictException);
+  });
+
+  it('drops blank and duplicate path mappings rather than failing the whole save', async () => {
+    const { service, repo } = makeService();
+    await service.create({
+      ...createDto,
+      pathMappings: [
+        { remotePath: ' /downloads ', localPath: ' /data/torrents ' },
+        { remotePath: '/downloads', localPath: '/data/other' },
+        { remotePath: '', localPath: '/data/nothing' },
+      ],
+    });
+
+    expect(repo.createWithPathMappings).toHaveBeenCalledWith(expect.anything(), [{ remotePath: '/downloads', localPath: '/data/torrents' }]);
+  });
+
+  /** Rows that predate the rule are edited, not blocked; the grab is what refuses them. */
+  it('leaves existing mappings alone when the update does not mention them', async () => {
+    const { service, repo } = makeService();
+    await service.update(4, { name: 'renamed' });
+    expect(repo.replacePathMappings).not.toHaveBeenCalled();
+  });
+
+  it('refuses a client with no path mapping, so nothing it downloads is imported from an undeclared root', async () => {
+    const { service } = makeService();
+    await expect(service.create({ ...createDto, pathMappings: [] })).rejects.toThrow(BadRequestException);
+    await expect(service.update(4, { pathMappings: [] })).rejects.toThrow(BadRequestException);
+  });
+
+  /** The single-host install: same filesystem is an identity mapping, not an absent one. */
+  it('accepts an identity mapping', async () => {
+    const { service, repo } = makeService();
+    await service.create({ ...createDto, pathMappings: [{ remotePath: '/downloads', localPath: '/downloads' }] });
+    expect(repo.createWithPathMappings).toHaveBeenCalledWith(expect.anything(), [{ remotePath: '/downloads', localPath: '/downloads' }]);
+  });
+
+  it('stamps the row with the outcome of a connection test', async () => {
+    const { service, repo } = makeService();
+    await expect(service.test(4)).resolves.toEqual({ success: true, version: 'v5.0.3' });
+    expect(repo.recordTestResult).toHaveBeenCalledWith(4, true, null);
+  });
+
+  it('records why a connection test failed, and reports it as a failure rather than a 200', async () => {
+    const { service, repo, registry } = makeService();
+    registry.require.mockReturnValue({ test: vi.fn().mockResolvedValue({ success: false, error: 'refused' }) });
+
+    await expect(service.test(4)).rejects.toMatchObject({ status: HttpStatus.BAD_GATEWAY, response: { message: 'refused' } });
+    expect(repo.recordTestResult).toHaveBeenCalledWith(4, false, 'refused');
+  });
+
+  it('answers a passing test normally', async () => {
+    const { service, repo, registry } = makeService();
+    registry.require.mockReturnValue({ test: vi.fn().mockResolvedValue({ success: true }) });
+
+    await expect(service.test(4)).resolves.toEqual({ success: true });
+    expect(repo.recordTestResult).toHaveBeenCalledWith(4, true, null);
+  });
+
+  it('decrypts credentials only into a value object, never onto the row', async () => {
+    const { service, credentials } = makeService();
+    const resolved = await service.resolveConfig(4);
+
+    expect(credentials.decrypt).toHaveBeenCalledWith('cipher');
+    expect(resolved).toMatchObject({ id: 4, password: 'secret', allowPrivateAddress: false });
+  });
+
+  it('404s an unknown client', async () => {
+    const { service } = makeService({ repo: { findById: vi.fn().mockResolvedValue(undefined) } });
+    await expect(service.findOne(99)).rejects.toThrow(NotFoundException);
+  });
+
+  describe('testHardlink', () => {
+    const withMapping = {
+      findById: vi.fn().mockResolvedValue({
+        client: clientRow(),
+        pathMappings: [{ id: 7, downloadClientId: 4, remotePath: '/downloads', localPath: '/data/torrents' }],
+      }),
+    };
+
+    it('probes the directory the named mapping stored, never one the caller supplied', async () => {
+      const { service, pathMappings } = makeService({ repo: withMapping });
+
+      await service.testHardlink(4, 7);
+
+      expect(pathMappings.testHardlink).toHaveBeenCalledWith('/data/torrents', '/data/book-dock');
+    });
+
+    it('404s a mapping that belongs to another client, so the probe cannot be aimed anywhere else', async () => {
+      const { service, pathMappings } = makeService({ repo: withMapping });
+
+      await expect(service.testHardlink(4, 8)).rejects.toThrow(NotFoundException);
+      expect(pathMappings.testHardlink).not.toHaveBeenCalled();
+    });
+  });
+
+  /**
+   * The attempt's FK nulls on delete, so a torrent whose client is removed keeps running while
+   * nothing can poll it, map it to a local path or remove it again.
+   */
+  describe('remove', () => {
+    it('refuses while the client is still working on downloads, and says how many', async () => {
+      const { service, repo, downloads } = makeService({ downloads: { countInFlightForClient: vi.fn().mockResolvedValue(3) } });
+
+      await expect(service.remove(4)).rejects.toThrow(/3 downloads/);
+      expect(repo.delete).not.toHaveBeenCalled();
+      expect(downloads.countInFlightForClient).toHaveBeenCalledWith(4);
+    });
+
+    it('reads as a conflict rather than a bad request, so the UI can offer to go and clear them', async () => {
+      const { service } = makeService({ downloads: { countInFlightForClient: vi.fn().mockResolvedValue(1) } });
+
+      await expect(service.remove(4)).rejects.toBeInstanceOf(ConflictException);
+    });
+
+    it('deletes a client with nothing in flight, dropping its cached session with it', async () => {
+      const { service, repo, adapter } = makeService();
+
+      await service.remove(4);
+
+      expect(repo.delete).toHaveBeenCalledWith(4);
+      expect(adapter.forget).toHaveBeenCalledWith(4);
+    });
+  });
+});
diff --git a/server/src/modules/book-request/download-clients/download-client-config.service.ts b/server/src/modules/book-request/download-clients/download-client-config.service.ts
new file mode 100644
index 000000000..58c18dfe0
--- /dev/null
+++ b/server/src/modules/book-request/download-clients/download-client-config.service.ts
@@ -0,0 +1,341 @@
+import { BadGatewayException, BadRequestException, ConflictException, HttpStatus, Injectable, Logger, NotFoundException } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { isAbsolute as isPosixAbsolute } from 'path/posix';
+import type {
+  DownloadClientErrorCode,
+  DownloadClientItem,
+  DownloadClientListResult,
+  DownloadClientSummary,
+  DownloadClientTestResult,
+  DownloadClientType,
+  DownloadDelivery,
+  PathMappingHardlinkTestResult,
+} from '@bookorbit/types';
+import { DOWNLOAD_CLIENT_DELIVERY } from '@bookorbit/types';
+
+import { isUniqueViolation } from '../../../common/utils/db-error.utils';
+import { sanitizeLogValue } from '../../../common/utils/log-sanitize.utils';
+import { PrivateAddressException, ensureSafeUrl } from '../../../common/utils/ssrf.utils';
+import type { DownloadClientPathMappingRow, DownloadClientRow } from '../../../db/schema';
+import { BookRequestDownloadRepository } from '../fulfillment/book-request-download.repository';
+import { RequestCredentialService } from '../request-credential.service';
+import type { ResolvedClientConfig } from './download-client-adapter';
+import { DownloadClientRegistry } from './download-client-registry';
+import { DownloadClientRepository, type DownloadClientWithMappings } from './download-client.repository';
+import { ADD_PATH_MAPPING_HINT, PathMappingService } from './path-mapping.service';
+import type { CreateDownloadClientDto, UpdateDownloadClientDto } from './dto/download-client.dto';
+
+/** Editing any of these changes how the adapter reaches the client, so its session must be dropped. */
+const CONNECTION_FIELDS = ['baseUrl', 'username', 'password', 'allowPrivateAddress', 'adapterType'] as const satisfies ReadonlyArray<
+  keyof UpdateDownloadClientDto
+>;
+
+@Injectable()
+export class DownloadClientConfigService {
+  private readonly logger = new Logger(DownloadClientConfigService.name);
+  private readonly bookDockPath: string;
+
+  constructor(
+    private readonly repo: DownloadClientRepository,
+    private readonly credentials: RequestCredentialService,
+    private readonly registry: DownloadClientRegistry,
+    private readonly pathMappings: PathMappingService,
+    private readonly downloads: BookRequestDownloadRepository,
+    config: ConfigService,
+  ) {
+    this.bookDockPath = config.getOrThrow<string>('storage.bookDockPath');
+  }
+
+  async findAll(): Promise<DownloadClientListResult> {
+    const rows = await this.repo.findAll();
+    return { clients: rows.map((row) => toItem(row)), encryptionConfigured: this.credentials.isConfigured() };
+  }
+
+  /**
+   * Names and ids of the clients an approver may pick between. Deliberately not `findAll()`: this
+   * one answers to `ManageBookRequests`, and a base URL or a `hasPassword` flag is not something
+   * moderating a queue should carry with it.
+   */
+  async findEnabledSummaries(delivery: DownloadDelivery): Promise<DownloadClientSummary[]> {
+    const rows = await this.repo.findAllEnabled();
+    return rows
+      .filter((row) => DOWNLOAD_CLIENT_DELIVERY[row.adapterType as DownloadClientType] === delivery)
+      .map((row) => ({ id: row.id, name: row.name, color: row.color ?? null }));
+  }
+
+  async findOne(id: number): Promise<DownloadClientItem> {
+    return toItem(await this.requireClient(id));
+  }
+
+  async create(dto: CreateDownloadClientDto): Promise<DownloadClientItem> {
+    // Everything that can reject the save runs before anything is written. Validating the mappings
+    // after the insert would answer "that path is not absolute" while leaving a half-made client
+    // behind, which the operator then cannot save over because the name is taken.
+    await this.assertReachableUrl(dto.baseUrl, dto.allowPrivateAddress ?? true);
+    const pathMappings = requireMappings(normalizeMappings(dto.pathMappings));
+    const credentialsEnc = dto.password ? this.credentials.encrypt(dto.password) : null;
+
+    let created: DownloadClientRow;
+    try {
+      created = await this.repo.createWithPathMappings(
+        {
+          name: dto.name.trim(),
+          color: dto.color ?? null,
+          adapterType: dto.adapterType,
+          baseUrl: dto.baseUrl.trim(),
+          username: dto.username?.trim() || null,
+          credentialsEnc,
+          enabled: dto.enabled ?? true,
+          priority: dto.priority ?? 1,
+          category: dto.category?.trim() || 'bookorbit',
+          useHardlinks: dto.useHardlinks ?? true,
+          allowPrivateAddress: dto.allowPrivateAddress ?? true,
+        },
+        pathMappings,
+      );
+    } catch (error) {
+      throw this.translateUniqueViolation(error);
+    }
+
+    this.logger.log(`[download_client.create] [end] clientId=${created.id} adapterType=${created.adapterType} - download client created`);
+    return toItem(await this.requireClient(created.id));
+  }
+
+  async update(id: number, dto: UpdateDownloadClientDto): Promise<DownloadClientItem> {
+    const existing = await this.requireClient(id);
+
+    const baseUrl = dto.baseUrl?.trim() ?? existing.client.baseUrl;
+    const allowPrivate = dto.allowPrivateAddress ?? existing.client.allowPrivateAddress;
+    if (dto.baseUrl !== undefined || dto.allowPrivateAddress !== undefined || dto.adapterType !== undefined) {
+      await this.assertReachableUrl(baseUrl, allowPrivate);
+    }
+
+    // Only when the edit actually carries mappings. An operator toggling `enabled` on a row that
+    // predates this rule must not be refused for a field the form did not send.
+    const pathMappings = dto.pathMappings !== undefined ? requireMappings(normalizeMappings(dto.pathMappings)) : null;
+
+    const patch: Partial<DownloadClientRow> = {};
+    if (dto.name !== undefined) patch.name = dto.name.trim();
+    if (dto.color !== undefined) patch.color = dto.color;
+    if (dto.adapterType !== undefined) patch.adapterType = dto.adapterType;
+    if (dto.baseUrl !== undefined) patch.baseUrl = baseUrl;
+    if (dto.username !== undefined) patch.username = dto.username.trim() || null;
+
+    if (dto.enabled !== undefined) patch.enabled = dto.enabled;
+    if (dto.priority !== undefined) patch.priority = dto.priority;
+    if (dto.category !== undefined) patch.category = dto.category.trim() || 'bookorbit';
+    if (dto.useHardlinks !== undefined) patch.useHardlinks = dto.useHardlinks;
+    if (dto.allowPrivateAddress !== undefined) patch.allowPrivateAddress = dto.allowPrivateAddress;
+    // An omitted password keeps the stored one, so the settings form never has to round-trip it.
+    if (dto.password !== undefined) patch.credentialsEnc = dto.password ? this.credentials.encrypt(dto.password) : null;
+
+    try {
+      if (Object.keys(patch).length > 0 && !(await this.repo.update(id, patch))) {
+        throw new NotFoundException('Download client not found');
+      }
+    } catch (error) {
+      throw this.translateUniqueViolation(error);
+    }
+
+    if (pathMappings !== null) {
+      await this.repo.replacePathMappings(id, pathMappings);
+    }
+
+    // A cached session outliving the config it was opened with would keep talking to the old host
+    // with the old cookie until it happened to be rejected.
+    if (CONNECTION_FIELDS.some((field) => dto[field] !== undefined)) {
+      this.registry.find(existing.client.adapterType as DownloadClientType)?.forget?.(id);
+    }
+
+    return toItem(await this.requireClient(id));
+  }
+
+  /**
+   * Refused while the client still holds live attempts.
+   *
+   * The attempt's FK nulls on delete rather than cascading, so the row survives with nothing on it
+   * saying where its torrent went: it stops being polled, stops being mappable to a local path and
+   * stops being removable, while the client goes on running the transfer. Detaching each one on
+   * the operator's behalf would be a guess about work they may want to keep, so they are told the
+   * count and left to decide.
+   */
+  async remove(id: number): Promise<void> {
+    const { client } = await this.requireClient(id);
+
+    const live = await this.downloads.countInFlightForClient(id);
+    if (live > 0) {
+      throw new ConflictException(
+        `This client is still working on ${live} ${live === 1 ? 'download' : 'downloads'}. Cancel or remove them first, then delete the client.`,
+      );
+    }
+
+    this.registry.find(client.adapterType as DownloadClientType)?.forget?.(id);
+    await this.repo.delete(id);
+    this.logger.log(`[download_client.delete] [end] clientId=${id} - download client removed`);
+  }
+
+  /**
+   * A test that ran and came back negative answers 502 rather than 200. The stored health stamp
+   * is written either way, so the card still shows what happened; what changes is that a script,
+   * a curl or a log line can no longer read a refused connection as a pass.
+   */
+  async test(id: number): Promise<DownloadClientTestResult> {
+    const config = await this.resolveConfig(id);
+    const adapter = this.registry.require(config.adapterType);
+    const result = await adapter.test(config);
+    const reason = result.success ? null : (result.error ?? 'Unknown error');
+    await this.repo.recordTestResult(id, result.success, reason);
+
+    if (reason !== null) {
+      throw new BadGatewayException({ message: reason, errorCode: 'DOWNLOAD_CLIENT_TEST_FAILED', statusCode: HttpStatus.BAD_GATEWAY });
+    }
+    return result;
+  }
+
+  /**
+   * The directory comes from the named mapping, never from the request body: the probe writes and
+   * unlinks where it is pointed, so a caller-supplied path would make this an arbitrary-directory
+   * write and existence oracle over the whole host, which is exactly what every other filesystem
+   * path in BookOrbit is rooted to stop.
+   */
+  async testHardlink(id: number, mappingId: number): Promise<PathMappingHardlinkTestResult> {
+    const { pathMappings } = await this.requireClient(id);
+    const mapping = pathMappings.find((row) => row.id === mappingId);
+    if (!mapping) throw new NotFoundException('Path mapping not found');
+    return this.pathMappings.testHardlink(mapping.localPath, this.bookDockPath);
+  }
+
+  /**
+   * The only place credentials are decrypted. Callers get a value object, never the row, so a
+   * `credentialsEnc` blob cannot reach a response body or a log line by accident.
+   */
+  async resolveConfig(id: number): Promise<ResolvedClientConfig> {
+    const { client } = await this.requireClient(id);
+    return {
+      id: client.id,
+      name: client.name,
+      adapterType: client.adapterType as DownloadClientType,
+      baseUrl: client.baseUrl,
+      username: client.username,
+      password: client.credentialsEnc ? this.credentials.decrypt(client.credentialsEnc) : null,
+      category: client.category,
+      allowPrivateAddress: client.allowPrivateAddress,
+      settings: client.settings ?? null,
+    };
+  }
+
+  async findPreferredEnabled(adapterTypes: readonly DownloadClientType[]): Promise<DownloadClientRow | undefined> {
+    return this.repo.findPreferredEnabled(adapterTypes);
+  }
+
+  async useHardlinks(id: number): Promise<boolean> {
+    const { client } = await this.requireClient(id);
+    return client.useHardlinks;
+  }
+
+  private async requireClient(id: number): Promise<DownloadClientWithMappings> {
+    const row = await this.repo.findById(id);
+    if (!row) throw new NotFoundException('Download client not found');
+    return row;
+  }
+
+  /**
+
+   * Clients usually live on the LAN, so `allowPrivate` is a per-row opt-in with the implication
+   * stated in the UI rather than a blanket relaxation.
+   */
+  private async assertReachableUrl(baseUrl: string, allowPrivate: boolean): Promise<void> {
+    try {
+      await ensureSafeUrl(baseUrl, { allowPrivate });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      this.logger.warn(`[download_client.url_check] [fail] error="${sanitizeLogValue(message)}" - rejected download client base URL`);
+      const isPrivateAddress = error instanceof PrivateAddressException;
+      throw downloadClientError(
+        isPrivateAddress ? 'DOWNLOAD_CLIENT_URL_PRIVATE' : 'DOWNLOAD_CLIENT_URL_UNSAFE',
+        isPrivateAddress && !allowPrivate ? `${message}. Enable "Allow private addresses" if this client is on your local network.` : message,
+      );
+    }
+  }
+
+  private translateUniqueViolation(error: unknown): unknown {
+    if (isUniqueViolation(error)) {
+      return new ConflictException({ message: 'A download client with this name already exists', errorCode: 'DOWNLOAD_CLIENT_NAME_TAKEN' });
+    }
+    return error;
+  }
+}
+
+/** Carries a stable code alongside the English text, so the settings form can translate it. */
+function downloadClientError(errorCode: DownloadClientErrorCode, message: string): BadRequestException {
+  return new BadRequestException({ message, errorCode, statusCode: HttpStatus.BAD_REQUEST });
+}
+
+/** A Windows client reports `D:\downloads`; the local side is always POSIX. Both must be rooted. */
+function isAbsoluteRemotePath(value: string): boolean {
+  const normalized = value.replace(/\\/g, '/');
+  return isPosixAbsolute(normalized) || /^[a-z]:\//i.test(normalized);
+}
+
+function normalizeMappings(mappings: Array<{ remotePath: string; localPath: string }> | undefined): Array<{ remotePath: string; localPath: string }> {
+  if (!mappings?.length) return [];
+
+  const seen = new Set<string>();
+  const normalized: Array<{ remotePath: string; localPath: string }> = [];
+  for (const mapping of mappings) {
+    const remotePath = mapping.remotePath.trim();
+    const localPath = mapping.localPath.trim();
+    if (!remotePath || !localPath) continue;
+    // A relative path would resolve against the server process's working directory at import
+    // time, which is neither what the operator typed nor anywhere predictable.
+    if (!isAbsoluteRemotePath(remotePath) || !isPosixAbsolute(localPath)) {
+      throw downloadClientError('DOWNLOAD_CLIENT_PATH_NOT_ABSOLUTE', `Path mappings must use absolute paths: "${remotePath}" -> "${localPath}"`);
+    }
+    // The unique index would reject a duplicate remote prefix mid-transaction; drop it here so
+    // the operator gets an edit that saves rather than a 409 from a row they cannot see.
+    if (seen.has(remotePath)) continue;
+    seen.add(remotePath);
+    normalized.push({ remotePath, localPath });
+  }
+  return normalized;
+}
+
+/**
+ * The mapping is what declares the directory the import may read out of, so a client without one
+ * is a client BookOrbit cannot safely import from. Required in the single-host case too, where it
+ * is an identity mapping: same filesystem is a translation that does nothing, not an absent root.
+ */
+function requireMappings(mappings: Array<{ remotePath: string; localPath: string }>): Array<{ remotePath: string; localPath: string }> {
+  if (mappings.length > 0) return mappings;
+  throw downloadClientError(
+    'DOWNLOAD_CLIENT_MAPPING_REQUIRED',
+    `A download client needs at least one path mapping, so BookOrbit knows which directory it may import from. ${ADD_PATH_MAPPING_HINT}`,
+  );
+}
+
+function toItem({ client, pathMappings }: DownloadClientWithMappings): DownloadClientItem {
+  return {
+    id: client.id,
+    name: client.name,
+    color: client.color ?? null,
+    adapterType: client.adapterType as DownloadClientType,
+    enabled: client.enabled,
+    priority: client.priority,
+    baseUrl: client.baseUrl,
+    username: client.username,
+    hasPassword: client.credentialsEnc !== null,
+    category: client.category,
+    useHardlinks: client.useHardlinks,
+    allowPrivateAddress: client.allowPrivateAddress,
+    lastTestedAt: client.lastTestedAt?.toISOString() ?? null,
+    lastTestOk: client.lastTestOk,
+    lastErrorMessage: client.lastErrorMessage,
+    pathMappings: pathMappings.map(toMappingItem),
+    createdAt: client.createdAt.toISOString(),
+    updatedAt: client.updatedAt.toISOString(),
+  };
+}
+
+function toMappingItem(row: DownloadClientPathMappingRow) {
+  return { id: row.id, remotePath: row.remotePath, localPath: row.localPath };
+}
diff --git a/server/src/modules/book-request/download-clients/download-client-reconciliation.service.test.ts b/server/src/modules/book-request/download-clients/download-client-reconciliation.service.test.ts
new file mode 100644
index 000000000..ec31e6f6c
--- /dev/null
+++ b/server/src/modules/book-request/download-clients/download-client-reconciliation.service.test.ts
@@ -0,0 +1,164 @@
+import { BadRequestException } from '@nestjs/common';
+
+import type { BookRequestDownloadRow } from '../../../db/schema';
+import type { ReconciliationAttemptRow } from '../fulfillment/book-request-download.repository';
+import { DownloadClientReconciliationService } from './download-client-reconciliation.service';
+
+const CLIENT_HASH = 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa';
+const ORPHAN_HASH = 'bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb';
+const MISSING_HASH = 'cccccccccccccccccccccccccccccccccccccccc';
+
+function attempt(
+  id: number,
+  requestId: number,
+  clientHash: string,
+  status: BookRequestDownloadRow['status'],
+  requestTitle: string,
+): ReconciliationAttemptRow {
+  return {
+    download: { id, requestId, clientHash, status } as BookRequestDownloadRow,
+    requestTitle,
+  };
+}
+
+function owned(infoHash: string, state: 'queued' | 'downloading' | 'completed' = 'downloading') {
+  return {
+    infoHash,
+    name: `Item ${infoHash.slice(0, 4)}`,
+    state,
+    progressPercent: state === 'completed' ? 100 : 35,
+    downloadedBytes: 350,
+    totalBytes: 1000,
+    contentPath: '/downloads/item',
+  } as const;
+}
+
+function makeService() {
+  const clients = {
+    resolveConfig: vi.fn().mockResolvedValue({ id: 4, adapterType: 'qbittorrent', category: 'bookorbit' }),
+  };
+  const adapter = {
+    listOwned: vi.fn().mockResolvedValue({ supported: true, truncated: false, items: [] }),
+    remove: vi.fn().mockResolvedValue(undefined),
+  };
+  const registry = { require: vi.fn().mockReturnValue(adapter) };
+  const downloads = {
+    findTrackedForClientHashes: vi.fn().mockResolvedValue([]),
+    findAdoptableForHashes: vi.fn().mockResolvedValue([]),
+    findActiveForClient: vi.fn().mockResolvedValue([]),
+    adoptFailedAttempt: vi.fn(),
+  };
+  const gateway = { emitChanged: vi.fn() };
+  const service = new DownloadClientReconciliationService(clients as never, registry as never, downloads as never, gateway as never);
+
+  return { service, clients, adapter, registry, downloads, gateway };
+}
+
+describe('DownloadClientReconciliationService', () => {
+  it('diffs the client inventory against tracked, adoptable, and missing attempts', async () => {
+    const { service, adapter, downloads } = makeService();
+    const tracked = attempt(11, 7, CLIENT_HASH, 'downloading', 'Tracked book');
+    const adoptable = attempt(12, 8, ORPHAN_HASH, 'failed', 'Retry this book');
+    const missing = attempt(13, 9, MISSING_HASH, 'queued', 'Missing book');
+    adapter.listOwned.mockResolvedValue({
+      supported: true,
+      truncated: false,
+      items: [owned(CLIENT_HASH), owned(ORPHAN_HASH, 'completed')],
+    });
+    downloads.findTrackedForClientHashes.mockResolvedValue([tracked]);
+    downloads.findAdoptableForHashes.mockResolvedValue([adoptable]);
+    downloads.findActiveForClient.mockResolvedValue([tracked, missing]);
+
+    const result = await service.reconcile(4);
+
+    expect(result).toMatchObject({
+      clientId: 4,
+      supported: true,
+      ownershipMarker: 'bookorbit',
+      truncated: false,
+      items: [
+        {
+          infoHash: CLIENT_HASH,
+          trackedAttempt: { downloadId: 11, requestId: 7, requestTitle: 'Tracked book', status: 'downloading' },
+          adoptableAttempts: [],
+        },
+        {
+          infoHash: ORPHAN_HASH,
+          trackedAttempt: null,
+          adoptableAttempts: [{ downloadId: 12, requestId: 8, requestTitle: 'Retry this book', status: 'failed' }],
+        },
+      ],
+      missingAttempts: [{ downloadId: 13, requestId: 9, requestTitle: 'Missing book', status: 'queued' }],
+    });
+  });
+
+  it('does not report missing attempts from a truncated client inventory', async () => {
+    const { service, adapter, downloads } = makeService();
+    adapter.listOwned.mockResolvedValue({ supported: true, truncated: true, items: [owned(CLIENT_HASH)] });
+
+    const result = await service.reconcile(4);
+
+    expect(result.truncated).toBe(true);
+    expect(result.missingAttempts).toEqual([]);
+    expect(downloads.findActiveForClient).not.toHaveBeenCalled();
+  });
+
+  it('reports a client whose ownership marker cannot be enumerated as unsupported', async () => {
+    const { service, adapter, downloads } = makeService();
+    adapter.listOwned.mockResolvedValue({ supported: false, truncated: false, items: [] });
+
+    await expect(service.reconcile(4)).resolves.toMatchObject({ supported: false, ownershipMarker: 'bookorbit', items: [] });
+    expect(downloads.findTrackedForClientHashes).not.toHaveBeenCalled();
+  });
+
+  it('rechecks the client item and adopts the exact failed attempt atomically', async () => {
+    const { service, adapter, downloads, gateway } = makeService();
+    const candidate = attempt(12, 8, ORPHAN_HASH, 'failed', 'Retry this book');
+    const adopted = { ...candidate.download, downloadClientId: 4, status: 'completed' } as BookRequestDownloadRow;
+    adapter.listOwned.mockResolvedValue({ supported: true, truncated: false, items: [owned(ORPHAN_HASH, 'completed')] });
+    downloads.findAdoptableForHashes.mockResolvedValue([candidate]);
+    downloads.adoptFailedAttempt.mockResolvedValue(adopted);
+
+    await expect(service.adopt(4, ORPHAN_HASH.toUpperCase(), 12)).resolves.toEqual({
+      downloadId: 12,
+      requestId: 8,
+      requestTitle: 'Retry this book',
+      status: 'completed',
+    });
+    expect(downloads.adoptFailedAttempt).toHaveBeenCalledWith(12, 4, ORPHAN_HASH, {
+      status: 'completed',
+      progressPercent: 100,
+      downloadedBytes: 350,
+      totalBytes: 1000,
+      contentPath: '/downloads/item',
+    });
+    expect(gateway.emitChanged).toHaveBeenCalledTimes(1);
+  });
+
+  it('refuses to remove an item once any database attempt owns it', async () => {
+    const { service, adapter, downloads } = makeService();
+    adapter.listOwned.mockResolvedValue({ supported: true, truncated: false, items: [owned(ORPHAN_HASH)] });
+    downloads.findTrackedForClientHashes.mockResolvedValue([attempt(12, 8, ORPHAN_HASH, 'failed', 'Tracked book')]);
+
+    await expect(service.removeOrphan(4, ORPHAN_HASH, false)).rejects.toMatchObject({
+      response: { errorCode: 'DOWNLOAD_CLIENT_RECONCILIATION_NOT_ORPHAN' },
+    });
+    expect(adapter.remove).not.toHaveBeenCalled();
+  });
+
+  it('removes a freshly confirmed orphan while preserving its files', async () => {
+    const { service, adapter } = makeService();
+    adapter.listOwned.mockResolvedValue({ supported: true, truncated: false, items: [owned(ORPHAN_HASH)] });
+
+    await service.removeOrphan(4, ORPHAN_HASH, false);
+
+    expect(adapter.remove).toHaveBeenCalledWith(ORPHAN_HASH, expect.anything(), { deleteFiles: false });
+  });
+
+  it('rejects malformed hashes before asking the client', async () => {
+    const { service, adapter } = makeService();
+
+    await expect(service.adopt(4, '../not-a-hash', 12)).rejects.toBeInstanceOf(BadRequestException);
+    expect(adapter.listOwned).not.toHaveBeenCalled();
+  });
+});
diff --git a/server/src/modules/book-request/download-clients/download-client-reconciliation.service.ts b/server/src/modules/book-request/download-clients/download-client-reconciliation.service.ts
new file mode 100644
index 000000000..54dbe28f4
--- /dev/null
+++ b/server/src/modules/book-request/download-clients/download-client-reconciliation.service.ts
@@ -0,0 +1,175 @@
+import { BadRequestException, ConflictException, HttpStatus, Injectable, Logger, NotFoundException } from '@nestjs/common';
+import type {
+  BookRequestDownloadStatus,
+  DownloadClientErrorCode,
+  DownloadClientReconciliationAttempt,
+  DownloadClientReconciliationResult,
+} from '@bookorbit/types';
+
+import { BookRequestGateway } from '../book-request.gateway';
+import { BookRequestDownloadRepository, type ReconciliationAttemptRow } from '../fulfillment/book-request-download.repository';
+import type { OwnedDownloadClientItem } from './download-client-adapter';
+import { DownloadClientConfigService } from './download-client-config.service';
+import { DownloadClientRegistry } from './download-client-registry';
+
+const ADOPTABLE_STATES = new Set<OwnedDownloadClientItem['state']>(['queued', 'downloading', 'completed']);
+
+@Injectable()
+export class DownloadClientReconciliationService {
+  private readonly logger = new Logger(DownloadClientReconciliationService.name);
+
+  constructor(
+    private readonly clients: DownloadClientConfigService,
+    private readonly registry: DownloadClientRegistry,
+    private readonly downloads: BookRequestDownloadRepository,
+    private readonly gateway: BookRequestGateway,
+  ) {}
+
+  async reconcile(clientId: number): Promise<DownloadClientReconciliationResult> {
+    const config = await this.clients.resolveConfig(clientId);
+    const inventory = await this.registry.require(config.adapterType).listOwned(config);
+    if (!inventory.supported) {
+      return {
+        clientId,
+        supported: false,
+        ownershipMarker: config.category,
+        truncated: false,
+        items: [],
+        missingAttempts: [],
+      };
+    }
+
+    const hashes = [...new Set(inventory.items.map((item) => item.infoHash.toLowerCase()))];
+    const [tracked, adoptable, active] = await Promise.all([
+      this.downloads.findTrackedForClientHashes(clientId, hashes),
+      this.downloads.findAdoptableForHashes(hashes),
+      inventory.truncated ? Promise.resolve([]) : this.downloads.findActiveForClient(clientId),
+    ]);
+    const trackedByHash = firstByHash(tracked);
+    const adoptableByHash = groupByHash(adoptable);
+    const inventoryHashes = new Set(hashes);
+
+    return {
+      clientId,
+      supported: true,
+      ownershipMarker: config.category,
+      truncated: inventory.truncated,
+      items: inventory.items.map((item) => ({
+        infoHash: item.infoHash.toLowerCase(),
+        name: item.name,
+        state: item.state,
+        progressPercent: item.progressPercent,
+        trackedAttempt: toAttempt(trackedByHash.get(item.infoHash.toLowerCase()) ?? null),
+        adoptableAttempts: ADOPTABLE_STATES.has(item.state)
+          ? (adoptableByHash.get(item.infoHash.toLowerCase()) ?? []).map((row) => toAttempt(row))
+          : [],
+      })),
+      missingAttempts: active
+        .filter((row) => row.download.clientHash !== null && !inventoryHashes.has(row.download.clientHash.toLowerCase()))
+        .map((row) => toAttempt(row)),
+    };
+  }
+
+  async adopt(clientId: number, infoHash: string, downloadId: number): Promise<DownloadClientReconciliationAttempt> {
+    const hash = normalizeHash(infoHash);
+    const config = await this.clients.resolveConfig(clientId);
+    const inventory = await this.registry.require(config.adapterType).listOwned(config);
+    if (!inventory.supported) throw reconciliationError('DOWNLOAD_CLIENT_RECONCILIATION_UNSUPPORTED', 'This client cannot enumerate owned downloads');
+
+    const item = inventory.items.find((entry) => entry.infoHash.toLowerCase() === hash);
+    if (!item || !ADOPTABLE_STATES.has(item.state)) {
+      throw reconciliationError('DOWNLOAD_CLIENT_RECONCILIATION_NOT_ADOPTABLE', 'That client item is no longer available to adopt');
+    }
+
+    const candidates = await this.downloads.findAdoptableForHashes([hash]);
+    const candidate = candidates.find((entry) => entry.download.id === downloadId);
+    if (!candidate) {
+      throw reconciliationError('DOWNLOAD_CLIENT_RECONCILIATION_NOT_ADOPTABLE', 'That attempt can no longer adopt this client item');
+    }
+
+    const status = adoptionStatus(item.state);
+    const adopted = await this.downloads.adoptFailedAttempt(downloadId, clientId, hash, {
+      status,
+      progressPercent: item.progressPercent,
+      downloadedBytes: item.downloadedBytes,
+      totalBytes: item.totalBytes,
+      contentPath: item.contentPath,
+    });
+    if (!adopted) throw new ConflictException('That request changed before the client item could be adopted');
+
+    this.gateway.emitChanged();
+    this.logger.log(
+      `[download_client.reconcile] [end] clientId=${clientId} downloadId=${downloadId} requestId=${adopted.requestId} hash=${hash} action=adopt - client item attached to its failed attempt`,
+    );
+    return toAttempt({ download: adopted, requestTitle: candidate.requestTitle });
+  }
+
+  async removeOrphan(clientId: number, infoHash: string, deleteFiles: boolean): Promise<void> {
+    const hash = normalizeHash(infoHash);
+    const config = await this.clients.resolveConfig(clientId);
+    const adapter = this.registry.require(config.adapterType);
+    const inventory = await adapter.listOwned(config);
+    if (!inventory.supported) throw reconciliationError('DOWNLOAD_CLIENT_RECONCILIATION_UNSUPPORTED', 'This client cannot enumerate owned downloads');
+    if (!inventory.items.some((entry) => entry.infoHash.toLowerCase() === hash)) throw new NotFoundException('That client item no longer exists');
+
+    const tracked = await this.downloads.findTrackedForClientHashes(clientId, [hash]);
+    if (tracked.length > 0) {
+      throw reconciliationError('DOWNLOAD_CLIENT_RECONCILIATION_NOT_ORPHAN', 'That client item is still attached to a download attempt');
+    }
+
+    await adapter.remove(hash, config, { deleteFiles });
+    this.logger.log(
+      `[download_client.reconcile] [end] clientId=${clientId} hash=${hash} action=remove deleteFiles=${deleteFiles} - orphaned client item removed`,
+    );
+  }
+}
+
+function normalizeHash(value: string): string {
+  const normalized = value.trim().toLowerCase();
+  if (!/^[a-f0-9]{40,64}$/.test(normalized)) throw new BadRequestException('Invalid client hash');
+  return normalized;
+}
+
+function adoptionStatus(state: OwnedDownloadClientItem['state']): Extract<BookRequestDownloadStatus, 'queued' | 'downloading' | 'completed'> {
+  if (state === 'queued') return 'queued';
+  if (state === 'completed') return 'completed';
+  return 'downloading';
+}
+
+function firstByHash(rows: ReconciliationAttemptRow[]): Map<string, ReconciliationAttemptRow> {
+  const result = new Map<string, ReconciliationAttemptRow>();
+  for (const row of rows) {
+    const hash = row.download.clientHash?.toLowerCase();
+    if (hash && !result.has(hash)) result.set(hash, row);
+  }
+  return result;
+}
+
+function groupByHash(rows: ReconciliationAttemptRow[]): Map<string, ReconciliationAttemptRow[]> {
+  const result = new Map<string, ReconciliationAttemptRow[]>();
+  for (const row of rows) {
+    const hash = row.download.clientHash?.toLowerCase();
+    if (!hash) continue;
+    const bucket = result.get(hash) ?? [];
+    bucket.push(row);
+    result.set(hash, bucket);
+  }
+  return result;
+}
+
+function toAttempt(row: ReconciliationAttemptRow): DownloadClientReconciliationAttempt;
+function toAttempt(row: null): null;
+function toAttempt(row: ReconciliationAttemptRow | null): DownloadClientReconciliationAttempt | null;
+function toAttempt(row: ReconciliationAttemptRow | null): DownloadClientReconciliationAttempt | null {
+  if (!row) return null;
+  return {
+    downloadId: row.download.id,
+    requestId: row.download.requestId,
+    requestTitle: row.requestTitle,
+    status: row.download.status as BookRequestDownloadStatus,
+  };
+}
+
+function reconciliationError(errorCode: DownloadClientErrorCode, message: string): BadRequestException {
+  return new BadRequestException({ message, errorCode, statusCode: HttpStatus.BAD_REQUEST });
+}
diff --git a/server/src/modules/book-request/download-clients/download-client-registry.ts b/server/src/modules/book-request/download-clients/download-client-registry.ts
new file mode 100644
index 000000000..4d22f9447
--- /dev/null
+++ b/server/src/modules/book-request/download-clients/download-client-registry.ts
@@ -0,0 +1,24 @@
+import { BadRequestException, Inject, Injectable } from '@nestjs/common';
+import type { DownloadClientType } from '@bookorbit/types';
+
+import { DOWNLOAD_CLIENT_ADAPTERS, type DownloadClientAdapter } from './download-client-adapter';
+
+@Injectable()
+export class DownloadClientRegistry {
+  constructor(@Inject(DOWNLOAD_CLIENT_ADAPTERS) private readonly adapters: DownloadClientAdapter[]) {}
+
+  all(): DownloadClientAdapter[] {
+    return this.adapters;
+  }
+
+  find(type: DownloadClientType): DownloadClientAdapter | undefined {
+    return this.adapters.find((adapter) => adapter.type === type);
+  }
+
+  /** Used on every grab and poll, so a row whose type was dropped from the build fails loudly. */
+  require(type: DownloadClientType): DownloadClientAdapter {
+    const adapter = this.find(type);
+    if (!adapter) throw new BadRequestException(`Unknown download client type: ${type}`);
+    return adapter;
+  }
+}
diff --git a/server/src/modules/book-request/download-clients/download-client.controller.ts b/server/src/modules/book-request/download-clients/download-client.controller.ts
new file mode 100644
index 000000000..e56418dfc
--- /dev/null
+++ b/server/src/modules/book-request/download-clients/download-client.controller.ts
@@ -0,0 +1,111 @@
+import { Body, Controller, Delete, Get, HttpCode, HttpStatus, Param, ParseIntPipe, Post, Put } from '@nestjs/common';
+import { AuditAction, AuditResource, Permission } from '@bookorbit/types';
+
+import { Auditable } from '../../../common/decorators/auditable.decorator';
+import { RequirePermission } from '../../../common/decorators/require-permission.decorator';
+import { DownloadClientConfigService } from './download-client-config.service';
+import { DownloadClientReconciliationService } from './download-client-reconciliation.service';
+import { CreateDownloadClientDto, TestPathMappingDto, UpdateDownloadClientDto } from './dto/download-client.dto';
+import { AdoptDownloadClientItemDto, RemoveOrphanedDownloadClientItemDto } from './dto/reconcile-download-client.dto';
+
+/**
+ * Gated on `ManageAppSettings`, not `ManageBookRequests`: moderating a queue and holding seedbox
+ * credentials are different levels of trust, and an approver should not get the second by having
+ * the first.
+ */
+@Controller('admin/download-clients')
+@RequirePermission(Permission.ManageAppSettings)
+export class DownloadClientController {
+  constructor(
+    private readonly service: DownloadClientConfigService,
+    private readonly reconciliation: DownloadClientReconciliationService,
+  ) {}
+
+  @Get()
+  findAll() {
+    return this.service.findAll();
+  }
+
+  @Get(':id')
+  findOne(@Param('id', ParseIntPipe) id: number) {
+    return this.service.findOne(id);
+  }
+
+  @Get(':id/reconciliation')
+  reconcile(@Param('id', ParseIntPipe) id: number) {
+    return this.reconciliation.reconcile(id);
+  }
+
+  @Post(':id/reconciliation/:hash/adopt')
+  @Auditable({
+    action: AuditAction.DownloadClientUpdate,
+    resource: AuditResource.DownloadClient,
+    getResourceId: (req) => Number(req.params.id),
+    description: (req) => `Adopted an owned download into client #${req.params.id}`,
+  })
+  adopt(@Param('id', ParseIntPipe) id: number, @Param('hash') hash: string, @Body() dto: AdoptDownloadClientItemDto) {
+    return this.reconciliation.adopt(id, hash, dto.downloadId);
+  }
+
+  @Delete(':id/reconciliation/:hash')
+  @HttpCode(HttpStatus.NO_CONTENT)
+  @Auditable({
+    action: AuditAction.DownloadClientUpdate,
+    resource: AuditResource.DownloadClient,
+    getResourceId: (req) => Number(req.params.id),
+    description: (req) => `Removed an orphaned owned download from client #${req.params.id}`,
+  })
+  removeOrphan(@Param('id', ParseIntPipe) id: number, @Param('hash') hash: string, @Body() dto: RemoveOrphanedDownloadClientItemDto) {
+    return this.reconciliation.removeOrphan(id, hash, dto.deleteFiles ?? false);
+  }
+
+  @Post()
+  @Auditable({
+    action: AuditAction.DownloadClientCreate,
+    resource: AuditResource.DownloadClient,
+    getResourceId: (_req, res: unknown) => (res as { id?: number })?.id,
+    description: (_req, res: unknown) => `Created download client '${(res as { name?: string })?.name ?? 'unknown'}'`,
+  })
+  create(@Body() dto: CreateDownloadClientDto) {
+    return this.service.create(dto);
+  }
+
+  @Put(':id')
+  @Auditable({
+    action: AuditAction.DownloadClientUpdate,
+    resource: AuditResource.DownloadClient,
+    getResourceId: (req) => Number(req.params.id),
+    description: (req) => `Updated download client #${req.params.id}`,
+  })
+  update(@Param('id', ParseIntPipe) id: number, @Body() dto: UpdateDownloadClientDto) {
+    return this.service.update(id, dto);
+  }
+
+  @Delete(':id')
+  @HttpCode(HttpStatus.NO_CONTENT)
+  @Auditable({
+    action: AuditAction.DownloadClientDelete,
+    resource: AuditResource.DownloadClient,
+    getResourceId: (req) => Number(req.params.id),
+    description: (req) => `Deleted download client #${req.params.id}`,
+  })
+  remove(@Param('id', ParseIntPipe) id: number) {
+    return this.service.remove(id);
+  }
+
+  @Post(':id/test')
+  @HttpCode(HttpStatus.OK)
+  test(@Param('id', ParseIntPipe) id: number) {
+    return this.service.test(id);
+  }
+
+  /**
+   * Answers whether an import from this path can hardlink into the Book Dock or will have to
+   * copy. Read-only, and a "no" is a supported configuration rather than an error.
+   */
+  @Post(':id/test-path-mapping')
+  @HttpCode(HttpStatus.OK)
+  testPathMapping(@Param('id', ParseIntPipe) id: number, @Body() dto: TestPathMappingDto) {
+    return this.service.testHardlink(id, dto.mappingId);
+  }
+}
diff --git a/server/src/modules/book-request/download-clients/download-client.repository.test.ts b/server/src/modules/book-request/download-clients/download-client.repository.test.ts
new file mode 100644
index 000000000..44ba6be2a
--- /dev/null
+++ b/server/src/modules/book-request/download-clients/download-client.repository.test.ts
@@ -0,0 +1,118 @@
+import { createCapturingDb } from '../../../common/test-utils/capture-sql-db';
+import { DownloadClientRepository } from './download-client.repository';
+
+/**
+ * The compiled SQL rather than a hand-mocked `db`, because everything worth asserting here is what
+ * the dialect adds: the ordering that decides which client a grab lands on, the transaction that
+ * keeps a half-applied mapping edit from existing, and the `length()` ordering that lets the caller
+ * take the first prefix match instead of scanning them all.
+ */
+describe('DownloadClientRepository', () => {
+  it('orders every enabled client by priority, then by id so the pick is stable', async () => {
+    const { db, queries } = createCapturingDb();
+
+    await new DownloadClientRepository(db).findAllEnabled();
+
+    expect(queries).toHaveLength(1);
+    expect(queries[0].sql).toMatch(
+      /where "download_clients"\."enabled" = \$1 order by "download_clients"\."priority" asc, "download_clients"\."id" asc/,
+    );
+  });
+
+  it('narrows the grab default to clients that can carry out that kind of grab, and takes one', async () => {
+    const { db, queries } = createCapturingDb();
+
+    await new DownloadClientRepository(db).findPreferredEnabled(['qbittorrent', 'transmission']);
+
+    expect(queries).toHaveLength(1);
+    expect(queries[0].sql).toMatch(/"download_clients"\."adapter_type" in \(\$2, \$3\)/);
+    expect(queries[0].sql).toMatch(/order by "download_clients"\."priority" asc, "download_clients"\."id" asc limit \$4/);
+    expect(queries[0].params.slice(1)).toEqual(['qbittorrent', 'transmission', 1]);
+  });
+
+  /**
+   * An empty list is not "any client will do". Asking Postgres for `in ()` is either a syntax error
+   * or, worse, a filter that matches everything, and either way the answer to "which client can
+   * deliver this" is none of them.
+   */
+  it('asks nothing at all when no adapter type could deliver the grab', async () => {
+    const { db, queries } = createCapturingDb();
+
+    await expect(new DownloadClientRepository(db).findPreferredEnabled([])).resolves.toBeUndefined();
+
+    expect(queries).toHaveLength(0);
+  });
+
+  /**
+   * The `updated_at` column is not in the patch this method writes; the dialect adds it from the
+   * table's `$onUpdateFn`. Worth pinning, because a failing connection test therefore bumps the
+   * row's modification time, and the credential-rotation guard elsewhere compares against it.
+   */
+  it('records a test result against the row it tested, and the dialect bumps updated_at with it', async () => {
+    const { db, queries } = createCapturingDb();
+
+    await new DownloadClientRepository(db).recordTestResult(7, false, 'Connection refused');
+
+    expect(queries).toHaveLength(1);
+    expect(queries[0].sql).toMatch(
+      /update "download_clients" set "last_tested_at" = \$1, "last_test_ok" = \$2, "last_error_message" = \$3, "updated_at" = \$4 where "download_clients"\."id" = \$5/,
+    );
+    expect(queries[0].params[1]).toBe(false);
+    expect(queries[0].params[2]).toBe('Connection refused');
+    expect(queries[0].params[4]).toBe(7);
+  });
+
+  /**
+   * Wholesale replacement inside one transaction. Half an edit would leave a client translating
+   * some paths with the old set and some with the new, which is an import reading out of a
+   * directory nobody authorised.
+   */
+  it('replaces path mappings in one transaction', async () => {
+    const { db, queries } = createCapturingDb();
+
+    await new DownloadClientRepository(db).replacePathMappings(3, [
+      { remotePath: '/downloads', localPath: '/mnt/downloads' },
+      { remotePath: '/downloads/books', localPath: '/mnt/downloads/books' },
+    ]);
+
+    expect(queries.map((query) => query.sql)).toEqual([
+      'begin',
+      expect.stringMatching(/delete from "download_client_path_mappings" where "download_client_path_mappings"\."download_client_id" = \$1/),
+      expect.stringMatching(/insert into "download_client_path_mappings"/),
+      'commit',
+    ]);
+  });
+
+  /** Clearing every mapping is a real edit: the delete still runs, and there is nothing to insert. */
+  it('deletes without inserting when the client is left with no mappings', async () => {
+    const { db, queries } = createCapturingDb();
+
+    await new DownloadClientRepository(db).replacePathMappings(3, []);
+
+    expect(queries.map((query) => query.sql)).toEqual(['begin', expect.stringMatching(/delete from "download_client_path_mappings"/), 'commit']);
+  });
+
+  /**
+   * Longest prefix first, so the caller can take the first match. Without it `/downloads` would
+   * shadow `/downloads/books` and translate a path into the wrong local root.
+   */
+  it('returns path mappings longest prefix first', async () => {
+    const { db, queries } = createCapturingDb();
+
+    await new DownloadClientRepository(db).findPathMappings(3);
+
+    expect(queries).toHaveLength(1);
+    expect(queries[0].sql).toMatch(/order by length\("download_client_path_mappings"\."remote_path"\) desc/);
+  });
+
+  it('reads the mappings for a page of clients in one query rather than one per client', async () => {
+    const { db, queries } = createCapturingDb();
+
+    await new DownloadClientRepository(db).findAll();
+
+    // The client list, then the mappings for whatever came back. A stub answers with no rows, so
+    // the second query is skipped entirely rather than issued against an empty id list.
+    expect(queries).toHaveLength(1);
+    expect(queries[0].sql).toMatch(/^select .* from "download_clients" order by/);
+  });
+});
diff --git a/server/src/modules/book-request/download-clients/download-client.repository.ts b/server/src/modules/book-request/download-clients/download-client.repository.ts
new file mode 100644
index 000000000..dcafe5967
--- /dev/null
+++ b/server/src/modules/book-request/download-clients/download-client.repository.ts
@@ -0,0 +1,141 @@
+import { Inject, Injectable } from '@nestjs/common';
+import { and, asc, eq, inArray, sql } from 'drizzle-orm';
+import { NodePgDatabase } from 'drizzle-orm/node-postgres';
+import type { DownloadClientType } from '@bookorbit/types';
+
+import { DB } from '../../../db';
+import * as schema from '../../../db/schema';
+import {
+  downloadClientPathMappings,
+  downloadClients,
+  type DownloadClientPathMappingRow,
+  type DownloadClientRow,
+  type NewDownloadClientRow,
+} from '../../../db/schema';
+
+type Db = NodePgDatabase<typeof schema>;
+
+export interface DownloadClientWithMappings {
+  client: DownloadClientRow;
+  pathMappings: DownloadClientPathMappingRow[];
+}
+
+@Injectable()
+export class DownloadClientRepository {
+  constructor(@Inject(DB) private readonly db: Db) {}
+
+  async findAll(): Promise<DownloadClientWithMappings[]> {
+    const clients = await this.db.select().from(downloadClients).orderBy(asc(downloadClients.priority), asc(downloadClients.id));
+    return this.attachMappings(clients);
+  }
+
+  async findById(id: number): Promise<DownloadClientWithMappings | undefined> {
+    const [client] = await this.db.select().from(downloadClients).where(eq(downloadClients.id, id)).limit(1);
+    if (!client) return undefined;
+    const [withMappings] = await this.attachMappings([client]);
+    return withMappings;
+  }
+
+  /** Every enabled client in pick order, for the approver-facing summary list. */
+  async findAllEnabled(): Promise<DownloadClientRow[]> {
+    return this.db
+      .select()
+      .from(downloadClients)
+      .where(eq(downloadClients.enabled, true))
+      .orderBy(asc(downloadClients.priority), asc(downloadClients.id));
+  }
+
+  /**
+   * The grab path's default when the approver does not name a client. Narrowed by adapter type,
+   * because a client that cannot carry out this kind of grab is not a candidate at any priority.
+   */
+  async findPreferredEnabled(adapterTypes: readonly DownloadClientType[]): Promise<DownloadClientRow | undefined> {
+    if (adapterTypes.length === 0) return undefined;
+    const [row] = await this.db
+      .select()
+      .from(downloadClients)
+      .where(and(eq(downloadClients.enabled, true), inArray(downloadClients.adapterType, [...adapterTypes])))
+      .orderBy(asc(downloadClients.priority), asc(downloadClients.id))
+      .limit(1);
+    return row;
+  }
+
+  /**
+   * The client and the mappings it may import from, written together.
+   *
+   * Separately, a mapping insert that fails leaves a saved client with no mapping at all, which
+   * every import then refuses; the operator sees a client that exists, looks configured, and
+   * cannot be re-created because the name is already taken.
+   */
+  async createWithPathMappings(data: NewDownloadClientRow, mappings: Array<{ remotePath: string; localPath: string }>): Promise<DownloadClientRow> {
+    return this.db.transaction(async (tx) => {
+      const [row] = await tx.insert(downloadClients).values(data).returning();
+      if (mappings.length > 0) {
+        await tx.insert(downloadClientPathMappings).values(mappings.map((mapping) => ({ ...mapping, downloadClientId: row.id })));
+      }
+      return row;
+    });
+  }
+
+  async update(id: number, data: Partial<NewDownloadClientRow>): Promise<DownloadClientRow | undefined> {
+    const [row] = await this.db.update(downloadClients).set(data).where(eq(downloadClients.id, id)).returning();
+    return row;
+  }
+
+  async delete(id: number): Promise<void> {
+    await this.db.delete(downloadClients).where(eq(downloadClients.id, id));
+  }
+
+  async recordTestResult(id: number, ok: boolean, errorMessage: string | null): Promise<void> {
+    await this.db
+      .update(downloadClients)
+      .set({ lastTestedAt: new Date(), lastTestOk: ok, lastErrorMessage: errorMessage })
+      .where(eq(downloadClients.id, id));
+  }
+
+  /**
+   * Mappings are replaced wholesale inside one transaction, so a half-applied edit can never
+   * leave a client translating some paths with the old set and some with the new.
+   */
+  async replacePathMappings(clientId: number, mappings: Array<{ remotePath: string; localPath: string }>): Promise<void> {
+    await this.db.transaction(async (tx) => {
+      await tx.delete(downloadClientPathMappings).where(eq(downloadClientPathMappings.downloadClientId, clientId));
+      if (mappings.length === 0) return;
+      await tx.insert(downloadClientPathMappings).values(mappings.map((mapping) => ({ ...mapping, downloadClientId: clientId })));
+    });
+  }
+
+  async findPathMappings(clientId: number): Promise<DownloadClientPathMappingRow[]> {
+    return (
+      this.db
+        .select()
+        .from(downloadClientPathMappings)
+        .where(eq(downloadClientPathMappings.downloadClientId, clientId))
+        // Longest prefix first, so the caller can take the first match rather than scanning.
+        .orderBy(sql`length(${downloadClientPathMappings.remotePath}) desc`)
+    );
+  }
+
+  private async attachMappings(clients: DownloadClientRow[]): Promise<DownloadClientWithMappings[]> {
+    if (clients.length === 0) return [];
+    const rows = await this.db
+      .select()
+      .from(downloadClientPathMappings)
+      .where(
+        inArray(
+          downloadClientPathMappings.downloadClientId,
+          clients.map((client) => client.id),
+        ),
+      )
+      .orderBy(asc(downloadClientPathMappings.id));
+
+    const byClient = new Map<number, DownloadClientPathMappingRow[]>();
+    for (const row of rows) {
+      const bucket = byClient.get(row.downloadClientId) ?? [];
+      bucket.push(row);
+      byClient.set(row.downloadClientId, bucket);
+    }
+
+    return clients.map((client) => ({ client, pathMappings: byClient.get(client.id) ?? [] }));
+  }
+}
diff --git a/server/src/modules/book-request/download-clients/dto/download-client.dto.test.ts b/server/src/modules/book-request/download-clients/dto/download-client.dto.test.ts
new file mode 100644
index 000000000..637ff93a2
--- /dev/null
+++ b/server/src/modules/book-request/download-clients/dto/download-client.dto.test.ts
@@ -0,0 +1,25 @@
+import 'reflect-metadata';
+
+import { plainToInstance } from 'class-transformer';
+import { validate } from 'class-validator';
+
+import { TestPathMappingDto } from './download-client.dto';
+
+const validationOptions = { whitelist: true, forbidNonWhitelisted: true } as const;
+
+describe('TestPathMappingDto', () => {
+  it('accepts and transforms a positive mapping id', async () => {
+    const dto = plainToInstance(TestPathMappingDto, { mappingId: '7' });
+
+    expect(dto.mappingId).toBe(7);
+    await expect(validate(dto, validationOptions)).resolves.toEqual([]);
+  });
+
+  it.each([{ mappingId: 0 }, { mappingId: 1.5 }, { mappingId: 'not-a-number' }, { localPath: '/path/to/library' }])(
+    'rejects an invalid or legacy payload: %o',
+    async (payload) => {
+      const dto = plainToInstance(TestPathMappingDto, payload);
+      expect(await validate(dto, validationOptions)).not.toEqual([]);
+    },
+  );
+});
diff --git a/server/src/modules/book-request/download-clients/dto/download-client.dto.ts b/server/src/modules/book-request/download-clients/dto/download-client.dto.ts
new file mode 100644
index 000000000..005de205a
--- /dev/null
+++ b/server/src/modules/book-request/download-clients/dto/download-client.dto.ts
@@ -0,0 +1,172 @@
+import { Type } from 'class-transformer';
+import {
+  ArrayMaxSize,
+  IsArray,
+  IsBoolean,
+  IsIn,
+  IsInt,
+  IsOptional,
+  IsString,
+  Matches,
+  MaxLength,
+  Min,
+  Max,
+  MinLength,
+  ValidateNested,
+} from 'class-validator';
+import { DOWNLOAD_CLIENT_TYPES, INDEXER_COLORS } from '@bookorbit/types';
+import type { DownloadClientType, IndexerColor } from '@bookorbit/types';
+
+export class DownloadClientPathMappingDto {
+  @IsString()
+  @MinLength(1)
+  @MaxLength(4096)
+  remotePath!: string;
+
+  @IsString()
+  @MinLength(1)
+  @MaxLength(4096)
+  localPath!: string;
+}
+
+export class CreateDownloadClientDto {
+  @IsString()
+  @MinLength(1)
+  @MaxLength(100)
+  name!: string;
+
+  @IsOptional()
+  @IsIn(INDEXER_COLORS)
+  color?: IndexerColor | null;
+
+  @IsIn(DOWNLOAD_CLIENT_TYPES)
+  adapterType!: DownloadClientType;
+
+  @IsString()
+  @MaxLength(2048)
+  baseUrl!: string;
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(255)
+  username?: string;
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(1024)
+  password?: string;
+
+  @IsOptional()
+  @IsBoolean()
+  enabled?: boolean;
+
+  @IsOptional()
+  @Type(() => Number)
+  @IsInt()
+  @Min(1)
+  @Max(100)
+  priority?: number;
+
+  /** Isolates our torrents in the client, so BookOrbit only ever acts on rows it created. */
+  @IsOptional()
+  @IsString()
+  @MaxLength(100)
+  @Matches(/^[\w .-]*$/, { message: 'category may only contain letters, numbers, spaces, dots, dashes and underscores' })
+  category?: string;
+
+  @IsOptional()
+  @IsBoolean()
+  useHardlinks?: boolean;
+
+  @IsOptional()
+  @IsBoolean()
+  allowPrivateAddress?: boolean;
+
+  @IsOptional()
+  @IsArray()
+  @ArrayMaxSize(20)
+  @ValidateNested({ each: true })
+  @Type(() => DownloadClientPathMappingDto)
+  pathMappings?: DownloadClientPathMappingDto[];
+}
+
+/**
+ * Spelled out rather than derived from the create DTO: `whitelist` plus `forbidNonWhitelisted`
+ * means the accepted field list has to be exact, and an inherited-then-loosened field is easy to
+ * get subtly wrong.
+ */
+export class UpdateDownloadClientDto {
+  @IsOptional()
+  @IsString()
+  @MinLength(1)
+  @MaxLength(100)
+  name?: string;
+
+  @IsOptional()
+  @IsIn(INDEXER_COLORS)
+  color?: IndexerColor | null;
+
+  @IsOptional()
+  @IsIn(DOWNLOAD_CLIENT_TYPES)
+  adapterType?: DownloadClientType;
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(2048)
+  baseUrl?: string;
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(255)
+  username?: string;
+
+  /** An omitted password keeps the stored one; an empty string clears it. */
+  @IsOptional()
+  @IsString()
+  @MaxLength(1024)
+  password?: string;
+
+  @IsOptional()
+  @IsBoolean()
+  enabled?: boolean;
+
+  @IsOptional()
+  @Type(() => Number)
+  @IsInt()
+  @Min(1)
+  @Max(100)
+  priority?: number;
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(100)
+  @Matches(/^[\w .-]*$/, { message: 'category may only contain letters, numbers, spaces, dots, dashes and underscores' })
+  category?: string;
+
+  @IsOptional()
+  @IsBoolean()
+  useHardlinks?: boolean;
+
+  @IsOptional()
+  @IsBoolean()
+  allowPrivateAddress?: boolean;
+
+  @IsOptional()
+  @IsArray()
+  @ArrayMaxSize(20)
+  @ValidateNested({ each: true })
+  @Type(() => DownloadClientPathMappingDto)
+  pathMappings?: DownloadClientPathMappingDto[];
+}
+
+/**
+ * A stored mapping rather than a path the caller names. The probe writes, links and unlinks at the
+ * directory it is given, so accepting an arbitrary path made this an arbitrary-directory write and
+ * existence oracle; the id can only ever select a directory an operator already configured.
+ */
+export class TestPathMappingDto {
+  @Type(() => Number)
+  @IsInt()
+  @Min(1)
+  mappingId!: number;
+}
diff --git a/server/src/modules/book-request/download-clients/dto/reconcile-download-client.dto.ts b/server/src/modules/book-request/download-clients/dto/reconcile-download-client.dto.ts
new file mode 100644
index 000000000..dccffc5a4
--- /dev/null
+++ b/server/src/modules/book-request/download-clients/dto/reconcile-download-client.dto.ts
@@ -0,0 +1,13 @@
+import { IsBoolean, IsInt, IsOptional, Min } from 'class-validator';
+
+export class AdoptDownloadClientItemDto {
+  @IsInt()
+  @Min(1)
+  downloadId!: number;
+}
+
+export class RemoveOrphanedDownloadClientItemDto {
+  @IsOptional()
+  @IsBoolean()
+  deleteFiles?: boolean;
+}
diff --git a/server/src/modules/book-request/download-clients/path-mapping.service.test.ts b/server/src/modules/book-request/download-clients/path-mapping.service.test.ts
new file mode 100644
index 000000000..b343ecdb7
--- /dev/null
+++ b/server/src/modules/book-request/download-clients/path-mapping.service.test.ts
@@ -0,0 +1,177 @@
+import { BadRequestException } from '@nestjs/common';
+import { chmod, mkdtemp, mkdir, readdir, symlink, writeFile } from 'fs/promises';
+import { realpath } from 'fs/promises';
+import { tmpdir } from 'os';
+import { join } from 'path';
+
+import { PathMappingService } from './path-mapping.service';
+
+function makeService(mappings: Array<{ remotePath: string; localPath: string }>) {
+  const repo = {
+    // The repository sorts longest-prefix-first; mirror that here so the service under test sees
+    // the same ordering it does in production.
+    findPathMappings: vi.fn().mockResolvedValue([...mappings].sort((a, b) => b.remotePath.length - a.remotePath.length)),
+  };
+  return { service: new PathMappingService(repo as never), repo };
+}
+
+describe('PathMappingService.toLocalPath', () => {
+  it('translates a path under the mapped prefix', async () => {
+    const { service } = makeService([{ remotePath: '/downloads', localPath: '/data/torrents' }]);
+    await expect(service.toLocalPath(1, '/downloads/books/dune.epub')).resolves.toMatchObject({
+      localPath: '/data/torrents/books/dune.epub',
+      containmentRoot: '/data/torrents',
+    });
+  });
+
+  it('translates the prefix itself', async () => {
+    const { service } = makeService([{ remotePath: '/downloads', localPath: '/data/torrents' }]);
+    await expect(service.toLocalPath(1, '/downloads')).resolves.toMatchObject({ localPath: '/data/torrents' });
+  });
+
+  it('prefers the longest matching prefix', async () => {
+    const { service } = makeService([
+      { remotePath: '/downloads', localPath: '/data/all' },
+      { remotePath: '/downloads/books', localPath: '/data/books' },
+    ]);
+    await expect(service.toLocalPath(1, '/downloads/books/dune.epub')).resolves.toMatchObject({ localPath: '/data/books/dune.epub' });
+  });
+
+  it('matches on segment boundaries, so a sibling directory is not swallowed', async () => {
+    const { service } = makeService([{ remotePath: '/downloads/complete', localPath: '/data/complete' }]);
+    await expect(service.toLocalPath(1, '/downloads/completed-books/dune.epub')).rejects.toThrow(BadRequestException);
+  });
+
+  it('normalizes the backslashes a Windows client reports', async () => {
+    const remotePath = ['D:', 'torrents'].join('\\');
+    const reportedPath = [remotePath, 'books', 'dune.epub'].join('\\');
+    const { service } = makeService([{ remotePath, localPath: '/data/torrents' }]);
+    await expect(service.toLocalPath(1, reportedPath)).resolves.toMatchObject({
+      localPath: '/data/torrents/books/dune.epub',
+    });
+  });
+
+  it('rejects traversal out of the mapped local path', async () => {
+    const { service } = makeService([{ remotePath: '/downloads', localPath: '/data/torrents' }]);
+    await expect(service.toLocalPath(1, '/downloads/../../etc/passwd')).rejects.toThrow(BadRequestException);
+  });
+
+  it('rejects a reported path no mapping covers', async () => {
+    const { service } = makeService([{ remotePath: '/downloads', localPath: '/data/torrents' }]);
+    await expect(service.toLocalPath(1, '/elsewhere/dune.epub')).rejects.toThrow(BadRequestException);
+  });
+
+  it('rejects an empty content path', async () => {
+    const { service } = makeService([{ remotePath: '/downloads', localPath: '/data/torrents' }]);
+    await expect(service.toLocalPath(1, '   ')).rejects.toThrow(BadRequestException);
+  });
+
+  /**
+   * Without a mapping there is no operator-declared directory to hold the reported path to, so a
+   * client that reported `/etc` would have had `/etc` scanned and hardlinked out of.
+   */
+  it('refuses a client with no mapping rather than trusting whatever it reported', async () => {
+    const { service } = makeService([]);
+    await expect(service.toLocalPath(1, '/downloads/dune.epub')).rejects.toThrow(BadRequestException);
+    await expect(service.toLocalPath(1, '/etc/shadow')).rejects.toThrow(BadRequestException);
+  });
+
+  /** The single-host case is an identity mapping, not an absent one, and still imports. */
+  it('translates through an identity mapping and roots containment at it', async () => {
+    const { service } = makeService([{ remotePath: '/downloads', localPath: '/downloads' }]);
+    await expect(service.toLocalPath(1, '/downloads/dune.epub')).resolves.toEqual({
+      localPath: '/downloads/dune.epub',
+      containmentRoot: '/downloads',
+    });
+  });
+
+  it('rejects a symlink inside the download directory that points out of it', async () => {
+    const root = await realpath(await mkdtemp(join(tmpdir(), 'bookorbit-mapping-')));
+    const inside = join(root, 'downloads');
+    const outside = join(root, 'secrets');
+    await mkdir(inside, { recursive: true });
+    await mkdir(outside, { recursive: true });
+    await writeFile(join(outside, 'passwd'), 'x');
+    await symlink(outside, join(inside, 'escape'));
+
+    const { service } = makeService([{ remotePath: '/remote', localPath: inside }]);
+    await expect(service.toLocalPath(1, '/remote/escape/passwd')).rejects.toThrow(BadRequestException);
+  });
+});
+
+describe('PathMappingService.assertWithinRoot', () => {
+  it('accepts a path under the root', async () => {
+    const { service } = makeService([]);
+    await expect(service.assertWithinRoot('/data/torrents', '/data/torrents/books/dune.epub')).resolves.toBeUndefined();
+  });
+
+  it('rejects a path outside the root', async () => {
+    const { service } = makeService([]);
+    await expect(service.assertWithinRoot('/data/torrents', '/etc/shadow')).rejects.toThrow(BadRequestException);
+  });
+
+  /** The release named this file, not the operator, so the symlink is followed before it is used. */
+  it('rejects a symlink inside the root that points out of it', async () => {
+    const root = await realpath(await mkdtemp(join(tmpdir(), 'bookorbit-contain-')));
+    const inside = join(root, 'downloads');
+    const outside = join(root, 'secrets');
+    await mkdir(inside, { recursive: true });
+    await mkdir(outside, { recursive: true });
+    await writeFile(join(outside, 'passwd'), 'x');
+    await symlink(join(outside, 'passwd'), join(inside, 'dune.epub'));
+
+    const { service } = makeService([]);
+    await expect(service.assertWithinRoot(inside, join(inside, 'dune.epub'))).rejects.toThrow(BadRequestException);
+  });
+});
+
+describe('PathMappingService.testHardlink', () => {
+  async function twoDirs() {
+    const root = await mkdtemp(join(tmpdir(), 'bookorbit-hardlink-'));
+    const a = join(root, 'a');
+    const b = join(root, 'b');
+    await mkdir(a);
+    await mkdir(b);
+    return { root, a, b };
+  }
+
+  it('reports a working hardlink for two directories on one filesystem', async () => {
+    const { a, b } = await twoDirs();
+
+    const { service } = makeService([]);
+    await expect(service.testHardlink(a, b)).resolves.toEqual({ localPathExists: true, bookDockPathExists: true, hardlinkWorks: true });
+  });
+
+  it('leaves nothing behind on either side', async () => {
+    const { a, b } = await twoDirs();
+
+    const { service } = makeService([]);
+    await service.testHardlink(a, b);
+
+    await expect(readdir(a)).resolves.toEqual([]);
+    await expect(readdir(b)).resolves.toEqual([]);
+  });
+
+  it('reports a missing local path rather than throwing', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'bookorbit-hardlink-'));
+    const { service } = makeService([]);
+    await expect(service.testHardlink(join(root, 'nope'), root)).resolves.toMatchObject({ localPathExists: false, hardlinkWorks: false });
+  });
+
+  it('separates a download directory it cannot write to from a refused link', async () => {
+    if (process.getuid?.() === 0) return; // skip when running as root
+    const { a, b } = await twoDirs();
+    await chmod(a, 0o500);
+
+    try {
+      const { service } = makeService([]);
+      const result = await service.testHardlink(a, b);
+
+      expect(result.hardlinkWorks).toBe(false);
+      expect(result.failure).toBe('download_dir_unwritable');
+      expect(result.errorCode).toBe('EACCES');
+    } finally {
+      await chmod(a, 0o700);
+    }
+  });
+});
diff --git a/server/src/modules/book-request/download-clients/path-mapping.service.ts b/server/src/modules/book-request/download-clients/path-mapping.service.ts
new file mode 100644
index 000000000..de3101c4c
--- /dev/null
+++ b/server/src/modules/book-request/download-clients/path-mapping.service.ts
@@ -0,0 +1,209 @@
+import { BadRequestException, Injectable } from '@nestjs/common';
+import { randomBytes } from 'crypto';
+import { link, realpath, stat, unlink, writeFile } from 'fs/promises';
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'path';
+
+import type { PathMappingHardlinkTestResult } from '@bookorbit/types';
+
+import { DownloadClientRepository } from './download-client.repository';
+
+const MAX_PATH_LENGTH = 4096;
+
+/**
+ * The one instruction that fixes a client with no mapping, said the same way at grab time and at
+ * import time because either can be the first to notice the absence.
+ */
+export const ADD_PATH_MAPPING_HINT =
+  'Add one under Settings > System > Requests; if the client and BookOrbit see the same filesystem, map the download directory to itself.';
+
+export interface ResolvedDownloadPath {
+  localPath: string;
+  /** The mapping that produced it, and therefore the root the path must stay inside. */
+  containmentRoot: string;
+}
+
+/**
+ * Translates what a download client reports into something BookOrbit can open.
+ *
+ * Containment is rooted at the matched mapping's own `localPath`, not at `LIBRARY_BROWSE_ROOT`.
+ * `PathPolicyService` guards the latter, which defaults to `/` and would therefore accept every
+ * path on the host; a download directory is also not the library browse root semantically. The
+ * symlink-aware walk below is that service's technique with the root swapped.
+ */
+@Injectable()
+export class PathMappingService {
+  constructor(private readonly repo: DownloadClientRepository) {}
+
+  /**
+   * Every client must declare at least one mapping, the single-host case included: qBittorrent and
+   * BookOrbit seeing the same filesystem makes the translation an identity, not an absence, and
+   * `/downloads -> /downloads` still says which directory the import may read out of. Accepting
+   * whatever an unmapped client reported left a compromised or misconfigured one able to point the
+   * importer at any readable path on the host.
+   */
+  async toLocalPath(clientId: number, remotePath: string): Promise<ResolvedDownloadPath> {
+    const reported = remotePath?.trim() ?? '';
+    if (!reported) throw new BadRequestException('The download client did not report a content path');
+    if (reported.length > MAX_PATH_LENGTH) throw new BadRequestException('The download client reported a path that is too long');
+
+    const mappings = await this.repo.findPathMappings(clientId);
+    if (mappings.length === 0) {
+      throw new BadRequestException(
+        `This download client has no path mapping, so there is no directory BookOrbit may import from. ${ADD_PATH_MAPPING_HINT}`,
+      );
+    }
+
+    for (const mapping of mappings) {
+      const remainder = prefixRemainder(reported, mapping.remotePath);
+      if (remainder === null) continue;
+
+      const root = resolve(mapping.localPath);
+      const candidate = remainder ? resolve(join(root, remainder)) : root;
+      if (!(await isWithin(root, candidate))) {
+        throw new BadRequestException('The mapped download path resolves outside its configured local path');
+      }
+      return { localPath: candidate, containmentRoot: root };
+    }
+
+    throw new BadRequestException(`No path mapping covers "${reported}". Add one under the download client's settings.`);
+  }
+
+  /**
+   * Re-checks a path the release plan produced against the root the download was resolved inside,
+   * immediately before it is opened or linked. `toLocalPath` answers for the directory the client
+   * named; everything under it was named by the release, whose contents nobody vouched for.
+   */
+  async assertWithinRoot(containmentRoot: string, candidate: string): Promise<void> {
+    if (await isWithin(containmentRoot, candidate)) return;
+    throw new BadRequestException('The download points at a file outside the directory it was downloaded into');
+  }
+
+  /**
+   * Whether a hardlink from this local path into the Book Dock actually works.
+   *
+   * Device ids cannot answer this. Two bind mounts of one filesystem report the same `st_dev`
+   * while `link(2)` still returns EXDEV, which is the ordinary Docker and Kubernetes layout, so
+   * comparing them promises a hardlink that the import then cannot make. The only honest test is
+   * to make one, so a throwaway file is linked across and both ends are removed again.
+   *
+   * A link that cannot be attempted is reported apart from one that was refused: an unwritable
+   * download directory is a different thing to fix than a filesystem boundary.
+   */
+  async testHardlink(localPath: string, bookDockPath: string): Promise<PathMappingHardlinkTestResult> {
+    const [localPathExists, bookDockPathExists] = await Promise.all([pathExists(localPath), pathExists(bookDockPath)]);
+    if (!localPathExists || !bookDockPathExists) {
+      return { localPathExists, bookDockPathExists, hardlinkWorks: false };
+    }
+
+    const probeName = `.bookorbit-hardlink-probe-${randomBytes(8).toString('hex')}`;
+    const source = join(localPath, probeName);
+    const target = join(bookDockPath, probeName);
+
+    try {
+      await writeFile(source, '', { flag: 'wx' });
+    } catch (error) {
+      return {
+        localPathExists: true,
+        bookDockPathExists: true,
+        hardlinkWorks: false,
+        failure: 'download_dir_unwritable',
+        errorCode: errorCode(error),
+      };
+    }
+
+    try {
+      await link(source, target);
+      await discard(target);
+      return { localPathExists: true, bookDockPathExists: true, hardlinkWorks: true };
+    } catch (error) {
+      return {
+        localPathExists: true,
+        bookDockPathExists: true,
+        hardlinkWorks: false,
+        failure: 'link_refused',
+        errorCode: errorCode(error),
+      };
+    } finally {
+      await discard(source);
+    }
+  }
+}
+
+/**
+ * Prefix matching on segment boundaries: `/downloads/complete` must not match `/downloads/completed-books`.
+ * Returns the remainder after the prefix, `''` for an exact match, or null when it does not match.
+ */
+function prefixRemainder(reported: string, remotePrefix: string): string | null {
+  const normalizedReported = normalizeSeparators(reported);
+  const normalizedPrefix = trimTrailingSeparator(normalizeSeparators(remotePrefix));
+  if (!normalizedPrefix) return null;
+
+  if (normalizedReported === normalizedPrefix) return '';
+  if (!normalizedReported.startsWith(normalizedPrefix)) return null;
+  const next = normalizedReported.charAt(normalizedPrefix.length);
+  if (next !== '/') return null;
+  return normalizedReported.slice(normalizedPrefix.length + 1);
+}
+
+/** Windows clients report backslashes; the mapping's local side is always POSIX. */
+function normalizeSeparators(value: string): string {
+  return value.replace(/\\/g, '/');
+}
+
+function trimTrailingSeparator(value: string): string {
+  return value.length > 1 ? value.replace(/\/+$/, '') : value;
+}
+
+/**
+ * Lexical check first, then `realpath` up the existing-ancestor chain, so a symlink planted
+ * inside the download directory cannot point the import at something outside it.
+ */
+async function isWithin(root: string, candidate: string): Promise<boolean> {
+  if (isEscaping(relative(root, candidate))) return false;
+
+  const [canonicalRoot, canonicalCandidate] = await Promise.all([canonicalize(root), canonicalize(candidate)]);
+  return !isEscaping(relative(canonicalRoot, canonicalCandidate));
+}
+
+function isEscaping(relativePath: string): boolean {
+  return relativePath === '..' || relativePath.startsWith(`..${sep}`) || isAbsolute(relativePath);
+}
+
+async function canonicalize(target: string): Promise<string> {
+  const suffixSegments: string[] = [];
+  let current = resolve(target);
+
+  while (true) {
+    try {
+      const canonical = await realpath(current);
+      return suffixSegments.reduceRight((built, segment) => join(built, segment), canonical);
+    } catch (error) {
+      const code = (error as NodeJS.ErrnoException).code;
+      if (code !== 'ENOENT' && code !== 'ENOTDIR') return resolve(target);
+    }
+
+    const parent = dirname(current);
+    if (parent === current) return resolve(target);
+    suffixSegments.push(basename(current));
+    current = parent;
+  }
+}
+
+/** Best effort, because a probe left behind is worse than a cleanup failure nobody sees. */
+async function discard(target: string): Promise<void> {
+  await unlink(target).catch(() => undefined);
+}
+
+function errorCode(error: unknown): string {
+  const code = (error as { code?: unknown })?.code;
+  return typeof code === 'string' ? code : 'unknown error';
+}
+
+async function pathExists(target: string): Promise<boolean> {
+  try {
+    await stat(target);
+    return true;
+  } catch {
+    return false;
+  }
+}
diff --git a/server/src/modules/book-request/dto/automation-settings.dto.ts b/server/src/modules/book-request/dto/automation-settings.dto.ts
new file mode 100644
index 000000000..288a4d7ae
--- /dev/null
+++ b/server/src/modules/book-request/dto/automation-settings.dto.ts
@@ -0,0 +1,244 @@
+import { Type } from 'class-transformer';
+import {
+  ArrayMaxSize,
+  IsArray,
+  IsBoolean,
+  IsIn,
+  IsInt,
+  IsNotEmpty,
+  IsOptional,
+  IsString,
+  Max,
+  MaxLength,
+  Min,
+  ValidateNested,
+} from 'class-validator';
+import {
+  BOOK_REQUEST_IMPORT_FORMATS,
+  MAX_AUTO_GRAB_ATTEMPTS_LIMIT,
+  MAX_AUTO_SEARCH_INTERVAL_HOURS,
+  MAX_AUTO_SEARCH_MAX_AGE_DAYS,
+  MAX_RELEASE_TIER_NAME_LENGTH,
+  MAX_RELEASE_TIERS,
+  MIN_AUTO_GRAB_SCORE_FLOOR,
+  MIN_AUTO_SEARCH_INTERVAL_HOURS,
+  MIN_AUTO_SEARCH_MAX_AGE_DAYS,
+} from '@bookorbit/types';
+import type { BookRequestImportFormats, ReleaseFileLayout } from '@bookorbit/types';
+
+/**
+ * Null clears the default for that medium, which is not the same as omitting it: an omitted
+ * medium keeps whatever is stored, so one row can be changed without resending the other two.
+ */
+class RequestDestinationDto {
+  @IsOptional()
+  @Type(() => Number)
+  @IsInt()
+  @Min(1)
+  libraryId!: number | null;
+
+  /** Left null to mean "the library's first folder", which the service resolves and stores. */
+  @IsOptional()
+  @Type(() => Number)
+  @IsInt()
+  @Min(1)
+  folderId!: number | null;
+}
+
+/**
+ * Spelled out per medium rather than typed as a record: `whitelist` with `forbidNonWhitelisted`
+ * needs an exact field list, and a record would take any key at all.
+ */
+class RequestDestinationDefaultsDto {
+  @IsOptional()
+  @ValidateNested()
+  @Type(() => RequestDestinationDto)
+  ebook?: RequestDestinationDto;
+
+  @IsOptional()
+  @ValidateNested()
+  @Type(() => RequestDestinationDto)
+  audiobook?: RequestDestinationDto;
+
+  @IsOptional()
+  @ValidateNested()
+  @Type(() => RequestDestinationDto)
+  comic?: RequestDestinationDto;
+}
+
+/**
+ * One tier's conditions. Every field is optional, and an omitted one constrains nothing, so an
+ * empty object is a tier that matches everything - which is exactly what a catch-all bottom tier
+ * is for.
+ */
+class ReleaseTierConditionsDto {
+  @IsOptional()
+  @IsArray()
+  @IsString({ each: true })
+  formats?: string[];
+
+  @IsOptional()
+  @IsIn(['single', 'multi'])
+  fileLayout?: ReleaseFileLayout;
+
+  @IsOptional()
+  @Type(() => Number)
+  @IsInt()
+  @Min(0)
+  minBitrateKbps?: number;
+
+  @IsOptional()
+  @Type(() => Number)
+  @IsInt()
+  @Min(1)
+  channels?: number;
+
+  @IsOptional()
+  @IsArray()
+  @IsString({ each: true })
+  languages?: string[];
+
+  @IsOptional()
+  @IsArray()
+  @IsInt({ each: true })
+  indexerIds?: number[];
+
+  @IsOptional()
+  @Type(() => Number)
+  @IsInt()
+  @Min(0)
+  minSeeders?: number;
+
+  @IsOptional()
+  @Type(() => Number)
+  @IsInt()
+  @Min(1)
+  maxSizeBytes?: number;
+
+  @IsOptional()
+  @IsBoolean()
+  freeleechOnly?: boolean;
+
+  @IsOptional()
+  @IsBoolean()
+  excludeVipOnly?: boolean;
+}
+
+class ReleaseTierDto {
+  /** Stable across reorders. The service refuses a duplicate, which a reorder cannot answer for. */
+  @IsString()
+  @IsNotEmpty()
+  @MaxLength(64)
+  id!: string;
+
+  @IsString()
+  @IsNotEmpty()
+  @MaxLength(MAX_RELEASE_TIER_NAME_LENGTH)
+  name!: string;
+
+  /**
+   * Defaulted rather than optional: a tier that states no conditions matches everything, which is
+   * a legitimate catch-all bottom tier, and the initializer lets a caller omit the key entirely
+   * without the field becoming undefined downstream.
+   */
+  @IsOptional()
+  @ValidateNested()
+  @Type(() => ReleaseTierConditionsDto)
+  conditions: ReleaseTierConditionsDto = {};
+}
+
+/** Spelled out per medium for the same reason the destinations are: a record would take any key. */
+class ReleaseProfilesDto {
+  @IsOptional()
+  @IsArray()
+  @ArrayMaxSize(MAX_RELEASE_TIERS)
+  @ValidateNested({ each: true })
+  @Type(() => ReleaseTierDto)
+  ebook?: ReleaseTierDto[];
+
+  @IsOptional()
+  @IsArray()
+  @ArrayMaxSize(MAX_RELEASE_TIERS)
+  @ValidateNested({ each: true })
+  @Type(() => ReleaseTierDto)
+  audiobook?: ReleaseTierDto[];
+
+  @IsOptional()
+  @IsArray()
+  @ArrayMaxSize(MAX_RELEASE_TIERS)
+  @ValidateNested({ each: true })
+  @Type(() => ReleaseTierDto)
+  comic?: ReleaseTierDto[];
+}
+
+/**
+ * Every field is optional so one knob can be moved without resending the rest. The service
+ * validates the same bounds again, because a value can also arrive from a hand-edited settings
+ * row that never passed through this pipe.
+ */
+export class UpdateAutomationSettingsDto {
+  @IsOptional()
+  @IsBoolean()
+  autoGrabEnabled?: boolean;
+
+  @IsOptional()
+  @Type(() => Number)
+  @IsInt()
+  @Min(MIN_AUTO_GRAB_SCORE_FLOOR)
+  @Max(100)
+  autoGrabMinScore?: number;
+
+  @IsOptional()
+  @IsBoolean()
+  autoRetryEnabled?: boolean;
+
+  @IsOptional()
+  @Type(() => Number)
+  @IsInt()
+  @Min(1)
+  @Max(MAX_AUTO_GRAB_ATTEMPTS_LIMIT)
+  maxAutoGrabAttempts?: number;
+
+  @IsOptional()
+  @IsBoolean()
+  autoSearchEnabled?: boolean;
+
+  @IsOptional()
+  @Type(() => Number)
+  @IsInt()
+  @Min(MIN_AUTO_SEARCH_INTERVAL_HOURS)
+  @Max(MAX_AUTO_SEARCH_INTERVAL_HOURS)
+  autoSearchIntervalHours?: number;
+
+  @IsOptional()
+  @Type(() => Number)
+  @IsInt()
+  @Min(MIN_AUTO_SEARCH_MAX_AGE_DAYS)
+  @Max(MAX_AUTO_SEARCH_MAX_AGE_DAYS)
+  autoSearchMaxAgeDays?: number;
+
+  @IsOptional()
+  @IsBoolean()
+  verificationEnabled?: boolean;
+
+  @IsOptional()
+  @Type(() => Number)
+  @IsInt()
+  @Min(0)
+  @Max(100)
+  verificationThreshold?: number;
+
+  @IsOptional()
+  @IsIn(BOOK_REQUEST_IMPORT_FORMATS)
+  importFormats?: BookRequestImportFormats;
+
+  @IsOptional()
+  @ValidateNested()
+  @Type(() => RequestDestinationDefaultsDto)
+  destinations?: RequestDestinationDefaultsDto;
+
+  @IsOptional()
+  @ValidateNested()
+  @Type(() => ReleaseProfilesDto)
+  profiles?: ReleaseProfilesDto;
+}
diff --git a/server/src/modules/book-request/dto/bulk-book-requests.dto.ts b/server/src/modules/book-request/dto/bulk-book-requests.dto.ts
new file mode 100644
index 000000000..84fd06010
--- /dev/null
+++ b/server/src/modules/book-request/dto/bulk-book-requests.dto.ts
@@ -0,0 +1,28 @@
+import { ArrayMaxSize, ArrayNotEmpty, IsArray, IsInt, IsOptional, IsString, MaxLength, Min } from 'class-validator';
+import { BOOK_REQUEST_BULK_LIMIT } from '@bookorbit/types';
+import type { BulkBookRequestsPayload, BulkRejectBookRequestsPayload } from '@bookorbit/types';
+
+/**
+ * Deliberately ids only. Bulk approval takes each request's own destination; rerouting a library
+ * is a judgement about one book, and applying one reroute to a whole selection is not something
+ * the approver can have meant.
+ */
+export class BulkBookRequestsDto implements BulkBookRequestsPayload {
+  @IsArray()
+  @ArrayNotEmpty()
+  @ArrayMaxSize(BOOK_REQUEST_BULK_LIMIT)
+  @IsInt({ each: true })
+  @Min(1, { each: true })
+  ids!: number[];
+}
+
+/**
+ * Rejection is the exception to the rule above: the note is about why the answer is no, which is
+ * the same answer for every request in the selection, so one sentence covers all of them.
+ */
+export class BulkRejectBookRequestsDto extends BulkBookRequestsDto implements BulkRejectBookRequestsPayload {
+  @IsOptional()
+  @IsString()
+  @MaxLength(2000)
+  decisionNote?: string;
+}
diff --git a/server/src/modules/book-request/dto/check-availability.dto.ts b/server/src/modules/book-request/dto/check-availability.dto.ts
new file mode 100644
index 000000000..4faa00d60
--- /dev/null
+++ b/server/src/modules/book-request/dto/check-availability.dto.ts
@@ -0,0 +1,42 @@
+import { Type } from 'class-transformer';
+import { ArrayMaxSize, IsArray, IsIn, IsOptional, IsString, MaxLength, ValidateNested } from 'class-validator';
+import { BOOK_REQUEST_MEDIA_KINDS } from '@bookorbit/types';
+import type { BookRequestMediaKind } from '@bookorbit/types';
+
+export class AvailabilityQueryDto {
+  @IsString()
+  @MaxLength(500)
+  title!: string;
+
+  @IsIn(BOOK_REQUEST_MEDIA_KINDS)
+  mediaKind!: BookRequestMediaKind;
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(255)
+  author?: string;
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(20)
+  isbn13?: string;
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(50)
+  providerKey?: string;
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(255)
+  providerId?: string;
+}
+
+export class CheckAvailabilityDto {
+  /** Capped at one screenful of search results; this is an annotation pass, not a bulk query. */
+  @IsArray()
+  @ArrayMaxSize(50)
+  @ValidateNested({ each: true })
+  @Type(() => AvailabilityQueryDto)
+  items!: AvailabilityQueryDto[];
+}
diff --git a/server/src/modules/book-request/dto/create-book-request.dto.test.ts b/server/src/modules/book-request/dto/create-book-request.dto.test.ts
new file mode 100644
index 000000000..46871d8d8
--- /dev/null
+++ b/server/src/modules/book-request/dto/create-book-request.dto.test.ts
@@ -0,0 +1,27 @@
+import 'reflect-metadata';
+
+import { validate } from 'class-validator';
+
+import { CreateBookRequestDto } from './create-book-request.dto';
+
+function dto(coverUrl: string | null): CreateBookRequestDto {
+  return Object.assign(new CreateBookRequestDto(), {
+    title: 'A book',
+    mediaKind: 'ebook',
+    coverUrl,
+  });
+}
+
+describe('CreateBookRequestDto', () => {
+  it.each(['https://covers.example/book.jpg', 'http://localhost/cover'])('accepts an HTTP cover URL: %s', async (coverUrl) => {
+    await expect(validate(dto(coverUrl))).resolves.toEqual([]);
+  });
+
+  it.each(['data:image/png;base64,AAAA', 'javascript:alert(1)', 'cover.jpg', 'https://'])('rejects a non-HTTP cover URL: %s', async (coverUrl) => {
+    expect(await validate(dto(coverUrl))).not.toEqual([]);
+  });
+
+  it('allows an omitted cover', async () => {
+    await expect(validate(dto(null))).resolves.toEqual([]);
+  });
+});
diff --git a/server/src/modules/book-request/dto/create-book-request.dto.ts b/server/src/modules/book-request/dto/create-book-request.dto.ts
new file mode 100644
index 000000000..aeba03e7c
--- /dev/null
+++ b/server/src/modules/book-request/dto/create-book-request.dto.ts
@@ -0,0 +1,159 @@
+import { Type } from 'class-transformer';
+import { ArrayMaxSize, IsArray, IsBoolean, IsIn, IsInt, IsOptional, IsString, IsUrl, Max, MaxLength, Min, ValidateNested } from 'class-validator';
+import { BOOK_REQUEST_MEDIA_KINDS } from '@bookorbit/types';
+import type { BookRequestMediaKind } from '@bookorbit/types';
+
+/**
+ * One provider's record of the same work, as the shared `BookRequestMetadataSource` describes it.
+ *
+ * Both ISBNs are stated as nullable rather than merely optional, because that is what the wire
+ * actually carries: a client holding the shared type sends `isbn10: null` for an edition with no
+ * ISBN-10, and `@IsOptional()` accepts null and undefined alike. `normalizeMetadataSources` is
+ * what collapses the two into the null the stored shape requires.
+ */
+export class BookRequestMetadataSourceDto {
+  @IsString()
+  @MaxLength(50)
+  providerKey!: string;
+
+  @IsString()
+  @MaxLength(255)
+  providerId!: string;
+
+  @IsString()
+  @MaxLength(100)
+  providerLabel!: string;
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(20)
+  isbn10?: string | null;
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(20)
+  isbn13?: string | null;
+}
+
+export class CreateBookRequestDto {
+  /**
+   * File this as somebody else, for a front end that its users sign into instead of this one.
+   *
+   * Refused without `manage_book_requests`, and the named user's own permissions decide the rest:
+   * naming them says who asked, never what they may have. Omitted, or set to the caller's own id,
+   * this is an ordinary request and nothing about it changes.
+   */
+  @IsOptional()
+  @Type(() => Number)
+  @IsInt()
+  @Min(1)
+  userId?: number;
+
+  @IsString()
+  @MaxLength(500)
+  title!: string;
+
+  @IsIn(BOOK_REQUEST_MEDIA_KINDS)
+  mediaKind!: BookRequestMediaKind;
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(500)
+  subtitle?: string;
+
+  @IsOptional()
+  @IsArray()
+  @ArrayMaxSize(50)
+  @IsString({ each: true })
+  @MaxLength(255, { each: true })
+  authors?: string[];
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(500)
+  seriesName?: string;
+
+  @IsOptional()
+  @Type(() => Number)
+  @IsInt()
+  @Min(0)
+  seriesIndex?: number;
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(20)
+  isbn10?: string;
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(20)
+  isbn13?: string;
+
+  @IsOptional()
+  @Type(() => Number)
+  @IsInt()
+  @Min(0)
+  @Max(9999)
+  publishedYear?: number;
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(20)
+  language?: string;
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(2048)
+  @IsUrl({ protocols: ['http', 'https'], require_protocol: true, require_tld: false }, { message: 'coverUrl must be an http or https address' })
+  coverUrl?: string;
+
+  /**
+   * Ask to fulfil this one yourself instead of queueing it for an approver. Refused without
+   * `book_request_self_fulfill`; never inferred from the permission, because then every ordinary
+   * request its holder made would skip the queue too.
+   */
+  @IsOptional()
+  @IsBoolean()
+  selfServe?: boolean;
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(50)
+  providerKey?: string;
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(255)
+  providerId?: string;
+
+  @IsOptional()
+  @IsArray()
+  @ArrayMaxSize(20)
+  @ValidateNested({ each: true })
+  @Type(() => BookRequestMetadataSourceDto)
+  metadataSources?: BookRequestMetadataSourceDto[];
+
+  @IsOptional()
+  @IsArray()
+  @ArrayMaxSize(20)
+  @IsString({ each: true })
+  @MaxLength(20, { each: true })
+  preferredFormats?: string[];
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(2000)
+  note?: string;
+
+  @IsOptional()
+  @Type(() => Number)
+  @IsInt()
+  @Min(1)
+  targetLibraryId?: number;
+
+  @IsOptional()
+  @Type(() => Number)
+  @IsInt()
+  @Min(1)
+  targetFolderId?: number;
+}
diff --git a/server/src/modules/book-request/dto/decide-book-request.dto.ts b/server/src/modules/book-request/dto/decide-book-request.dto.ts
new file mode 100644
index 000000000..daf31a04e
--- /dev/null
+++ b/server/src/modules/book-request/dto/decide-book-request.dto.ts
@@ -0,0 +1,21 @@
+import { Type } from 'class-transformer';
+import { IsInt, IsOptional, IsString, MaxLength, Min } from 'class-validator';
+
+export class DecideBookRequestDto {
+  @IsOptional()
+  @IsString()
+  @MaxLength(2000)
+  decisionNote?: string;
+
+  @IsOptional()
+  @Type(() => Number)
+  @IsInt()
+  @Min(1)
+  targetLibraryId?: number;
+
+  @IsOptional()
+  @Type(() => Number)
+  @IsInt()
+  @Min(1)
+  targetFolderId?: number;
+}
diff --git a/server/src/modules/book-request/dto/fulfill-book-request.dto.ts b/server/src/modules/book-request/dto/fulfill-book-request.dto.ts
new file mode 100644
index 000000000..e07b3ac75
--- /dev/null
+++ b/server/src/modules/book-request/dto/fulfill-book-request.dto.ts
@@ -0,0 +1,22 @@
+import { Type } from 'class-transformer';
+import { IsInt, IsOptional, IsString, MaxLength, Min } from 'class-validator';
+import type { FulfillBookRequestPayload } from '@bookorbit/types';
+
+export class FulfillBookRequestDto implements FulfillBookRequestPayload {
+  @IsOptional()
+  @Type(() => Number)
+  @IsInt()
+  @Min(1)
+  bookDockFileId?: number;
+
+  @IsOptional()
+  @Type(() => Number)
+  @IsInt()
+  @Min(1)
+  matchedBookId?: number;
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(2000)
+  note?: string;
+}
diff --git a/server/src/modules/book-request/dto/grab-book-request.dto.ts b/server/src/modules/book-request/dto/grab-book-request.dto.ts
new file mode 100644
index 000000000..d02ed8bf1
--- /dev/null
+++ b/server/src/modules/book-request/dto/grab-book-request.dto.ts
@@ -0,0 +1,49 @@
+import { Type } from 'class-transformer';
+import { IsBase64, IsInt, IsOptional, IsString, MaxLength, Min } from 'class-validator';
+import { MAX_INDEXER_RELEASE_GUID_LENGTH } from '@bookorbit/types';
+
+/**
+ * A grab names one of three things: a release the approver picked out of the ranked list, a
+ * magnet, or a .torrent file. The service enforces "exactly one", because none of them is
+ * required on its own.
+ *
+ * A picked release is named by indexer and guid, never by URL. The server resolves the download
+ * link from its own search results, so a client cannot point the download client at an address it
+ * chose, and a private tracker's credentialed link never has to leave the server.
+ *
+ * A .torrent arrives base64-encoded in the JSON body rather than as multipart. Torrent files are
+ * a few kilobytes, and one JSON endpoint keeps every path validated the same way.
+ */
+export class GrabBookRequestDto {
+  @IsOptional()
+  @Type(() => Number)
+  @IsInt()
+  @Min(1)
+  indexerId?: number;
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(MAX_INDEXER_RELEASE_GUID_LENGTH)
+  releaseGuid?: string;
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(8192)
+  magnet?: string;
+
+  @IsOptional()
+  @IsBase64()
+  @MaxLength(4 * 1024 * 1024)
+  torrentFileBase64?: string;
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(255)
+  torrentFileName?: string;
+
+  @IsOptional()
+  @Type(() => Number)
+  @IsInt()
+  @Min(1)
+  downloadClientId?: number;
+}
diff --git a/server/src/modules/book-request/dto/inspect-book-request-release.dto.ts b/server/src/modules/book-request/dto/inspect-book-request-release.dto.ts
new file mode 100644
index 000000000..3e5f9d67b
--- /dev/null
+++ b/server/src/modules/book-request/dto/inspect-book-request-release.dto.ts
@@ -0,0 +1,14 @@
+import { Type } from 'class-transformer';
+import { IsInt, IsString, MaxLength, Min } from 'class-validator';
+import { MAX_INDEXER_RELEASE_GUID_LENGTH, type InspectBookRequestReleasePayload } from '@bookorbit/types';
+
+export class InspectBookRequestReleaseDto implements InspectBookRequestReleasePayload {
+  @Type(() => Number)
+  @IsInt()
+  @Min(1)
+  indexerId!: number;
+
+  @IsString()
+  @MaxLength(MAX_INDEXER_RELEASE_GUID_LENGTH)
+  releaseGuid!: string;
+}
diff --git a/server/src/modules/book-request/dto/list-book-requests.dto.test.ts b/server/src/modules/book-request/dto/list-book-requests.dto.test.ts
new file mode 100644
index 000000000..12dafdfb4
--- /dev/null
+++ b/server/src/modules/book-request/dto/list-book-requests.dto.test.ts
@@ -0,0 +1,49 @@
+import 'reflect-metadata';
+
+import { plainToInstance } from 'class-transformer';
+import { validate } from 'class-validator';
+import { ListAllBookRequestsDto, ListBookRequestsDto } from './list-book-requests.dto';
+
+describe('ListAllBookRequestsDto', () => {
+  it('transforms requester and accepts every supported status and media kind', async () => {
+    const dto = plainToInstance(ListAllBookRequestsDto, {
+      requesterUserId: '42',
+      status: 'needs_review',
+      mediaKind: 'audiobook',
+    });
+
+    expect(dto.requesterUserId).toBe(42);
+    expect(await validate(dto)).toEqual([]);
+  });
+
+  it('rejects invalid requester, status, and media values', async () => {
+    const dto = plainToInstance(ListAllBookRequestsDto, {
+      requesterUserId: '0',
+      status: 'active',
+      mediaKind: 'movie',
+    });
+
+    expect((await validate(dto)).length).toBeGreaterThan(0);
+  });
+});
+
+describe('ListBookRequestsDto', () => {
+  /**
+   * The personal list has no requester filter. Accepting one and ignoring it answered "my requests
+   * by somebody else" with the caller's own rows and no hint the filter had not applied, so the
+   * field lives only on the admin list and `forbidNonWhitelisted` refuses it here.
+   */
+  it('is refused a requester filter under the pipe the app runs', async () => {
+    const dto = plainToInstance(ListBookRequestsDto, { requesterUserId: '42' });
+    const errors = await validate(dto, { whitelist: true, forbidNonWhitelisted: true });
+
+    expect(errors.map((error) => error.property)).toContain('requesterUserId');
+  });
+
+  it('still accepts the filters the personal list does offer', async () => {
+    const dto = plainToInstance(ListBookRequestsDto, { status: 'pending', mediaKind: 'ebook', selfServe: 'true' });
+
+    expect(dto.selfServe).toBe(true);
+    expect(await validate(dto)).toEqual([]);
+  });
+});
diff --git a/server/src/modules/book-request/dto/list-book-requests.dto.ts b/server/src/modules/book-request/dto/list-book-requests.dto.ts
new file mode 100644
index 000000000..0de3bb0fd
--- /dev/null
+++ b/server/src/modules/book-request/dto/list-book-requests.dto.ts
@@ -0,0 +1,71 @@
+import { Transform } from 'class-transformer';
+import { IsBoolean, IsIn, IsInt, IsOptional, Max, Min } from 'class-validator';
+import { BOOK_REQUEST_MEDIA_KINDS, BOOK_REQUEST_SORT_DIRECTIONS, BOOK_REQUEST_SORT_FIELDS, BOOK_REQUEST_STATUSES } from '@bookorbit/types';
+import type { BookRequestMediaKind, BookRequestSortDirection, BookRequestSortField, BookRequestStatus } from '@bookorbit/types';
+
+export class ListBookRequestsDto {
+  @IsOptional()
+  @Transform(({ value }) => parseInt(value as string, 10))
+  @IsInt()
+  @Min(1)
+  page?: number = 1;
+
+  @IsOptional()
+  @Transform(({ value }) => parseInt(value as string, 10))
+  @IsInt()
+  @Min(1)
+  @Max(100)
+  limit?: number = 20;
+
+  @IsOptional()
+  @IsIn(BOOK_REQUEST_STATUSES)
+  status?: BookRequestStatus;
+
+  @IsOptional()
+  @IsIn(BOOK_REQUEST_MEDIA_KINDS)
+  mediaKind?: BookRequestMediaKind;
+
+  /** Rows the caller has hidden are left out unless they ask for them back. */
+  @IsOptional()
+  @Transform(({ value }) => value === true || value === 'true')
+  @IsBoolean()
+  includeDismissed?: boolean;
+
+  /**
+   * Narrows to self-served rows, or to the ones that went through approval. Server-side because a
+   * badge on the twenty rows already fetched filters a page rather than the queue: an approver
+   * asking "what is actually waiting on me" would still page through everything else.
+   */
+  @IsOptional()
+  @Transform(({ value }) => (value === true || value === 'true' ? true : value === false || value === 'false' ? false : value))
+  @IsBoolean()
+  selfServe?: boolean;
+
+  /**
+   * Ordering is a query concern, not a client one: sorting the twenty rows already fetched would
+   * reorder a page rather than the list, and page 2 would disagree with page 1.
+   */
+  @IsOptional()
+  @IsIn(BOOK_REQUEST_SORT_FIELDS)
+  sortBy?: BookRequestSortField;
+
+  @IsOptional()
+  @IsIn(BOOK_REQUEST_SORT_DIRECTIONS)
+  sortDir?: BookRequestSortDirection;
+}
+
+/**
+ * The approver queue's list, which is the only one that may ask about somebody else's requests.
+ *
+ * Split from the base rather than shared with it: the requester filter used to be accepted on the
+ * personal list and silently ignored there, so a caller narrowing "my requests" to another person
+ * was answered with their own rows and no hint that the filter had not applied. Declared only on
+ * the admin list, `forbidNonWhitelisted` refuses it on the personal one instead.
+ */
+export class ListAllBookRequestsDto extends ListBookRequestsDto {
+  @IsOptional()
+  @Transform(({ value }) => parseInt(value as string, 10))
+  @IsInt()
+  @Min(1)
+  requesterUserId?: number;
+}
diff --git a/server/src/modules/book-request/dto/list-requester-options.dto.ts b/server/src/modules/book-request/dto/list-requester-options.dto.ts
new file mode 100644
index 000000000..d2da26704
--- /dev/null
+++ b/server/src/modules/book-request/dto/list-requester-options.dto.ts
@@ -0,0 +1,14 @@
+import { Transform } from 'class-transformer';
+import { IsOptional, IsString, MaxLength } from 'class-validator';
+
+export class ListRequesterOptionsDto {
+  /**
+   * Matched against a requester's display name and username. Without it the filter offers only
+   * the first page of requesters, which on a large instance is a list that silently omits people.
+   */
+  @IsOptional()
+  @Transform(({ value }) => (typeof value === 'string' ? value.trim() : value))
+  @IsString()
+  @MaxLength(100)
+  search?: string;
+}
diff --git a/server/src/modules/book-request/dto/release-guid.dto.test.ts b/server/src/modules/book-request/dto/release-guid.dto.test.ts
new file mode 100644
index 000000000..6afe813b8
--- /dev/null
+++ b/server/src/modules/book-request/dto/release-guid.dto.test.ts
@@ -0,0 +1,17 @@
+import 'reflect-metadata';
+
+import { validate } from 'class-validator';
+
+import { GrabBookRequestDto } from './grab-book-request.dto';
+import { InspectBookRequestReleaseDto } from './inspect-book-request-release.dto';
+
+describe('book request release guid DTOs', () => {
+  const longGuid = `https://indexer.example/download?token=${'a'.repeat(900)}`;
+
+  it.each([
+    Object.assign(new GrabBookRequestDto(), { indexerId: 1, releaseGuid: longGuid }),
+    Object.assign(new InspectBookRequestReleaseDto(), { indexerId: 1, releaseGuid: longGuid }),
+  ])('accepts a bounded Torznab guid longer than 500 characters', async (dto) => {
+    await expect(validate(dto)).resolves.toEqual([]);
+  });
+});
diff --git a/server/src/modules/book-request/dto/remove-download.dto.ts b/server/src/modules/book-request/dto/remove-download.dto.ts
new file mode 100644
index 000000000..a242e1cde
--- /dev/null
+++ b/server/src/modules/book-request/dto/remove-download.dto.ts
@@ -0,0 +1,11 @@
+import { IsBoolean, IsOptional } from 'class-validator';
+
+export class RemoveDownloadDto {
+  /**
+   * Off unless asked for. The seeded copy is the one BookOrbit hardlinked from, so deleting it is
+   * a deliberate choice rather than tidying up after a removal.
+   */
+  @IsOptional()
+  @IsBoolean()
+  deleteFiles?: boolean;
+}
diff --git a/server/src/modules/book-request/dto/search-book-request-releases.dto.ts b/server/src/modules/book-request/dto/search-book-request-releases.dto.ts
new file mode 100644
index 000000000..08872edde
--- /dev/null
+++ b/server/src/modules/book-request/dto/search-book-request-releases.dto.ts
@@ -0,0 +1,33 @@
+import { ArrayMaxSize, IsArray, IsOptional, IsString, MaxLength } from 'class-validator';
+import type { ReleaseSearchOverrides } from '@bookorbit/types';
+
+export class SearchBookRequestReleasesDto implements ReleaseSearchOverrides {
+  @IsOptional()
+  @IsString()
+  @MaxLength(500)
+  title?: string;
+
+  @IsOptional()
+  @IsArray()
+  @ArrayMaxSize(50)
+  @IsString({ each: true })
+  @MaxLength(255, { each: true })
+  authors?: string[];
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(20)
+  isbn?: string | null;
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(20)
+  language?: string | null;
+
+  @IsOptional()
+  @IsArray()
+  @ArrayMaxSize(20)
+  @IsString({ each: true })
+  @MaxLength(20, { each: true })
+  preferredFormats?: string[];
+}
diff --git a/server/src/modules/book-request/dto/select-release-unit.dto.ts b/server/src/modules/book-request/dto/select-release-unit.dto.ts
new file mode 100644
index 000000000..08ec81140
--- /dev/null
+++ b/server/src/modules/book-request/dto/select-release-unit.dto.ts
@@ -0,0 +1,10 @@
+import { Type } from 'class-transformer';
+import { IsInt, Min } from 'class-validator';
+
+export class SelectReleaseUnitDto {
+  /** Position in the held attempt's stored unit list. Bounds are checked against that list. */
+  @Type(() => Number)
+  @IsInt()
+  @Min(0)
+  unitIndex!: number;
+}
diff --git a/server/src/modules/book-request/dto/update-book-request-language.dto.ts b/server/src/modules/book-request/dto/update-book-request-language.dto.ts
new file mode 100644
index 000000000..1e1ad865c
--- /dev/null
+++ b/server/src/modules/book-request/dto/update-book-request-language.dto.ts
@@ -0,0 +1,15 @@
+import { REQUEST_LANGUAGE_CODES } from '@bookorbit/types';
+import { IsIn, IsString, ValidateIf } from 'class-validator';
+
+export class UpdateBookRequestLanguageDto {
+  /**
+   * A two-letter code, or null to accept any language.
+   *
+   * Restricted to codes the release matcher can compare, because the language is a hard filter: a
+   * code it does not know rejects every release rather than leaving the request open.
+   */
+  @ValidateIf((_object, value) => value !== null)
+  @IsString()
+  @IsIn(REQUEST_LANGUAGE_CODES as string[])
+  language!: string | null;
+}
diff --git a/server/src/modules/book-request/fulfillment/book-request-download.repository.test.ts b/server/src/modules/book-request/fulfillment/book-request-download.repository.test.ts
new file mode 100644
index 000000000..eaa5d7727
--- /dev/null
+++ b/server/src/modules/book-request/fulfillment/book-request-download.repository.test.ts
@@ -0,0 +1,47 @@
+import { createCapturingDb } from '../../../common/test-utils/capture-sql-db';
+import { BookRequestDownloadRepository } from './book-request-download.repository';
+
+/**
+ * The list renders this for every row on the page, and a request accumulates attempts without
+ * bound: automated retries are capped, but manual grabs and recorded refusals are not. What has to
+ * hold is that the database returns one attempt per request, rather than every attempt for the
+ * repository to throw all but one of them away.
+ */
+describe('BookRequestDownloadRepository.findLatestForRequests', () => {
+  async function compiledQuery(): Promise<string> {
+    const { db, queries } = createCapturingDb();
+    await new BookRequestDownloadRepository(db as never).findLatestForRequests([7, 9]);
+    return queries.at(-1)?.sql ?? '';
+  }
+
+  it('narrows to one attempt per request in the database', async () => {
+    const { db, queries } = createCapturingDb();
+
+    await new BookRequestDownloadRepository(db as never).findLatestForRequests([7, 9]);
+
+    expect(queries).toHaveLength(1);
+    expect(queries[0].sql).toContain('distinct on ("book_request_downloads"."request_id")');
+    expect(queries[0].params).toEqual([7, 9]);
+  });
+
+  /** Highest id wins, because two attempts inserted in one transaction share a `created_at`. */
+  it('picks the newest attempt by id', async () => {
+    expect(await compiledQuery()).toContain('order by "book_request_downloads"."request_id", "book_request_downloads"."id" desc');
+  });
+
+  /** The join has to hang off the narrowed set, or the bound is decorative. */
+  it('joins the client and indexer names onto the narrowed set', async () => {
+    const sql = await compiledQuery();
+
+    expect(sql).toContain('inner join');
+    expect(sql).toContain('"newest_attempt"');
+    expect(sql.indexOf('left join')).toBeGreaterThan(sql.indexOf('inner join'));
+  });
+
+  it('asks nothing at all for an empty page', async () => {
+    const { db, queries } = createCapturingDb();
+
+    await expect(new BookRequestDownloadRepository(db as never).findLatestForRequests([])).resolves.toEqual(new Map());
+    expect(queries).toHaveLength(0);
+  });
+});
diff --git a/server/src/modules/book-request/fulfillment/book-request-download.repository.ts b/server/src/modules/book-request/fulfillment/book-request-download.repository.ts
new file mode 100644
index 000000000..fc71a69f5
--- /dev/null
+++ b/server/src/modules/book-request/fulfillment/book-request-download.repository.ts
@@ -0,0 +1,409 @@
+import { Inject, Injectable } from '@nestjs/common';
+import { and, count, desc, eq, inArray, isNotNull, isNull, lt, or, sql } from 'drizzle-orm';
+
+import { NodePgDatabase } from 'drizzle-orm/node-postgres';
+import {
+  ACTIVE_BOOK_REQUEST_DOWNLOAD_STATUSES,
+  GRABBABLE_BOOK_REQUEST_STATUSES,
+  IN_FLIGHT_BOOK_REQUEST_DOWNLOAD_STATUSES,
+  UNSETTLED_BOOK_REQUEST_DOWNLOAD_STATUSES,
+} from '@bookorbit/types';
+import type { BookRequestDownloadStatus, IndexerColor } from '@bookorbit/types';
+
+import { DB } from '../../../db';
+import * as schema from '../../../db/schema';
+import {
+  bookRequestDownloads,
+  bookRequests,
+  downloadClients,
+  requestIndexers,
+  type BookRequestDownloadRow,
+  type NewBookRequestDownloadRow,
+} from '../../../db/schema';
+
+/** Newest first, and bounded: an attempt list is something a person reads, not a full history. */
+const MAX_ATTEMPTS_PER_REQUEST = 20;
+
+/** What the import heartbeat may touch: exactly the two statuses the watchdog ages by `updatedAt`. */
+const IMPORT_HEARTBEAT_STATUSES: readonly BookRequestDownloadStatus[] = ['completed', 'importing'];
+
+/**
+ * How many live attempts one deleted account's requests are detached in one pass. Far past
+ * anything a person accumulates; it is here so a pathological account cannot turn one deletion
+ * into an unbounded run of client calls. Exported so the caller can say when it was reached
+ * rather than reporting a truncated sweep as a complete one.
+ */
+export const MAX_DETACH_ON_OWNER_DELETE = 500;
+
+type Db = NodePgDatabase<typeof schema>;
+
+export interface BookRequestDownloadJoinedRow {
+  download: BookRequestDownloadRow;
+  downloadClientName: string | null;
+  downloadClientColor: IndexerColor | null;
+  /** Null once the indexer row is gone, or for a magnet somebody pasted by hand. */
+  indexerName: string | null;
+  indexerColor: IndexerColor | null;
+}
+
+export interface ReconciliationAttemptRow {
+  download: BookRequestDownloadRow;
+  requestTitle: string;
+}
+
+class AdoptionRaceError extends Error {}
+
+@Injectable()
+export class BookRequestDownloadRepository {
+  constructor(@Inject(DB) private readonly db: Db) {}
+
+  async create(data: NewBookRequestDownloadRow): Promise<BookRequestDownloadRow> {
+    const [row] = await this.db.insert(bookRequestDownloads).values(data).returning();
+    return row;
+  }
+
+  async update(id: number, data: Partial<NewBookRequestDownloadRow>): Promise<BookRequestDownloadRow | undefined> {
+    const [row] = await this.db.update(bookRequestDownloads).set(data).where(eq(bookRequestDownloads.id, id)).returning();
+    return row;
+  }
+
+  /**
+   * Says "these are still being worked on" without changing anything about them.
+   *
+   * Import concurrency is one, so a finished download can wait behind another for as long as that
+   * one takes, and a running import writes nothing for the whole extraction. The watchdog ages a
+   * `completed` or `importing` attempt by `updatedAt`, so with no heartbeat queue depth alone
+   * fails a healthy import and a genuinely slow one is failed while it is still running.
+   */
+  async touch(ids: number[]): Promise<number> {
+    if (ids.length === 0) return 0;
+    const rows = await this.db
+      .update(bookRequestDownloads)
+      .set({ updatedAt: new Date() })
+      .where(and(inArray(bookRequestDownloads.id, ids), inArray(bookRequestDownloads.status, [...IMPORT_HEARTBEAT_STATUSES])))
+      .returning({ id: bookRequestDownloads.id });
+    return rows.length;
+  }
+
+  /**
+   * `update`, refused unless the attempt is still in one of the statuses the caller decided
+   * against. Everything that writes an attempt reads it first, and a client poll can take twenty
+   * seconds to answer: without this, a stale poll returns a cancelled attempt to `downloading`
+   * and, if the client had reported completion, carries a settled request into an import.
+   */
+  async updateIf(
+    id: number,
+    expected: readonly BookRequestDownloadStatus[],
+    data: Partial<NewBookRequestDownloadRow>,
+  ): Promise<BookRequestDownloadRow | undefined> {
+    if (expected.length === 0) return undefined;
+    const [row] = await this.db
+      .update(bookRequestDownloads)
+      .set(data)
+      .where(and(eq(bookRequestDownloads.id, id), inArray(bookRequestDownloads.status, [...expected])))
+      .returning();
+    return row;
+  }
+
+  /**
+   * Takes every attempt for one request that still has work behind it out of the active set, in
+   * one statement.
+   *
+   * For the moment a person settles a request under a live transfer. An attempt left in flight is
+   * one the poll loop keeps asking the client about and keeps writing progress back from, onto a
+   * request that has already been decided.
+   */
+  async failInFlightForRequest(requestId: number, reason: string): Promise<number> {
+    const rows = await this.db
+      .update(bookRequestDownloads)
+      .set({ status: 'failed', errorMessage: reason })
+      .where(and(eq(bookRequestDownloads.requestId, requestId), inArray(bookRequestDownloads.status, [...IN_FLIGHT_BOOK_REQUEST_DOWNLOAD_STATUSES])))
+      .returning({ id: bookRequestDownloads.id });
+    return rows.length;
+  }
+
+  async findById(id: number): Promise<BookRequestDownloadRow | undefined> {
+    const [row] = await this.db.select().from(bookRequestDownloads).where(eq(bookRequestDownloads.id, id)).limit(1);
+    return row;
+  }
+
+  async findByBookDockFileId(fileId: number): Promise<BookRequestDownloadRow | undefined> {
+    const [row] = await this.db
+      .select()
+      .from(bookRequestDownloads)
+      .where(eq(bookRequestDownloads.bookDockFileId, fileId))
+      .orderBy(desc(bookRequestDownloads.id))
+      .limit(1);
+    return row;
+  }
+
+  /**
+   * Only what the poll loop can still report on, so a quiet instance makes no HTTP calls. A
+   * direct file is ours whether or not a client row exists; a torrent whose client was deleted
+   * is left to the watchdog, because nothing can be asked about it any more.
+   */
+  async findActive(): Promise<BookRequestDownloadRow[]> {
+    return this.db
+      .select()
+      .from(bookRequestDownloads)
+      .where(
+        and(
+          inArray(bookRequestDownloads.status, [...ACTIVE_BOOK_REQUEST_DOWNLOAD_STATUSES]),
+          or(eq(bookRequestDownloads.source, 'direct_url'), isNotNull(bookRequestDownloads.downloadClientId)),
+        ),
+      );
+  }
+
+  async findActiveDirect(): Promise<BookRequestDownloadRow[]> {
+    return this.db
+      .select()
+      .from(bookRequestDownloads)
+      .where(and(eq(bookRequestDownloads.source, 'direct_url'), inArray(bookRequestDownloads.status, [...ACTIVE_BOOK_REQUEST_DOWNLOAD_STATUSES])));
+  }
+
+  /**
+   * Finished downloads that never claimed a Book Dock row, which means the import never started.
+   * Once a row has one, retrying would link the file a second time, so a crash after that point is
+   * left to the watchdog rather than replayed.
+   */
+  async findCompletedAwaitingImport(): Promise<BookRequestDownloadRow[]> {
+    return this.db
+      .select()
+      .from(bookRequestDownloads)
+      .where(and(eq(bookRequestDownloads.status, 'completed'), isNull(bookRequestDownloads.bookDockFileId)));
+  }
+
+  /**
+   * `basis` picks what "old" means. A stalled download is measured from the last time bytes
+   * moved; a stuck import is measured from its last state change, because its `lastProgressAt`
+   * belongs to the download that already finished and would make every import look ancient.
+   */
+  async findByStatusOlderThan(
+    statuses: BookRequestDownloadStatus[],
+    cutoff: Date,
+    basis: 'progress' | 'state-change',
+  ): Promise<BookRequestDownloadRow[]> {
+    if (statuses.length === 0) return [];
+    const age =
+      basis === 'progress'
+        ? sql`coalesce(${bookRequestDownloads.lastProgressAt}, ${bookRequestDownloads.grabbedAt}, ${bookRequestDownloads.createdAt})`
+        : sql`${bookRequestDownloads.updatedAt}`;
+
+    return this.db
+      .select()
+      .from(bookRequestDownloads)
+      .where(and(inArray(bookRequestDownloads.status, statuses), lt(age, cutoff)));
+  }
+
+  /**
+   * Attempts one download client is still working on, which is what makes deleting it unsafe.
+   *
+   * The FK nulls on delete, so a torrent whose client is removed stops being pollable, mappable
+   * and removable in the same instant while the client goes on seeding it. Counting first is what
+   * lets the operator be told that rather than discover it.
+   */
+  async countInFlightForClient(clientId: number): Promise<number> {
+    const [row] = await this.db
+      .select({ total: count() })
+      .from(bookRequestDownloads)
+      .where(
+        and(eq(bookRequestDownloads.downloadClientId, clientId), inArray(bookRequestDownloads.status, [...IN_FLIGHT_BOOK_REQUEST_DOWNLOAD_STATUSES])),
+      );
+    return row?.total ?? 0;
+  }
+
+  async findTrackedForClientHashes(clientId: number, hashes: string[]): Promise<ReconciliationAttemptRow[]> {
+    if (hashes.length === 0) return [];
+    return this.db
+      .select({ download: bookRequestDownloads, requestTitle: bookRequests.title })
+      .from(bookRequestDownloads)
+      .innerJoin(bookRequests, eq(bookRequests.id, bookRequestDownloads.requestId))
+      .where(and(eq(bookRequestDownloads.downloadClientId, clientId), inArray(bookRequestDownloads.clientHash, hashes)))
+      .orderBy(desc(bookRequestDownloads.id));
+  }
+
+  async findAdoptableForHashes(hashes: string[]): Promise<ReconciliationAttemptRow[]> {
+    if (hashes.length === 0) return [];
+    return this.db
+      .select({ download: bookRequestDownloads, requestTitle: bookRequests.title })
+      .from(bookRequestDownloads)
+      .innerJoin(bookRequests, eq(bookRequests.id, bookRequestDownloads.requestId))
+      .where(
+        and(
+          inArray(bookRequestDownloads.clientHash, hashes),
+          eq(bookRequestDownloads.status, 'failed'),
+          inArray(bookRequests.status, [...GRABBABLE_BOOK_REQUEST_STATUSES]),
+        ),
+      )
+      .orderBy(desc(bookRequestDownloads.id))
+      .limit(1000);
+  }
+
+  async findActiveForClient(clientId: number): Promise<ReconciliationAttemptRow[]> {
+    return this.db
+      .select({ download: bookRequestDownloads, requestTitle: bookRequests.title })
+      .from(bookRequestDownloads)
+      .innerJoin(bookRequests, eq(bookRequests.id, bookRequestDownloads.requestId))
+      .where(
+        and(eq(bookRequestDownloads.downloadClientId, clientId), inArray(bookRequestDownloads.status, [...ACTIVE_BOOK_REQUEST_DOWNLOAD_STATUSES])),
+      )
+      .orderBy(desc(bookRequestDownloads.id))
+      .limit(1000);
+  }
+
+  async adoptFailedAttempt(
+    downloadId: number,
+    clientId: number,
+    clientHash: string,
+    data: Pick<NewBookRequestDownloadRow, 'status' | 'progressPercent' | 'downloadedBytes' | 'totalBytes' | 'contentPath'>,
+  ): Promise<BookRequestDownloadRow | undefined> {
+    try {
+      return await this.db.transaction(async (tx) => {
+        const [download] = await tx
+          .update(bookRequestDownloads)
+          .set({ ...data, downloadClientId: clientId, errorMessage: null })
+          .where(
+            and(eq(bookRequestDownloads.id, downloadId), eq(bookRequestDownloads.clientHash, clientHash), eq(bookRequestDownloads.status, 'failed')),
+          )
+          .returning();
+        if (!download) throw new AdoptionRaceError();
+
+        const [request] = await tx
+          .update(bookRequests)
+          .set({ status: data.status === 'queued' ? 'grabbed' : 'downloading', statusReason: null })
+          .where(and(eq(bookRequests.id, download.requestId), inArray(bookRequests.status, [...GRABBABLE_BOOK_REQUEST_STATUSES])))
+          .returning({ id: bookRequests.id });
+        if (!request) throw new AdoptionRaceError();
+        return download;
+      });
+    } catch (error) {
+      if (error instanceof AdoptionRaceError) return undefined;
+      throw error;
+    }
+  }
+
+  /**
+   * Live attempts behind the requests one person owns or fulfils, read before their account is
+   * deleted. The cascade takes every tracking row with it, so this is the last moment anything
+   * knows which torrents and staged files belong to work nobody will ever poll again.
+   */
+  async findInFlightForOwner(userId: number): Promise<BookRequestDownloadRow[]> {
+    const rows = await this.db
+      .select({ download: bookRequestDownloads })
+      .from(bookRequestDownloads)
+      .innerJoin(bookRequests, eq(bookRequests.id, bookRequestDownloads.requestId))
+      .where(
+        and(
+          inArray(bookRequestDownloads.status, [...IN_FLIGHT_BOOK_REQUEST_DOWNLOAD_STATUSES]),
+          or(eq(bookRequests.userId, userId), eq(bookRequests.fulfillerUserId, userId)),
+        ),
+      )
+      .limit(MAX_DETACH_ON_OWNER_DELETE);
+    return rows.map((row) => row.download);
+  }
+
+  /**
+   * The staging directories something might still read: a transfer in flight, or finished bytes
+   * an import or a held review has not finished with. Every other directory under the direct
+   * download root is spent, which is what the bootstrap reap acts on.
+   */
+  async findLiveDirectHashes(): Promise<string[]> {
+    const rows = await this.db
+      .select({ clientHash: bookRequestDownloads.clientHash })
+      .from(bookRequestDownloads)
+      .where(
+        and(
+          eq(bookRequestDownloads.source, 'direct_url'),
+          isNotNull(bookRequestDownloads.clientHash),
+          inArray(bookRequestDownloads.status, [...UNSETTLED_BOOK_REQUEST_DOWNLOAD_STATUSES]),
+        ),
+      );
+    return rows.map((row) => row.clientHash).filter((hash): hash is string => hash !== null);
+  }
+
+  /** How many times the automation has already tried this request, which is what bounds retries. */
+  async countAutomatedForRequest(requestId: number): Promise<number> {
+    const [row] = await this.db
+      .select({ count: count() })
+      .from(bookRequestDownloads)
+      .where(and(eq(bookRequestDownloads.requestId, requestId), eq(bookRequestDownloads.automated, true)));
+    return row?.count ?? 0;
+  }
+
+  /**
+   * `indexerId:guid` for every release already handed to a client for this request, so a retry
+   * picks the next one down rather than the one that just failed.
+   */
+  async findTriedReleaseKeys(requestId: number): Promise<Set<string>> {
+    const rows = await this.db
+      .select({ indexerId: bookRequestDownloads.indexerId, releaseGuid: bookRequestDownloads.releaseGuid })
+      .from(bookRequestDownloads)
+      .where(eq(bookRequestDownloads.requestId, requestId));
+
+    const keys = new Set<string>();
+    for (const row of rows) {
+      // A hand-pasted magnet has neither, and there is nothing about it to match a release on.
+      if (row.indexerId === null || row.releaseGuid === null) continue;
+      keys.add(`${row.indexerId}:${row.releaseGuid}`);
+    }
+    return keys;
+  }
+
+  /**
+   * The newest attempt per request, which is the one a card shows.
+   *
+   * The narrowing to one id per request happens in the database, not here. This runs on every list
+   * render, and reading every attempt to keep the first of each would grow with the history behind
+   * each row: automated retries are capped, but manual grabs and recorded refusals are not, so a
+   * page of twenty requests could carry an unbounded number of rows across the wire to discard all
+   * but twenty of them.
+   */
+  async findLatestForRequests(requestIds: number[]): Promise<Map<number, BookRequestDownloadJoinedRow>> {
+    if (requestIds.length === 0) return new Map();
+
+    const newest = this.db
+      .selectDistinctOn([bookRequestDownloads.requestId], { id: bookRequestDownloads.id })
+      .from(bookRequestDownloads)
+      .where(inArray(bookRequestDownloads.requestId, requestIds))
+      .orderBy(bookRequestDownloads.requestId, desc(bookRequestDownloads.id))
+      .as('newest_attempt');
+
+    const rows = await this.db
+      .select({
+        download: bookRequestDownloads,
+        downloadClientName: downloadClients.name,
+        downloadClientColor: downloadClients.color,
+        indexerName: requestIndexers.name,
+        indexerColor: requestIndexers.color,
+      })
+      .from(bookRequestDownloads)
+      .innerJoin(newest, eq(newest.id, bookRequestDownloads.id))
+      .leftJoin(downloadClients, eq(downloadClients.id, bookRequestDownloads.downloadClientId))
+      .leftJoin(requestIndexers, eq(requestIndexers.id, bookRequestDownloads.indexerId));
+
+    return new Map(rows.map((row) => [row.download.requestId, row]));
+  }
+
+  /**
+   * Every attempt made for one request, newest first, refusals included.
+   *
+   * The refusals are the point: a request that ended up downloading from the second source says
+   * nothing, on its own, about the first one having been asked and having said no.
+   */
+  async findForRequest(requestId: number): Promise<BookRequestDownloadJoinedRow[]> {
+    return this.db
+      .select({
+        download: bookRequestDownloads,
+        downloadClientName: downloadClients.name,
+        downloadClientColor: downloadClients.color,
+        indexerName: requestIndexers.name,
+        indexerColor: requestIndexers.color,
+      })
+      .from(bookRequestDownloads)
+      .leftJoin(downloadClients, eq(downloadClients.id, bookRequestDownloads.downloadClientId))
+      .leftJoin(requestIndexers, eq(requestIndexers.id, bookRequestDownloads.indexerId))
+      .where(eq(bookRequestDownloads.requestId, requestId))
+      .orderBy(desc(bookRequestDownloads.id))
+      .limit(MAX_ATTEMPTS_PER_REQUEST);
+  }
+}
diff --git a/server/src/modules/book-request/fulfillment/direct-download.service.test.ts b/server/src/modules/book-request/fulfillment/direct-download.service.test.ts
new file mode 100644
index 000000000..677af0fd1
--- /dev/null
+++ b/server/src/modules/book-request/fulfillment/direct-download.service.test.ts
@@ -0,0 +1,649 @@
+import { mkdir, mkdtemp, readFile, rm, stat, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+/**
+ * The fetcher pins the connection to the address that passed policy, and that path goes through
+ * undici's fetch rather than the global one. What is under test here is the service, not the
+ * dispatcher, so undici is pointed back at whatever stub each test installed.
+ */
+vi.mock('undici', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('undici')>()),
+  fetch: (...args: Parameters<typeof fetch>) => fetch(...args),
+}));
+
+import { Agent } from 'undici';
+
+import { DirectDownloadService, stagedDirectFileName } from './direct-download.service';
+import type { BookRequestDownloadRow } from '../../../db/schema';
+
+const HASH = 'a'.repeat(40);
+/** Real time a case may spend waiting on event-loop turns, and a test budget that outlasts it. */
+const SETTLE_MS = 5_000;
+const FAKE_CLOCK = { timeout: 30_000 };
+
+describe('DirectDownloadService', () => {
+  let appDataPath: string;
+  let service: DirectDownloadService;
+  let fetchMock: ReturnType<typeof vi.fn<typeof fetch>>;
+  let downloads: { update: ReturnType<typeof vi.fn> };
+
+  beforeEach(async () => {
+    appDataPath = await mkdtemp(join(tmpdir(), 'bookorbit-http-'));
+    downloads = { update: vi.fn().mockResolvedValue(undefined) };
+    service = new DirectDownloadService({ appDataPath } as never, downloads as never);
+    fetchMock = vi.fn<typeof fetch>();
+    vi.stubGlobal('fetch', fetchMock);
+  });
+
+  afterEach(async () => {
+    vi.unstubAllGlobals();
+    await rm(appDataPath, { recursive: true, force: true });
+  });
+
+  function fileResponse(body: string, headers: Record<string, string> = {}): Response {
+    return new Response(body, { headers: { 'content-type': 'application/epub+zip', ...headers } });
+  }
+
+  /** Waits for the fire-and-forget download, which `add` deliberately does not await. */
+  async function settle() {
+    return vi.waitFor(async () => {
+      const [status] = await service.status([HASH]);
+      expect(status.state === 'completed' || status.state === 'failed').toBe(true);
+      return status;
+    });
+  }
+
+  it('writes the file into its staging directory and reports where it landed', async () => {
+    fetchMock.mockResolvedValue(fileResponse('a real epub would go here'));
+
+    await service.add({ fileUrl: 'https://archive.org/download/x/book.epub', fileName: 'book.epub', infoHash: HASH });
+    const status = await settle();
+
+    expect(status.state).toBe('completed');
+    expect(status.progressPercent).toBe(100);
+    expect(status.contentPath).toBe(join(appDataPath, 'request-downloads', HASH, 'book.epub'));
+    await expect(readFile(status.contentPath!, 'utf8')).resolves.toBe('a real epub would go here');
+  });
+
+  it('persists validators and resumes a partial file only from the requested byte', async () => {
+    const directory = join(appDataPath, 'request-downloads', HASH);
+    await mkdir(directory, { recursive: true });
+    await writeFile(join(directory, 'book.epub'), 'partial');
+    fetchMock.mockResolvedValue(
+      new Response(' tail', {
+        status: 206,
+        headers: {
+          'content-type': 'application/epub+zip',
+          'content-range': 'bytes 7-11/12',
+          etag: '"edition-1"',
+        },
+      }),
+    );
+
+    const resumed = await service.resume({
+      id: 44,
+      source: 'direct_url',
+      clientHash: HASH,
+      directUrl: 'https://archive.org/download/x/book.epub',
+      directFileName: 'book.epub',
+      directEtag: '"edition-1"',
+      directLastModified: null,
+      totalBytes: 12,
+      status: 'downloading',
+    } as BookRequestDownloadRow);
+
+    expect(resumed).toBe(true);
+    expect((await settle()).state).toBe('completed');
+    await expect(readFile(join(directory, 'book.epub'), 'utf8')).resolves.toBe('partial tail');
+    expect(fetchMock.mock.calls[0][1]?.headers).toMatchObject({ Range: 'bytes=7-', 'If-Range': '"edition-1"' });
+    expect(downloads.update).toHaveBeenCalledWith(44, expect.objectContaining({ directEtag: '"edition-1"', totalBytes: 12 }));
+  });
+
+  it('fails rather than appending when a source ignores the validated range request', async () => {
+    const directory = join(appDataPath, 'request-downloads', HASH);
+    await mkdir(directory, { recursive: true });
+    await writeFile(join(directory, 'book.epub'), 'partial');
+    fetchMock.mockResolvedValue(fileResponse('a different whole file', { etag: '"edition-2"' }));
+
+    await service.resume({
+      id: 45,
+      source: 'direct_url',
+      clientHash: HASH,
+      directUrl: 'https://archive.org/download/x/book.epub',
+      directFileName: 'book.epub',
+      directEtag: '"edition-1"',
+      directLastModified: null,
+      totalBytes: 12,
+      status: 'downloading',
+    } as BookRequestDownloadRow);
+
+    const status = await settle();
+    expect(status.state).toBe('failed');
+    expect(status.errorMessage).toContain('does not support resuming');
+  });
+
+  it('accepts a completed partial file only when a 416 confirms its exact saved size', async () => {
+    const directory = join(appDataPath, 'request-downloads', HASH);
+    await mkdir(directory, { recursive: true });
+    await writeFile(join(directory, 'book.epub'), 'complete');
+    fetchMock.mockResolvedValue(new Response('', { status: 416, headers: { 'content-range': 'bytes */8' } }));
+
+    await service.resume({
+      id: 46,
+      source: 'direct_url',
+      clientHash: HASH,
+      directUrl: 'https://archive.org/download/x/book.epub',
+      directFileName: 'book.epub',
+      directEtag: '"edition-1"',
+      directLastModified: null,
+      totalBytes: 8,
+      status: 'downloading',
+    } as BookRequestDownloadRow);
+
+    await expect(settle()).resolves.toMatchObject({ state: 'completed', downloadedBytes: 8, totalBytes: 8 });
+    await expect(readFile(join(directory, 'book.epub'), 'utf8')).resolves.toBe('complete');
+  });
+
+  it('fails a resumed response that ends before its declared total', async () => {
+    const directory = join(appDataPath, 'request-downloads', HASH);
+    await mkdir(directory, { recursive: true });
+    await writeFile(join(directory, 'book.epub'), 'partial');
+    fetchMock.mockResolvedValue(
+      new Response('x', {
+        status: 206,
+        headers: { 'content-type': 'application/epub+zip', 'content-range': 'bytes 7-11/12', etag: '"edition-1"' },
+      }),
+    );
+
+    await service.resume({
+      id: 47,
+      source: 'direct_url',
+      clientHash: HASH,
+      directUrl: 'https://archive.org/download/x/book.epub',
+      directFileName: 'book.epub',
+      directEtag: '"edition-1"',
+      directLastModified: null,
+      totalBytes: 12,
+      status: 'downloading',
+    } as BookRequestDownloadRow);
+
+    await expect(settle()).resolves.toMatchObject({ state: 'failed', errorMessage: 'That source ended after 8 of 12 bytes' });
+  });
+
+  it('refuses a partial file with no strong validator before making a request', async () => {
+    const directory = join(appDataPath, 'request-downloads', HASH);
+    await mkdir(directory, { recursive: true });
+    await writeFile(join(directory, 'book.epub'), 'partial');
+
+    await expect(
+      service.resume({
+        id: 48,
+        source: 'direct_url',
+        clientHash: HASH,
+        directUrl: 'https://archive.org/download/x/book.epub',
+        directFileName: 'book.epub',
+        directEtag: null,
+        directLastModified: null,
+        totalBytes: 12,
+        status: 'downloading',
+      } as BookRequestDownloadRow),
+    ).resolves.toBe(false);
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  /**
+   * The importer classifies by extension alone, so a name the source did not put one on is a file
+   * it finds no book in. Inspection reported this release ready, which is a promise the staged
+   * name has to keep rather than one the download breaks.
+   */
+  it('stages a nameless file under the format the source declared', async () => {
+    fetchMock.mockResolvedValue(fileResponse('a real epub would go here'));
+
+    await service.add({ fileUrl: 'https://archive.org/download/x/get', fileName: 'download', format: 'epub', infoHash: HASH });
+
+    expect((await settle()).contentPath).toBe(join(appDataPath, 'request-downloads', HASH, 'download.epub'));
+  });
+
+  /**
+   * A content-length that is not a whole number of kilobytes used to be fatal: the transfer budget
+   * was derived from it, and `AbortSignal.timeout` rejects a fractional delay outright. This
+   * failed against the live archive on a 187712 byte EPUB while every mocked test passed.
+   */
+  it('accepts a content-length that does not divide evenly', async () => {
+    fetchMock.mockResolvedValue(fileResponse('x'.repeat(187712), { 'content-length': '187712' }));
+
+    await service.add({ fileUrl: 'https://archive.org/download/x/book.epub', fileName: 'book.epub', infoHash: HASH });
+
+    expect((await settle()).state).toBe('completed');
+  });
+
+  /**
+   * Timers and the clock are faked; `setImmediate` is not. Staging the file and resolving the host
+   * are real I/O that only completes on real event-loop turns, so faking everything would stop the
+   * download before it started.
+   */
+  function withFakeClock<T>(body: () => Promise<T>): Promise<T> {
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout', 'setInterval', 'clearInterval', 'Date'] });
+    return body().finally(() => vi.useRealTimers());
+  }
+
+  /** Bounded on the real clock, which `Date` being faked is exactly why this cannot use `Date`. */
+  function realElapsedMs(from: bigint): number {
+    return Number(process.hrtime.bigint() - from) / 1e6;
+  }
+
+  /** Real event-loop turns, so the fs and DNS work `add` kicks off can actually finish. */
+  async function until(predicate: () => boolean, ms = SETTLE_MS): Promise<void> {
+    const started = process.hrtime.bigint();
+    while (!predicate() && realElapsedMs(started) < ms) await new Promise((resolve) => setImmediate(resolve));
+  }
+
+  /**
+   * Moves `Date` on without faking the timers the transfer itself needed to be real, and puts it
+   * back afterwards so the offset cannot leak into the next case.
+   */
+  async function atLaterTime<T>(offsetMs: number, body: () => Promise<T>): Promise<T> {
+    vi.useFakeTimers({ toFake: ['Date'], now: Date.now() + offsetMs });
+    try {
+      return await body();
+    } finally {
+      vi.useRealTimers();
+    }
+  }
+
+  /**
+   * Real turns until the transfer has taken the bytes just pushed. A fixed pause was enough here
+   * and timed out on a loaded runner, where the clock could pass the idle timeout before the
+   * watchdog these cases advance had been armed at all, leaving a transfer nothing would end.
+   */
+  async function untilDownloaded(bytes: number, ms = SETTLE_MS): Promise<void> {
+    const started = process.hrtime.bigint();
+    while (realElapsedMs(started) < ms) {
+      const [status] = await service.status([HASH]);
+      if (status.downloadedBytes >= bytes) return;
+      await new Promise((resolve) => setImmediate(resolve));
+    }
+  }
+
+  /** What `settle` does, without the faked `setTimeout` that `vi.waitFor` would need. */
+  async function settleOnRealTurns() {
+    const started = process.hrtime.bigint();
+    while (realElapsedMs(started) < SETTLE_MS) {
+      const [status] = await service.status([HASH]);
+      if (status.state === 'completed' || status.state === 'failed') return status;
+      await new Promise((resolve) => setImmediate(resolve));
+    }
+    return { state: 'never settled', errorMessage: null } as never;
+  }
+
+  /** A body the test feeds by hand, so a transfer can be spread across as much clock as it likes. */
+  function trickleResponse() {
+    let controller!: ReadableStreamDefaultController<Uint8Array>;
+    const body = new ReadableStream<Uint8Array>({
+      start(source) {
+        controller = source;
+      },
+    });
+    return {
+      response: new Response(body, { headers: { 'content-type': 'application/epub+zip' } }),
+      push: (text: string) => controller.enqueue(new TextEncoder().encode(text)),
+      close: () => controller.close(),
+    };
+  }
+
+  /**
+   * The regression that made every LibriVox grab fail. The connect deadline was set with
+   * `AbortSignal.timeout`, whose signal stays attached to the response body, so a 239 MB zip
+   * streaming at 6 MB/s was aborted at exactly 30 seconds with three quarters of it written.
+   * Gutenberg's one-megabyte EPUBs land long before that, which is why nothing caught it.
+   */
+  it('lets a download outlive the deadline for reaching the server', FAKE_CLOCK, async () => {
+    await withFakeClock(async () => {
+      let handed: AbortSignal | undefined;
+      fetchMock.mockImplementation((_url, init) => {
+        handed = init?.signal ?? undefined;
+        return Promise.resolve(fileResponse('a real epub would go here'));
+      });
+
+      await service.add({ fileUrl: 'https://archive.org/download/x/book.epub', fileName: 'book.epub', infoHash: HASH });
+      await until(() => handed !== undefined);
+      // Well past the connect deadline, which by then has nothing left to say about the transfer.
+      vi.advanceTimersByTime(90_000);
+
+      await expect(settleOnRealTurns()).resolves.toMatchObject({ state: 'completed' });
+      expect(handed!.aborted).toBe(false);
+    });
+  });
+
+  /** The other half: dropping the deadline once headers arrive must not drop it before they do. */
+  it('still gives up on a server that never sends its headers', FAKE_CLOCK, async () => {
+    await withFakeClock(async () => {
+      let asked = false;
+      fetchMock.mockImplementation((_url, init) => {
+        asked = true;
+        return new Promise<Response>((_resolve, reject) => {
+          init?.signal?.addEventListener('abort', () => reject(init.signal?.reason as Error));
+        });
+      });
+
+      await service.add({ fileUrl: 'https://archive.org/download/x/book.epub', fileName: 'book.epub', infoHash: HASH });
+      await until(() => asked);
+      vi.advanceTimersByTime(31_000);
+
+      await expect(settleOnRealTurns()).resolves.toMatchObject({ state: 'failed' });
+    });
+  });
+
+  /**
+   * The second half of the same defect. The body had a budget that scaled with the file size but
+   * still assumed a floor on throughput: about 1 MB/s, so a 239 MB audiobook needed 5.4 Mbit/s and
+   * anything slower spent six minutes downloading before being told the line was too slow. A slow
+   * transfer is not a failed one, and nothing here bounds how long an honest one may take.
+   */
+  it('finishes a slow transfer that keeps sending, however long it takes', FAKE_CLOCK, async () => {
+    await withFakeClock(async () => {
+      const trickle = trickleResponse();
+      fetchMock.mockResolvedValue(trickle.response);
+
+      await service.add({ fileUrl: 'https://archive.org/download/x/book.epub', fileName: 'book.epub', infoHash: HASH });
+      // Ten minutes of transfer, for a file the old size-scaled budget allowed two.
+      const chunk = 'another chunk of the audiobook';
+      for (let minute = 0; minute < 10; minute++) {
+        trickle.push(chunk);
+        await untilDownloaded(chunk.length * (minute + 1));
+        vi.advanceTimersByTime(60_000);
+      }
+      trickle.close();
+
+      await expect(settleOnRealTurns()).resolves.toMatchObject({ state: 'completed' });
+    });
+  });
+
+  /** Slow is not stalled, and the difference is whether anything is still arriving. */
+  it('gives up on a transfer that stops sending altogether', FAKE_CLOCK, async () => {
+    await withFakeClock(async () => {
+      const trickle = trickleResponse();
+      fetchMock.mockResolvedValue(trickle.response);
+
+      await service.add({ fileUrl: 'https://archive.org/download/x/book.epub', fileName: 'book.epub', infoHash: HASH });
+      const chunk = 'the only chunk that ever arrives';
+      trickle.push(chunk);
+      await untilDownloaded(chunk.length);
+      vi.advanceTimersByTime(130_000);
+
+      await expect(settleOnRealTurns()).resolves.toMatchObject({ state: 'failed', errorMessage: expect.stringMatching(/sent nothing/) });
+    });
+  });
+
+  /** An open library answers a wrong path with a courtesy page and a 200, not a 404. */
+  it('fails a response that is a web page rather than a file', async () => {
+    fetchMock.mockResolvedValue(new Response('<html>not found</html>', { headers: { 'content-type': 'text/html; charset=utf-8' } }));
+
+    await service.add({ fileUrl: 'https://archive.org/download/x/book.epub', fileName: 'book.epub', infoHash: HASH });
+    const status = await settle();
+
+    expect(status.state).toBe('failed');
+    expect(status.errorMessage).toMatch(/web page/);
+  });
+
+  /**
+   * Which is exactly what a file host does when it reads `node` in the agent header, so the cause
+   * arrives as the failure above and names nothing. Saying who we are is what gets us served.
+   */
+  it('names itself rather than letting Node announce the request as node', async () => {
+    fetchMock.mockResolvedValue(fileResponse('a real epub would go here'));
+
+    await service.add({ fileUrl: 'https://archive.org/download/x/book.epub', fileName: 'book.epub', infoHash: HASH });
+    await settle();
+
+    const [, init] = fetchMock.mock.calls[0] as [URL, RequestInit];
+    expect((init.headers as Record<string, string>)['User-Agent']).toBe('BookOrbit');
+  });
+
+  it('fails a file that declares itself past the size cap', async () => {
+    fetchMock.mockResolvedValue(fileResponse('x', { 'content-length': String(64 * 1024 * 1024 * 1024) }));
+
+    await service.add({ fileUrl: 'https://archive.org/download/x/huge.m4b', fileName: 'huge.m4b', infoHash: HASH });
+
+    expect((await settle()).state).toBe('failed');
+  });
+
+  it('fails an empty file rather than importing nothing', async () => {
+    fetchMock.mockResolvedValue(fileResponse(''));
+
+    await service.add({ fileUrl: 'https://archive.org/download/x/book.epub', fileName: 'book.epub', infoHash: HASH });
+
+    expect((await settle()).state).toBe('failed');
+  });
+
+  /**
+   * `redirect: 'follow'` would let a redirect to a private address through, which is exactly what
+   * the containment check exists to stop, so each hop is checked in turn.
+   */
+  it('refuses a redirect to a private address', async () => {
+    fetchMock.mockResolvedValueOnce(new Response('', { status: 302, headers: { location: 'http://127.0.0.1:8080/secret' } }));
+
+    await service.add({ fileUrl: 'https://archive.org/download/x/book.epub', fileName: 'book.epub', infoHash: HASH });
+
+    expect((await settle()).state).toBe('failed');
+  });
+
+  it('gives up rather than following redirects forever', async () => {
+    fetchMock.mockResolvedValue(new Response('', { status: 302, headers: { location: 'https://archive.org/again' } }));
+
+    await service.add({ fileUrl: 'https://archive.org/download/x/book.epub', fileName: 'book.epub', infoHash: HASH });
+    const status = await settle();
+
+    expect(status.state).toBe('failed');
+    expect(status.errorMessage).toMatch(/redirected more than/);
+  });
+
+  /** The filename comes from an external source, so it must not be able to choose a path. */
+  it('keeps a traversing filename inside the download directory', async () => {
+    fetchMock.mockResolvedValue(fileResponse('payload'));
+
+    await service.add({ fileUrl: 'https://archive.org/download/x/b', fileName: '../../escaped.epub', infoHash: HASH });
+    const status = await settle();
+
+    expect(status.state).toBe('completed');
+    expect(status.contentPath!.startsWith(join(appDataPath, 'request-downloads', HASH))).toBe(true);
+  });
+
+  /**
+   * A release URL comes from an indexer, so this is the caller that cannot live with a name that
+   * resolves publicly to be approved and privately to be connected to. The refusal itself is
+   * proven in `safe-fetch.test.ts`; what matters here is that this path asks for it.
+   */
+  it('connects only to the address that passed policy', async () => {
+    fetchMock.mockResolvedValue(fileResponse('a real epub would go here'));
+
+    await service.add({ fileUrl: 'https://archive.org/download/x/book.epub', fileName: 'book.epub', infoHash: HASH });
+    await settle();
+
+    expect(fetchMock.mock.calls[0][1]).toMatchObject({ dispatcher: expect.any(Agent) });
+  });
+
+  /**
+   * Reported the way a download client reports a torrent it does not hold: by leaving it out. The
+   * poll loop reads an unmapped `unknown` as `downloading`, so answering with one left a transfer a
+   * restart interrupted sitting at "downloading 0%" until the twelve-hour stall timeout.
+   */
+  it('leaves a hash it has never seen out of the answer rather than reporting a state for it', async () => {
+    await expect(service.status(['b'.repeat(40)])).resolves.toEqual([]);
+  });
+
+  it('deletes only the staged copy, the library hardlink being a separate one', async () => {
+    fetchMock.mockResolvedValue(fileResponse('payload'));
+    await service.add({ fileUrl: 'https://archive.org/download/x/book.epub', fileName: 'book.epub', infoHash: HASH });
+    await settle();
+
+    await service.remove(HASH, { deleteFiles: true });
+
+    await expect(stat(join(appDataPath, 'request-downloads', HASH))).rejects.toThrow();
+    await expect(service.status([HASH])).resolves.toEqual([]);
+  });
+
+  /**
+   * Nothing collects a failed attempt. It is no longer polled, `cleanupStagedDirectDownload` runs
+   * only after a successful import, and `removeLatestForRequest` only on cancel or delete - so
+   * whatever the failure wrote sits under its own hash directory until the disk fills. The size
+   * ceiling is the worst of them: it is checked after the chunk is appended, so tripping it means
+   * roughly eight gigabytes are already written.
+   */
+  describe('staging after a failure', () => {
+    async function stagingExists(): Promise<boolean> {
+      return stat(join(appDataPath, 'request-downloads', HASH)).then(
+        () => true,
+        () => false,
+      );
+    }
+
+    it('leaves nothing behind when the server answers with a page rather than a file', async () => {
+      fetchMock.mockResolvedValue(new Response('<html>not found</html>', { headers: { 'content-type': 'text/html' } }));
+
+      await service.add({ fileUrl: 'https://archive.org/download/x/book.epub', fileName: 'book.epub', infoHash: HASH });
+      await settle();
+
+      expect(await stagingExists()).toBe(false);
+    });
+
+    it('leaves nothing behind when the file declares itself past the size cap', async () => {
+      fetchMock.mockResolvedValue(fileResponse('x', { 'content-length': String(64 * 1024 * 1024 * 1024) }));
+
+      await service.add({ fileUrl: 'https://archive.org/download/x/huge.m4b', fileName: 'huge.m4b', infoHash: HASH });
+      await settle();
+
+      expect(await stagingExists()).toBe(false);
+    });
+
+    it('leaves nothing behind when the connection fails outright', async () => {
+      fetchMock.mockRejectedValue(new Error('ECONNREFUSED'));
+
+      await service.add({ fileUrl: 'https://archive.org/download/x/book.epub', fileName: 'book.epub', infoHash: HASH });
+      await settle();
+
+      expect(await stagingExists()).toBe(false);
+    });
+
+    it('leaves nothing behind when the stream breaks partway through', async () => {
+      const body = new ReadableStream<Uint8Array>({
+        start(controller) {
+          controller.enqueue(new TextEncoder().encode('the first half'));
+          controller.error(new Error('the connection dropped'));
+        },
+      });
+      fetchMock.mockResolvedValue(new Response(body, { headers: { 'content-type': 'application/epub+zip' } }));
+
+      await service.add({ fileUrl: 'https://archive.org/download/x/book.epub', fileName: 'book.epub', infoHash: HASH });
+      await settle();
+
+      expect(await stagingExists()).toBe(false);
+    });
+
+    /** Read once by the poll loop and then never again, so the entry must not outlive the process. */
+    it('drops a terminal entry once nothing could still be reading it', async () => {
+      fetchMock.mockRejectedValue(new Error('ECONNREFUSED'));
+      await service.add({ fileUrl: 'https://archive.org/download/x/book.epub', fileName: 'book.epub', infoHash: HASH });
+      expect((await settle()).state).toBe('failed');
+
+      const reported = await atLaterTime(11 * 60 * 1000, () => service.status([HASH]));
+
+      expect(reported).toEqual([]);
+    });
+
+    /** Dropping it too early would replace the reason it failed with "the client has never heard of it". */
+    it('keeps a terminal entry readable while the poll loop could still want it', async () => {
+      fetchMock.mockRejectedValue(new Error('ECONNREFUSED'));
+      await service.add({ fileUrl: 'https://archive.org/download/x/book.epub', fileName: 'book.epub', infoHash: HASH });
+      await settle();
+
+      const state = await atLaterTime(60 * 1000, async () => (await service.status([HASH]))[0].state);
+
+      expect(state).toBe('failed');
+    });
+  });
+
+  /** Startup reaps directories only after resumable attempts have claimed the ones they still need. */
+  describe('reapStaging', () => {
+    const OTHER = 'c'.repeat(40);
+
+    async function stage(hash: string): Promise<void> {
+      await mkdir(join(appDataPath, 'request-downloads', hash), { recursive: true });
+    }
+
+    it('removes a directory no live attempt is behind and keeps the ones that are', async () => {
+      await stage(HASH);
+      await stage(OTHER);
+
+      const reaped = await service.reapStaging(new Set([OTHER]));
+
+      expect(reaped).toBe(1);
+      await expect(stat(join(appDataPath, 'request-downloads', HASH))).rejects.toThrow();
+      await expect(stat(join(appDataPath, 'request-downloads', OTHER))).resolves.toBeDefined();
+    });
+
+    /** A transfer this process is running has no row saying so until the grab commits. */
+    it('never reaps a directory this process is downloading into', async () => {
+      const trickle = trickleResponse();
+      fetchMock.mockResolvedValue(trickle.response);
+      await service.add({ fileUrl: 'https://archive.org/download/x/book.epub', fileName: 'book.epub', infoHash: HASH });
+      await vi.waitFor(() => expect(fetchMock).toHaveBeenCalled());
+
+      expect(await service.reapStaging(new Set())).toBe(0);
+      await expect(stat(join(appDataPath, 'request-downloads', HASH))).resolves.toBeDefined();
+
+      trickle.push('payload');
+      trickle.close();
+      await settle();
+    });
+
+    it('says nothing was reaped when the root does not exist yet', async () => {
+      await expect(service.reapStaging(new Set())).resolves.toBe(0);
+    });
+  });
+
+  it('aborts an active transfer before deleting its partial staging file', async () => {
+    const body = new ReadableStream<Uint8Array>({
+      start(controller) {
+        controller.enqueue(new TextEncoder().encode('partial'));
+      },
+    });
+    fetchMock.mockResolvedValue(new Response(body, { headers: { 'content-type': 'application/epub+zip', 'content-length': '1000' } }));
+    await service.add({ fileUrl: 'https://archive.org/download/x/book.epub', fileName: 'book.epub', infoHash: HASH });
+    await vi.waitFor(async () => {
+      expect((await service.status([HASH]))[0].downloadedBytes).toBeGreaterThan(0);
+    });
+
+    await service.remove(HASH, { deleteFiles: true });
+
+    await expect(service.status([HASH])).resolves.toEqual([]);
+    await expect(stat(join(appDataPath, 'request-downloads', HASH))).rejects.toThrow();
+  });
+});
+
+/**
+ * The rule the staged name follows, which inspection reads too: the two have to agree or a release
+ * is accepted, downloaded in full, and then refused for a condition inspection called safe.
+ */
+describe('stagedDirectFileName', () => {
+  it('gives a nameless file the declared extension', () => {
+    expect(stagedDirectFileName('download', 'epub')).toBe('download.epub');
+    expect(stagedDirectFileName('', 'epub')).toBe('download.epub');
+    expect(stagedDirectFileName(null, 'M4B')).toBe('download.m4b');
+    expect(stagedDirectFileName('download', '.epub')).toBe('download.epub');
+  });
+
+  /** A `.zip` holding an epub is an archive the importer extracts; `book.zip.epub` is not. */
+  it('leaves a name that already carries an extension alone', () => {
+    expect(stagedDirectFileName('book.zip', 'epub')).toBe('book.zip');
+    expect(stagedDirectFileName('book.epub', 'epub')).toBe('book.epub');
+  });
+
+  /** Nothing to promise: an unsupported format is refused at inspection rather than dressed up. */
+  it('adds nothing for a format the importer does not support', () => {
+    expect(stagedDirectFileName('download', 'html')).toBe('download');
+    expect(stagedDirectFileName(null, 'html')).toBe('download.bin');
+    expect(stagedDirectFileName(undefined, undefined)).toBe('download.bin');
+  });
+});
diff --git a/server/src/modules/book-request/fulfillment/direct-download.service.ts b/server/src/modules/book-request/fulfillment/direct-download.service.ts
new file mode 100644
index 000000000..b30f6c03b
--- /dev/null
+++ b/server/src/modules/book-request/fulfillment/direct-download.service.ts
@@ -0,0 +1,611 @@
+import { createWriteStream } from 'node:fs';
+import { mkdir, readdir, rm, stat } from 'node:fs/promises';
+import { extname, join, resolve, sep } from 'node:path';
+
+import { Readable } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+import { Inject, Injectable, Logger } from '@nestjs/common';
+import type { ConfigType } from '@nestjs/config';
+import { BOOK_FORMATS } from '@bookorbit/types';
+
+import { storageConfig } from '../../../config/config';
+import { sanitizeLogValue } from '../../../common/utils/log-sanitize.utils';
+import { safeFetch } from '../../../common/utils/safe-fetch';
+import { ensureSafeUrl } from '../../../common/utils/ssrf.utils';
+import type { BookRequestDownloadRow } from '../../../db/schema';
+import type { DownloadStatus } from '../download-clients/download-client-adapter';
+import { BookRequestDownloadRepository } from './book-request-download.repository';
+
+/**
+ * Where BookOrbit's own fetches land, and therefore the boundary the import may read one out of.
+ * A direct file has no download client and so no path mapping to declare a root for it; this is
+ * that root, and the importer holds it to the same containment a mapped client path gets.
+ */
+export function directDownloadRoot(appDataPath: string): string {
+  return join(appDataPath, 'request-downloads');
+}
+
+/** The formats a staged name may be given, which is exactly what the importer classifies by. */
+const STAGEABLE_FORMATS = new Set<string>(BOOK_FORMATS);
+
+/**
+ * The name a resolved file is staged under, which has to be a name the importer can classify.
+ *
+ * A direct source states its format out of band and its download URL often ends in something that
+ * is not a filename at all, so `{ fileName: "download", format: "epub" }` is an ordinary answer.
+ * Staged unchanged it is a file the importer finds no book in, and the release is then accepted,
+ * downloaded in full, and only afterwards refused for a condition inspection called safe.
+ *
+ * Carrying the declared extension closes that gap, and the rule is deliberately narrow: a name
+ * that already carries any extension is left alone, because a `.zip` holding an epub is an
+ * archive the importer extracts and `book.zip.epub` is one it cannot open at all.
+ */
+export function stagedDirectFileName(fileName: string | null | undefined, format: string | null | undefined): string {
+  const name = (fileName ?? '').trim();
+  const declared = (format ?? '').trim().toLowerCase().replace(/^\./, '');
+  const stageable = STAGEABLE_FORMATS.has(declared);
+
+  if (!name) return stageable ? `download.${declared}` : 'download.bin';
+  if (extname(name) !== '') return name;
+  return stageable ? `${name}.${declared}` : name;
+}
+
+/** Generous enough for an unabridged audiobook, low enough that a runaway response is bounded. */
+const MAX_FILE_BYTES = 8 * 1024 * 1024 * 1024;
+const CONNECT_TIMEOUT_MS = 30_000;
+/**
+ * A stalled body, as distinct from a slow one: how long a transfer may send nothing at all before
+ * it is treated as dead rather than slow. Reset whenever bytes actually arrive.
+ */
+const IDLE_TIMEOUT_MS = 120_000;
+/** How often that is checked. Coarse on purpose: it is a watchdog, not a stopwatch. */
+const IDLE_CHECK_MS = 5_000;
+/**
+ * A backstop so a trickle cannot hold a download slot open forever, not a throughput expectation.
+ * Generous enough that no honest transfer reaches it: even the 8 GB cap only needs 190 KB/s.
+ */
+const MAX_TRANSFER_MS = 12 * 60 * 60 * 1000;
+const MAX_REDIRECTS = 5;
+
+/**
+ * How long a finished transfer stays readable before its entry is dropped.
+ *
+ * The poll loop reads a direct transfer once a second and stops reading it the moment it records
+ * a terminal state, so this is several thousand times longer than the outcome needs to survive.
+ * It is generous because the alternative to a stale entry is an outcome nobody ever saw: an
+ * attempt whose `failed` is dropped too early reads as `unknown` instead, and the reason it
+ * failed is replaced by "the download client no longer has this torrent".
+ */
+const TERMINAL_RETENTION_MS = 10 * 60 * 1000;
+
+/** An open library answers a wrong path with a courtesy HTML page and a 200, not a 404. */
+const HTML_CONTENT_TYPE = /^text\/html\b/i;
+
+/**
+ * Sent because Node's fetch otherwise announces itself as `node`, which file hosts commonly refuse.
+ *
+ * Measured 2026-08-20 against a Library Genesis CDN: the same link answered `application/octet-stream`
+ * for this string, for no agent header at all, and for a browser one, and answered `text/html` for
+ * `node`, `curl` and `python-requests`. So what is being refused is a known automation token rather
+ * than anything a real client sends, and saying who we actually are is enough to be served.
+ */
+const USER_AGENT = 'BookOrbit';
+
+/**
+ * A release URL comes from an indexer, which is the one thing on this path that is never trusted,
+ * so a direct fetch never reaches the private network. Torrent clients get a per-row opt-in
+ * because they live on the LAN; there is no equivalent reason for a file to.
+ */
+const ALLOW_PRIVATE = false;
+
+interface Progress {
+  state: DownloadStatus['state'];
+  downloadedBytes: number;
+  totalBytes: number | null;
+  contentPath: string | null;
+  errorMessage?: string;
+  /** When this stopped moving for good, which is what makes the entry collectable. */
+  terminalAt?: number;
+}
+
+export interface DirectDownloadRequest {
+  downloadId: number;
+  fileUrl: string;
+  fileName?: string;
+  /** What the source declared the file to be, which is what names a file that arrived without one. */
+  format?: string | null;
+  /**
+   * How the poll loop identifies this transfer. A direct file has no infohash, so the caller
+   * derives a stable digest of the URL, which keeps the duplicate-grab index meaningful.
+   */
+  infoHash: string;
+}
+
+/**
+ * Fetches one file over plain HTTP into a staging directory, and reports on it the way a torrent
+ * client reports on a torrent, so the import path downstream is unchanged: it still reads a
+ * `contentPath` and still hardlinks out of it into the Book Dock.
+ *
+ * This exists because the good public-domain sources are not torrents. Standard Ebooks and
+ * Project Gutenberg publish no torrents at all, and an Internet Archive item torrent is mostly
+ * not the book: the Frankenstein item measured on 2026-08-19 is 134 MB across 13 files for a
+ * 13.8 MB PDF, where the direct file is a 382 KB EPUB. It also means book requests work on a
+ * fresh install with no torrent client configured, which is otherwise the first hard step.
+ *
+ * Deliberately not a `DownloadClientAdapter`: there is no address, no credentials and nothing to
+ * choose, so an operator is never asked to configure it and no row stands for it. Attempts it
+ * fetched are the ones whose `source` is `direct_url`.
+ *
+ * Active progress lives in memory, while the source URL, target name, byte count and HTTP
+ * validators live on the attempt row. On restart a partial file is resumed only when `If-Range`
+ * and an exact `Content-Range` prove the response continues the same representation.
+ */
+@Injectable()
+export class DirectDownloadService {
+  private readonly logger = new Logger(DirectDownloadService.name);
+
+  private readonly progress = new Map<string, Progress>();
+  private readonly controllers = new Map<string, AbortController>();
+  private readonly tasks = new Map<string, Promise<void>>();
+
+  constructor(
+    @Inject(storageConfig.KEY) private readonly storage: ConfigType<typeof storageConfig>,
+    private readonly downloads: BookRequestDownloadRepository,
+  ) {}
+
+  private get root(): string {
+    return directDownloadRoot(this.storage.appDataPath);
+  }
+
+  async add(release: DirectDownloadRequest): Promise<{ clientHash: string }> {
+    const url = await ensureSafeUrl(release.fileUrl, { allowPrivate: ALLOW_PRIVATE });
+
+    const directory = join(this.root, release.infoHash);
+    const target = safeJoin(directory, stagedDirectFileName(release.fileName, release.format));
+
+    await mkdir(directory, { recursive: true });
+    this.start(release.downloadId, release.infoHash, url, target, directory, 0, null, null);
+
+    return { clientHash: release.infoHash };
+  }
+
+  /** Restores one active direct attempt left by the previous process. */
+  async resume(download: BookRequestDownloadRow): Promise<boolean> {
+    if (
+      download.source !== 'direct_url' ||
+      download.clientHash === null ||
+      download.directUrl === null ||
+      download.directFileName === null ||
+      this.progress.has(download.clientHash)
+    ) {
+      return false;
+    }
+
+    const url = await ensureSafeUrl(download.directUrl, { allowPrivate: ALLOW_PRIVATE });
+    const directory = join(this.root, download.clientHash);
+    const target = safeJoin(directory, download.directFileName);
+    const existingBytes = await stat(target)
+      .then((entry) => (entry.isFile() ? entry.size : 0))
+      .catch(() => 0);
+    const validator = resumeValidator(download.directEtag, download.directLastModified);
+    if (existingBytes > 0 && validator === null) return false;
+    if (existingBytes > MAX_FILE_BYTES) return false;
+
+    await mkdir(directory, { recursive: true });
+    this.start(download.id, download.clientHash, url, target, directory, existingBytes, validator, download.totalBytes);
+    this.logger.log(
+      `[direct_download.resume] [start] downloadId=${download.id} hash=${download.clientHash} bytes=${existingBytes} - resuming an interrupted direct download`,
+    );
+    return true;
+  }
+
+  private start(
+    downloadId: number,
+    infoHash: string,
+    url: URL,
+    target: string,
+    directory: string,
+    offset: number,
+    validator: string | null,
+    expectedBytes: number | null,
+  ): void {
+    this.progress.set(infoHash, {
+      state: 'downloading',
+      downloadedBytes: offset,
+      totalBytes: expectedBytes,
+      contentPath: null,
+    });
+    const controller = new AbortController();
+    this.controllers.set(infoHash, controller);
+
+    // Deliberately not awaited: `add` hands the work over the way a torrent client does, and the
+    // poll loop is what reports on it from here.
+    const task = this.run(downloadId, infoHash, url, target, controller.signal, offset, validator, expectedBytes)
+      .catch((error: unknown) => {
+        if (controller.signal.aborted) return;
+        const message = error instanceof Error ? error.message : String(error);
+        const current = this.progress.get(infoHash);
+        this.progress.set(infoHash, {
+          state: 'failed',
+          downloadedBytes: current?.downloadedBytes ?? offset,
+          totalBytes: current?.totalBytes ?? expectedBytes,
+          contentPath: null,
+          errorMessage: message,
+          terminalAt: Date.now(),
+        });
+        this.logger.warn(`[direct_download.fetch] [fail] hash=${infoHash} error="${sanitizeLogValue(message)}" - direct download failed`);
+      })
+      .finally(async () => {
+        this.controllers.delete(infoHash);
+        this.tasks.delete(infoHash);
+        if (this.progress.get(infoHash)?.state !== 'completed') await this.discard(infoHash, directory);
+      });
+    this.tasks.set(infoHash, task);
+    void task;
+  }
+
+  /**
+   * Reports only the transfers this process is actually holding, exactly as a download client
+   * reports only the torrents it holds.
+   *
+   * Nothing in memory means this process never started it or was restarted under it, and progress
+   * lives only in memory: there is nothing left to resume. Answering with `unknown` instead used to
+   * read to the poll loop as an unmapped state, which it spells `downloading`, so an interrupted
+   * transfer sat at "downloading 0%" until the twelve-hour stall timeout - a timeout sized for a
+   * seederless torrent that might still finish, not for a transfer that certainly will not.
+   * Leaving the hash out puts it on the monitor's missing path, which gives it two minutes to
+   * reappear and then fails it with a reason.
+   */
+  // eslint-disable-next-line @typescript-eslint/require-await -- matches the client adapters it is polled alongside.
+  async status(hashes: string[]): Promise<DownloadStatus[]> {
+    this.pruneTerminal();
+    return hashes.flatMap((infoHash) => {
+      const current = this.progress.get(infoHash);
+      if (!current) return [];
+      const percent =
+        current.state === 'completed'
+          ? 100
+          : current.totalBytes && current.totalBytes > 0
+            ? Math.min(99, Math.floor((current.downloadedBytes / current.totalBytes) * 100))
+            : 0;
+      return [
+        {
+          infoHash,
+          state: current.state,
+          progressPercent: percent,
+          downloadedBytes: current.downloadedBytes,
+          totalBytes: current.totalBytes,
+          contentPath: current.contentPath,
+          ...(current.errorMessage ? { errorMessage: current.errorMessage } : {}),
+        },
+      ];
+    });
+  }
+
+  /**
+   * There is no swarm to leave, so removing is only ever about the staged copy. The import has
+   * already hardlinked what it wanted, and dropping our link does not touch the library's.
+   */
+  async remove(hash: string, opts: { deleteFiles: boolean }): Promise<void> {
+    this.controllers.get(hash)?.abort();
+    await this.tasks.get(hash);
+    this.progress.delete(hash);
+    if (opts.deleteFiles) await rm(join(this.root, hash), { recursive: true, force: true });
+  }
+
+  /**
+   * Drops staging directories no attempt is behind any more, against the hashes of the attempts
+   * that are. Bootstrap first resumes safe partial transfers and fails the rest, then calls this
+   * to remove directories whose attempts no longer have work behind them.
+   *
+   * Safe to call while transfers are running only because anything this process is working on is
+   * held in `progress` and skipped; the caller is still expected to be the boot path.
+   */
+  async reapStaging(liveHashes: ReadonlySet<string>): Promise<number> {
+    const entries = await readdir(this.root, { withFileTypes: true }).catch(() => []);
+
+    let reaped = 0;
+    for (const entry of entries) {
+      if (!entry.isDirectory() || liveHashes.has(entry.name) || this.progress.has(entry.name)) continue;
+      await this.discard(entry.name, join(this.root, entry.name));
+      reaped++;
+    }
+    return reaped;
+  }
+
+  /**
+   * Best-effort: staging that could not be removed is wasted disk, and failing the transfer over
+   * it would replace the reason it actually ended with a filesystem error nobody can act on.
+   */
+  private async discard(hash: string, directory: string): Promise<void> {
+    try {
+      await rm(directory, { recursive: true, force: true });
+    } catch (error: unknown) {
+      const message = error instanceof Error ? error.message : String(error);
+      this.logger.warn(`[direct_download.discard] [fail] hash=${hash} error="${sanitizeLogValue(message)}" - staged download could not be removed`);
+    }
+  }
+
+  /**
+   * A finished transfer is read once and never again, so its entry is only kept long enough for
+   * the poll loop to have seen it. Swept here rather than on a timer because the map is small and
+   * this is the one method anything calls often.
+   */
+  private pruneTerminal(): void {
+    const cutoff = Date.now() - TERMINAL_RETENTION_MS;
+    for (const [hash, entry] of this.progress) {
+      if (entry.terminalAt !== undefined && entry.terminalAt <= cutoff) this.progress.delete(hash);
+    }
+  }
+
+  private async run(
+    downloadId: number,
+    infoHash: string,
+    url: URL,
+    target: string,
+    signal: AbortSignal,
+    offset: number,
+    validator: string | null,
+    expectedBytes: number | null,
+  ): Promise<void> {
+    const response = await this.open(url, signal, offset > 0 ? { Range: `bytes=${offset}-`, 'If-Range': validator as string } : {});
+    const responseMeta = validateDownloadResponse(response, offset, expectedBytes, validator);
+    const totalBytes = responseMeta.totalBytes;
+    if (totalBytes !== null && totalBytes > MAX_FILE_BYTES) {
+      throw new Error(`That file is ${totalBytes} bytes, past the ${MAX_FILE_BYTES} byte limit`);
+    }
+
+    if (responseMeta.alreadyComplete) {
+      await response.body?.cancel().catch(() => {});
+      this.progress.set(infoHash, {
+        state: 'completed',
+        downloadedBytes: offset,
+        totalBytes: offset,
+        contentPath: target,
+        terminalAt: Date.now(),
+      });
+      return;
+    }
+
+    const etag = strongEtag(response.headers.get('etag'));
+    const lastModified = response.headers.get('last-modified')?.trim() || null;
+    await this.downloads.update(downloadId, {
+      directEtag: etag ?? strongEtag(validator),
+      directLastModified: lastModified ?? (validator && strongEtag(validator) === null ? validator : null),
+      totalBytes,
+    });
+
+    // Filename alone says nothing about what a server actually sent, and a courtesy error page
+    // saved as book.epub would go on to fail somewhere much less obvious.
+    const contentType = response.headers.get('content-type') ?? '';
+    if (HTML_CONTENT_TYPE.test(contentType)) throw new Error('That URL answered with a web page rather than a file');
+    if (!response.body) throw new Error('That URL answered with an empty body');
+
+    let downloaded = offset;
+    let lastChunkAt = Date.now();
+    const body = response.body;
+    const reader = body.getReader();
+
+    /**
+     * Idle rather than total. A budget that scaled with the file size still assumed a floor on
+     * throughput - the previous one worked out at about 1 MB/s, so a 239 MB audiobook needed
+     * 5.4 Mbit/s - and it spent six minutes downloading before deciding the line was too slow.
+     * A slow transfer is not a failed one. What tells the two apart is whether bytes are still
+     * arriving, so that is what is measured, and the size of the file stops mattering.
+     */
+    const stalled = new AbortController();
+    const stallMessage = `That download sent nothing for ${IDLE_TIMEOUT_MS}ms`;
+    const watchdog = setInterval(() => {
+      if (Date.now() - lastChunkAt > IDLE_TIMEOUT_MS) stalled.abort(new Error(stallMessage));
+    }, IDLE_CHECK_MS);
+    watchdog.unref?.();
+
+    /**
+     * One signal for the whole transfer, and the reader is cancelled from it rather than from the
+     * caller's alone. A stalled read is exactly the case where nothing else can end it: the
+     * generator sits inside `reader.read()` waiting for bytes that never come, so aborting the
+     * pipeline cannot tear it down and the download hangs instead of failing.
+     */
+    const ceiling = AbortSignal.timeout(MAX_TRANSFER_MS);
+    const transfer = AbortSignal.any([signal, stalled.signal, ceiling]);
+    const cancelReader = () => {
+      void reader.cancel(transfer.reason).catch(() => {});
+    };
+    transfer.addEventListener('abort', cancelReader, { once: true });
+    const onProgress = (bytes: number) => {
+      const current = this.progress.get(infoHash);
+      if (current) this.progress.set(infoHash, { ...current, downloadedBytes: bytes, totalBytes });
+    };
+
+    // Counted as it streams rather than buffered: an audiobook is gigabytes, and the point of
+    // the cap is that we stop at it rather than discovering it after holding the whole file.
+    const counted = async function* () {
+      try {
+        while (true) {
+          const { done, value: chunk } = await reader.read();
+          if (done) return;
+          downloaded += chunk.byteLength;
+          lastChunkAt = Date.now();
+          if (downloaded > MAX_FILE_BYTES) throw new Error(`That file went past the ${MAX_FILE_BYTES} byte limit while downloading`);
+          onProgress(downloaded);
+          yield chunk;
+        }
+      } finally {
+        transfer.removeEventListener('abort', cancelReader);
+        reader.releaseLock();
+      }
+    };
+
+    try {
+      await pipeline(Readable.from(counted()), createWriteStream(target, { flags: offset > 0 ? 'a' : 'w' }), { signal: transfer });
+    } catch (error) {
+      // `pipeline` rejects with a bare "The operation was aborted" rather than the reason it was
+      // given, which is what put that sentence in the operator's log in place of the cause.
+      if (stalled.signal.aborted) throw new Error(stallMessage, { cause: error });
+      if (ceiling.aborted) throw new Error(`That download was still running after ${MAX_TRANSFER_MS}ms`, { cause: error });
+      throw error;
+    } finally {
+      clearInterval(watchdog);
+    }
+
+    if (downloaded === offset) throw new Error('That URL answered with an empty file');
+    if (totalBytes !== null && downloaded !== totalBytes) {
+      throw new Error(`That source ended after ${downloaded} of ${totalBytes} bytes`);
+    }
+    this.progress.set(infoHash, {
+      state: 'completed',
+      downloadedBytes: downloaded,
+      totalBytes: totalBytes ?? downloaded,
+      contentPath: target,
+      terminalAt: Date.now(),
+    });
+    this.logger.log(`[direct_download.fetch] [end] hash=${infoHash} bytes=${downloaded} - direct download finished`);
+  }
+
+  /**
+   * Redirects are followed by hand so every hop is checked: `redirect: 'follow'` would let a
+   * first-hop redirect to a private address through, which is the whole point of the check.
+   *
+   * Every hop that is not the one being returned has its body cancelled. A redirect usually
+   * carries a short courtesy page, but nothing obliges it to, and an undrained body holds its
+   * socket open until the agent times it out: five hops through a chain of mirrors would otherwise
+   * leave five sockets and five buffers behind per grab.
+   */
+  private async open(url: URL, signal: AbortSignal, headers: Record<string, string> = {}): Promise<Response> {
+    let current = url;
+    for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
+      const response = await this.openHop(current, signal, headers);
+
+      if (response.status >= 300 && response.status < 400) {
+        const location = response.headers.get('location');
+        await response.body?.cancel().catch(() => {});
+        if (!location) throw new Error(`That URL answered ${response.status} without saying where to go`);
+        current = await ensureSafeUrl(new URL(location, current).href, { allowPrivate: ALLOW_PRIVATE });
+
+        continue;
+      }
+
+      if (!response.ok && response.status !== 416) {
+        await response.body?.cancel().catch(() => {});
+        throw new Error(`That URL answered ${response.status}`);
+      }
+      return response;
+    }
+    throw new Error(`That URL redirected more than ${MAX_REDIRECTS} times`);
+  }
+
+  /**
+   * One hop, with a deadline that covers reaching the server and getting its headers back and is
+   * dropped the moment they arrive.
+   *
+   * `AbortSignal.timeout` cannot express that. The signal it returns stays attached to the
+   * response body, so a connect deadline set here goes on to abort a download that is streaming
+   * perfectly well: a 239 MB LibriVox zip arrives at about 6 MB/s and needs 39 seconds, and every
+   * one of them died at exactly 30 with three quarters of the file already written. Gutenberg's
+   * one-megabyte EPUBs finish long before the deadline, which is why it took an audiobook to show.
+   *
+   * The body is not left unbounded: `run` holds it to an idle timeout and a total ceiling.
+   */
+  private async openHop(url: URL, signal: AbortSignal, headers: Record<string, string>): Promise<Response> {
+    const connect = new AbortController();
+    const deadline = setTimeout(() => connect.abort(new Error(`That URL did not answer within ${CONNECT_TIMEOUT_MS}ms`)), CONNECT_TIMEOUT_MS);
+    try {
+      return await safeFetch(
+        url.href,
+        {
+          redirect: 'manual',
+          signal: AbortSignal.any([signal, connect.signal]),
+          headers: { Accept: '*/*', 'User-Agent': USER_AGENT, ...headers },
+        },
+        // Pinned, because the URL came from an indexer or a plugin rather than from an operator:
+        // this is exactly the caller the resolve-twice window in `safeFetch` is not acceptable
+        // for, so the address that passed policy is the address the socket opens to.
+        { allowPrivate: ALLOW_PRIVATE, profile: null, pinResolvedAddress: true },
+      );
+    } finally {
+      clearTimeout(deadline);
+    }
+  }
+}
+
+interface ValidatedDownloadResponse {
+  totalBytes: number | null;
+  alreadyComplete: boolean;
+}
+
+function validateDownloadResponse(
+  response: Response,
+  offset: number,
+  expectedBytes: number | null,
+  validator: string | null,
+): ValidatedDownloadResponse {
+  if (offset === 0) {
+    if (response.status !== 200) throw new Error(`That URL answered ${response.status} to a new download`);
+    const declared = Number(response.headers.get('content-length'));
+    return { totalBytes: Number.isFinite(declared) && declared > 0 ? declared : null, alreadyComplete: false };
+  }
+
+  if (!validator) throw new Error('That partial download has no HTTP validator and cannot be resumed safely');
+
+  if (response.status === 416) {
+    const total = parseUnsatisfiedRange(response.headers.get('content-range'));
+    if (total !== offset || (expectedBytes !== null && expectedBytes !== total)) {
+      throw new Error('That source no longer agrees with the saved partial download');
+    }
+    return { totalBytes: total, alreadyComplete: true };
+  }
+
+  if (response.status !== 206) {
+    throw new Error('That source does not support resuming this partial download safely');
+  }
+
+  const range = parseContentRange(response.headers.get('content-range'));
+  if (range.start !== offset || range.end < range.start) {
+    throw new Error('That source resumed from a different byte than BookOrbit requested');
+  }
+  if (expectedBytes !== null && range.total !== expectedBytes) {
+    throw new Error('That source changed size since this download started');
+  }
+  return { totalBytes: range.total, alreadyComplete: false };
+}
+
+function parseContentRange(value: string | null): { start: number; end: number; total: number } {
+  const match = /^bytes (\d+)-(\d+)\/(\d+)$/.exec(value?.trim() ?? '');
+  if (!match) throw new Error('That source returned an invalid Content-Range while resuming');
+  const start = Number(match[1]);
+  const end = Number(match[2]);
+  const total = Number(match[3]);
+  if (![start, end, total].every(Number.isSafeInteger) || total <= 0 || end >= total) {
+    throw new Error('That source returned an invalid Content-Range while resuming');
+  }
+  return { start, end, total };
+}
+
+function parseUnsatisfiedRange(value: string | null): number {
+  const match = /^bytes \*\/(\d+)$/.exec(value?.trim() ?? '');
+  const total = Number(match?.[1]);
+  if (!Number.isSafeInteger(total) || total <= 0) throw new Error('That source returned an invalid range response');
+  return total;
+}
+
+function strongEtag(value: string | null): string | null {
+  const normalized = value?.trim();
+  return normalized && /^"[\s\S]*"$/.test(normalized) ? normalized : null;
+}
+
+function resumeValidator(etag: string | null, lastModified: string | null): string | null {
+  return strongEtag(etag) ?? (lastModified?.trim() || null);
+}
+
+/**
+ * The filename comes from an external source, so it is reduced to a bare name and the result is
+ * checked to still sit under the directory we made for it.
+ */
+function safeJoin(directory: string, fileName: string): string {
+  const bare = fileName.replace(/[\\/]/g, '_').replace(/^\.+/, '').trim();
+  const target = resolve(directory, bare || 'download.bin');
+  if (target !== directory && !target.startsWith(directory + sep)) {
+    throw new Error('That release names a file that would land outside the download directory');
+  }
+  return target;
+}
diff --git a/server/src/modules/book-request/fulfillment/download-monitor.service.test.ts b/server/src/modules/book-request/fulfillment/download-monitor.service.test.ts
new file mode 100644
index 000000000..cd577d659
--- /dev/null
+++ b/server/src/modules/book-request/fulfillment/download-monitor.service.test.ts
@@ -0,0 +1,546 @@
+import { ACTIVE_BOOK_REQUEST_DOWNLOAD_STATUSES } from '@bookorbit/types';
+
+import type { BookRequestDownloadRow } from '../../../db/schema';
+import type { DownloadStatus } from '../download-clients/download-client-adapter';
+import { DownloadMonitorService } from './download-monitor.service';
+
+const HASH_A = 'a'.repeat(40);
+const HASH_B = 'b'.repeat(40);
+
+function row(overrides: Partial<BookRequestDownloadRow> = {}): BookRequestDownloadRow {
+  return {
+    id: 11,
+    requestId: 7,
+    downloadClientId: 4,
+    clientHash: HASH_A,
+    status: 'downloading',
+    progressPercent: 10,
+    downloadedBytes: 100,
+    totalBytes: 1000,
+    contentPath: null,
+    bookDockFileId: null,
+    completedAt: null,
+    grabbedAt: new Date(Date.now() - 10 * 60 * 1000),
+    createdAt: new Date(Date.now() - 10 * 60 * 1000),
+    ...overrides,
+  } as BookRequestDownloadRow;
+}
+
+function status(overrides: Partial<DownloadStatus> = {}): DownloadStatus {
+  return {
+    infoHash: HASH_A,
+    state: 'downloading',
+    progressPercent: 50,
+    downloadedBytes: 500,
+    totalBytes: 1000,
+    contentPath: '/downloads/dune.epub',
+    ...overrides,
+  };
+}
+
+function makeService(
+  options: {
+    active?: BookRequestDownloadRow[];
+    statuses?: DownloadStatus[];
+    statusError?: Error;
+    awaitingImport?: BookRequestDownloadRow[];
+    /** The attempt left the active set between the read and the write, so every write is refused. */
+    attemptSettled?: boolean;
+  } = {},
+) {
+  // The import runs off the tick now, so it re-reads the attempt rather than working from the row
+  // the poll saw. Kept as a store so a write is visible to the read that follows it.
+  const stored = new Map<number, BookRequestDownloadRow>(
+    [...(options.active ?? [row()]), ...(options.awaitingImport ?? [])].map((stored) => [stored.id, stored]),
+  );
+  function write(id: number, patch: Record<string, unknown>): BookRequestDownloadRow {
+    const next = row({ ...stored.get(id), id, ...patch });
+    stored.set(id, next);
+    return next;
+  }
+
+  const downloads = {
+    findActive: vi.fn().mockResolvedValue(options.active ?? [row()]),
+    findCompletedAwaitingImport: vi.fn().mockResolvedValue(options.awaitingImport ?? []),
+    findById: vi.fn().mockImplementation((id: number) => Promise.resolve(stored.get(id))),
+    update: vi.fn().mockImplementation((id: number, patch: Record<string, unknown>) => Promise.resolve(write(id, patch))),
+    updateIf: vi
+      .fn()
+      .mockImplementation((id: number, _expected: unknown, patch: Record<string, unknown>) =>
+        Promise.resolve(options.attemptSettled ? undefined : write(id, patch)),
+      ),
+    touch: vi.fn().mockResolvedValue(0),
+  };
+  const requests = {
+    update: vi.fn().mockResolvedValue(undefined),
+    updateIf: vi.fn().mockResolvedValue(undefined),
+    findRequestViewerIds: vi.fn().mockImplementation((ids: number[]) => Promise.resolve(new Map(ids.map((id) => [id, [id * 100]])))),
+  };
+  const clients = { resolveConfig: vi.fn().mockResolvedValue({ id: 4, adapterType: 'qbittorrent' }) };
+  const adapter = {
+    status: options.statusError ? vi.fn().mockRejectedValue(options.statusError) : vi.fn().mockResolvedValue(options.statuses ?? [status()]),
+  };
+  const registry = { require: vi.fn().mockReturnValue(adapter) };
+  const direct = {
+    status: options.statusError ? vi.fn().mockRejectedValue(options.statusError) : vi.fn().mockResolvedValue(options.statuses ?? [status()]),
+  };
+  const imports = { importDownload: vi.fn().mockResolvedValue(true) };
+  const fulfillment = { failDownload: vi.fn().mockResolvedValue(undefined) };
+  const gateway = { emitProgress: vi.fn(), emitChanged: vi.fn() };
+
+  const service = new DownloadMonitorService(
+    downloads as never,
+    requests as never,
+    clients as never,
+    registry as never,
+    direct as never,
+    imports as never,
+    fulfillment as never,
+    gateway as never,
+  );
+
+  return { service, downloads, requests, clients, adapter, direct, imports, fulfillment, gateway };
+}
+
+/**
+ * A tick dispatches its polls rather than awaiting them, so one unreachable client cannot hold up
+ * every other download's progress. A test asserting on what a poll wrote has to wait for it.
+ */
+async function polled(service: DownloadMonitorService): Promise<void> {
+  await service.tick();
+  await service.whenPollsSettle();
+}
+
+/** The imports are off the tick, so a test that asserts on one has to wait for the queue. */
+function importQueue(service: DownloadMonitorService): { waitForIdle(): Promise<void> } {
+  return (service as unknown as { importQueue: { waitForIdle(): Promise<void> } }).importQueue;
+}
+
+/** Long enough for a queued handler to reach its first await, and no longer. */
+function flush(): Promise<void> {
+  return new Promise((resolve) => setImmediate(resolve));
+}
+
+describe('DownloadMonitorService.tick', () => {
+  it('makes no HTTP call at all when nothing is in flight', async () => {
+    const { service, clients, adapter } = makeService({ active: [] });
+    await polled(service);
+    expect(clients.resolveConfig).not.toHaveBeenCalled();
+    expect(adapter.status).not.toHaveBeenCalled();
+  });
+
+  it('batches every hash for one client into a single call', async () => {
+    const { service, adapter } = makeService({
+      active: [row(), row({ id: 12, clientHash: HASH_B })],
+      statuses: [status(), status({ infoHash: HASH_B })],
+    });
+
+    await polled(service);
+
+    expect(adapter.status).toHaveBeenCalledTimes(1);
+    expect(adapter.status).toHaveBeenCalledWith([HASH_A, HASH_B], expect.anything());
+  });
+
+  it('reports direct HTTP progress on consecutive one-second ticks', async () => {
+    const { service, direct, adapter } = makeService({ active: [row({ source: 'direct_url', downloadClientId: null })] });
+    const now = vi.spyOn(Date, 'now');
+    now.mockReturnValue(10_000);
+
+    await polled(service);
+    now.mockReturnValue(11_000);
+    await polled(service);
+
+    expect(direct.status).toHaveBeenCalledTimes(2);
+    // A direct file has no client row, so nothing is asked of a download client on its behalf.
+    expect(adapter.status).not.toHaveBeenCalled();
+    now.mockRestore();
+  });
+
+  it('does not increase torrent-client polling beyond once per five seconds', async () => {
+    const { service, adapter } = makeService({ active: [row({ source: 'torrent_file' })] });
+    const now = vi.spyOn(Date, 'now');
+    now.mockReturnValue(30_000);
+
+    await polled(service);
+    // Three seconds later is still inside the window, five seconds later is not.
+    now.mockReturnValue(33_000);
+    await polled(service);
+    now.mockReturnValue(35_000);
+    await polled(service);
+
+    expect(adapter.status).toHaveBeenCalledTimes(2);
+    now.mockRestore();
+  });
+
+  it('records progress and pushes it to the gateway', async () => {
+    const { service, downloads, gateway } = makeService();
+    await polled(service);
+
+    expect(downloads.updateIf).toHaveBeenCalledWith(
+      11,
+      ACTIVE_BOOK_REQUEST_DOWNLOAD_STATUSES,
+      expect.objectContaining({ status: 'downloading', progressPercent: 50, downloadedBytes: 500, contentPath: '/downloads/dune.epub' }),
+    );
+    expect(gateway.emitProgress).toHaveBeenCalledWith(expect.objectContaining({ requestId: 7, downloadId: 11, progressPercent: 50 }), [700]);
+  });
+
+  it('stamps lastProgressAt only when bytes actually moved, which is what the watchdog reads', async () => {
+    const stalled = makeService({ statuses: [status({ downloadedBytes: 100 })] });
+    await polled(stalled.service);
+    expect(stalled.downloads.updateIf.mock.calls[0][2]).not.toHaveProperty('lastProgressAt');
+
+    const moving = makeService();
+    await polled(moving.service);
+    expect(moving.downloads.updateIf.mock.calls[0][2]).toHaveProperty('lastProgressAt');
+  });
+
+  it('moves the request to downloading once the client stops queueing it', async () => {
+    const { service, requests } = makeService({ active: [row({ status: 'queued' })] });
+    await polled(service);
+    expect(requests.updateIf).toHaveBeenCalledWith(7, expect.arrayContaining(['grabbed']), { status: 'downloading' });
+  });
+
+  it('hands a completed download to the importer', async () => {
+    const { service, imports, downloads } = makeService({ statuses: [status({ state: 'completed', progressPercent: 100, downloadedBytes: 1000 })] });
+
+    await polled(service);
+    await importQueue(service).waitForIdle();
+
+    expect(downloads.updateIf).toHaveBeenCalledWith(
+      11,
+      ACTIVE_BOOK_REQUEST_DOWNLOAD_STATUSES,
+      expect.objectContaining({ status: 'completed', completedAt: expect.any(Date) }),
+    );
+    expect(imports.importDownload).toHaveBeenCalledTimes(1);
+  });
+
+  it('drops direct-download resume credentials once the transfer completes', async () => {
+    const { service, downloads } = makeService({
+      active: [row({ source: 'direct_url', downloadClientId: null })],
+      statuses: [status({ state: 'completed', progressPercent: 100, downloadedBytes: 1000 })],
+    });
+
+    await polled(service);
+
+    expect(downloads.updateIf).toHaveBeenCalledWith(
+      11,
+      ACTIVE_BOOK_REQUEST_DOWNLOAD_STATUSES,
+      expect.objectContaining({ directUrl: null, directEtag: null, directLastModified: null }),
+    );
+  });
+
+  /**
+   * A client poll can take twenty seconds to answer, and a cancellation landing inside that window
+   * has already taken the attempt out of the active set. Writing the stale answer back would
+   * return the request to `downloading` and, on a completed transfer, carry it into an import.
+   */
+  describe('a cancellation that lands while a poll is in flight', () => {
+    it('drops the stale progress write rather than reviving the attempt', async () => {
+      const { service, requests, gateway } = makeService({ active: [row({ status: 'queued' })], attemptSettled: true });
+
+      await polled(service);
+
+      expect(requests.updateIf).not.toHaveBeenCalled();
+      expect(gateway.emitProgress).not.toHaveBeenCalled();
+    });
+
+    it('does not import a transfer the client reports as finished', async () => {
+      const { service, imports } = makeService({
+        statuses: [status({ state: 'completed', progressPercent: 100, downloadedBytes: 1000 })],
+        attemptSettled: true,
+      });
+
+      await polled(service);
+      await importQueue(service).waitForIdle();
+
+      expect(imports.importDownload).not.toHaveBeenCalled();
+    });
+  });
+
+  it('fails a download the client reports as errored', async () => {
+    const { service, fulfillment, imports } = makeService({ statuses: [status({ state: 'failed', errorMessage: 'missing files' })] });
+
+    await polled(service);
+
+    expect(fulfillment.failDownload).toHaveBeenCalledWith(expect.objectContaining({ id: 11 }), 'missing files');
+    expect(imports.importDownload).not.toHaveBeenCalled();
+  });
+
+  /**
+   * A client that is down, misconfigured or restarting must not fail every download it holds.
+   * That is the watchdog's job, on a much longer clock.
+   */
+  it('leaves downloads alone when the client cannot be reached', async () => {
+    const { service, fulfillment, downloads } = makeService({ statusError: new Error('ECONNREFUSED') });
+
+    await expect(service.tick()).resolves.toBeUndefined();
+
+    expect(fulfillment.failDownload).not.toHaveBeenCalled();
+    expect(downloads.updateIf).not.toHaveBeenCalled();
+  });
+
+  it('gives a just-grabbed torrent time to appear before calling it missing', async () => {
+    const { service, fulfillment } = makeService({ active: [row({ grabbedAt: new Date() })], statuses: [] });
+    await polled(service);
+    expect(fulfillment.failDownload).not.toHaveBeenCalled();
+  });
+
+  it('fails a torrent the client has forgotten once the grace period is over', async () => {
+    const { service, fulfillment } = makeService({ active: [row({ grabbedAt: new Date(Date.now() - 5 * 60 * 1000) })], statuses: [] });
+    await polled(service);
+    expect(fulfillment.failDownload).toHaveBeenCalledWith(expect.objectContaining({ id: 11 }), expect.stringContaining('no longer has this torrent'));
+  });
+
+  /**
+   * A client that has not started the torrent yet is not the same as one that is transferring,
+   * and a card that says "downloading" at 0% for an hour is how a stalled queue looks like a bug.
+   */
+  it('keeps a queued torrent queued rather than calling it downloading', async () => {
+    const { service, downloads, gateway } = makeService({
+      active: [row({ status: 'queued', downloadedBytes: 0, progressPercent: 0 })],
+      statuses: [status({ state: 'queued', progressPercent: 0, downloadedBytes: 0 })],
+    });
+
+    await polled(service);
+
+    expect(downloads.updateIf).toHaveBeenCalledWith(11, ACTIVE_BOOK_REQUEST_DOWNLOAD_STATUSES, expect.objectContaining({ status: 'queued' }));
+    expect(gateway.emitProgress).toHaveBeenCalledWith(expect.objectContaining({ status: 'queued' }), [700]);
+  });
+
+  /** A state this adapter has no mapping for is in-flight, not idle. */
+  it('treats an unmapped client state as downloading', async () => {
+    const { service, downloads } = makeService({ statuses: [status({ state: 'unknown' })] });
+    await polled(service);
+    expect(downloads.updateIf).toHaveBeenCalledWith(11, ACTIVE_BOOK_REQUEST_DOWNLOAD_STATUSES, expect.objectContaining({ status: 'downloading' }));
+  });
+
+  /**
+   * The bytes are already on disk; nothing else would ever look at this row again, because the
+   * poll query stops at `downloading` and the watchdog only knows how to fail it.
+   */
+  it('resumes a completed download whose import never ran', async () => {
+    const stranded = row({ id: 21, status: 'completed', bookDockFileId: null });
+    const { service, imports } = makeService({ active: [], awaitingImport: [stranded] });
+
+    await polled(service);
+    await importQueue(service).waitForIdle();
+
+    expect(imports.importDownload).toHaveBeenCalledWith(stranded);
+  });
+
+  /**
+   * Extracting a release takes minutes and the tick is a process-wide critical section, so an
+   * import awaited inside it stops progress polling and completion handling for everything else.
+   */
+  describe('an import that takes minutes', () => {
+    function makeBlockedImport(context: ReturnType<typeof makeService>): () => void {
+      let finish: () => void = () => {};
+      context.imports.importDownload.mockReturnValue(
+        new Promise<boolean>((resolve) => {
+          finish = () => resolve(true);
+        }),
+      );
+      return finish;
+    }
+
+    it('does not hold the poll loop while it runs', async () => {
+      const now = vi.spyOn(Date, 'now');
+      now.mockReturnValue(60_000);
+      const context = makeService({ statuses: [status({ state: 'completed', progressPercent: 100, downloadedBytes: 1000 })] });
+      const finishImport = makeBlockedImport(context);
+
+      await polled(context.service);
+      await flush();
+      expect(context.imports.importDownload).toHaveBeenCalledTimes(1);
+
+      // A second transfer reports five seconds later, with the first import still running.
+      context.downloads.findActive.mockResolvedValue([row({ id: 12, clientHash: HASH_B })]);
+      context.adapter.status.mockResolvedValue([status({ infoHash: HASH_B, progressPercent: 40, downloadedBytes: 400 })]);
+      now.mockReturnValue(66_000);
+      await polled(context.service);
+
+      expect(context.gateway.emitProgress).toHaveBeenCalledWith(expect.objectContaining({ downloadId: 12, progressPercent: 40 }), expect.any(Array));
+      finishImport();
+      await importQueue(context.service).waitForIdle();
+      now.mockRestore();
+    });
+
+    /** The row stays `completed` until the extraction is done, so the sweep keeps finding it. */
+    it('is not started a second time by the resume sweep that keeps finding it', async () => {
+      const now = vi.spyOn(Date, 'now');
+      now.mockReturnValue(100_000);
+      const context = makeService({ active: [], awaitingImport: [row({ id: 21, status: 'completed', bookDockFileId: null })] });
+      const finishImport = makeBlockedImport(context);
+
+      await polled(context.service);
+      await flush();
+      now.mockReturnValue(120_000);
+      await polled(context.service);
+      await flush();
+
+      expect(context.imports.importDownload).toHaveBeenCalledTimes(1);
+      finishImport();
+      await importQueue(context.service).waitForIdle();
+      now.mockRestore();
+    });
+  });
+
+  /** Queued behind another import for as long as that one takes, which is long enough to matter. */
+  it('drops an import whose attempt was settled while it waited', async () => {
+    const { service, imports, downloads } = makeService({ active: [], awaitingImport: [row({ id: 21, status: 'completed', bookDockFileId: null })] });
+    downloads.findById.mockResolvedValue(row({ id: 21, status: 'failed' }));
+
+    await polled(service);
+    await importQueue(service).waitForIdle();
+
+    expect(imports.importDownload).not.toHaveBeenCalled();
+  });
+
+  /**
+   * The symptom that made this worth changing: one client on a twenty-second timeout used to hold
+   * the whole tick, so direct transfers - which report once a second - froze along with every
+   * other client's progress and every completion.
+   */
+  describe('one client that will not answer', () => {
+    /** A torrent client whose read never comes back, and a direct transfer alongside it. */
+    function stalledClient() {
+      const context = makeService({
+        active: [row(), row({ id: 12, source: 'direct_url', downloadClientId: null, clientHash: HASH_B })],
+        statuses: [status({ infoHash: HASH_B })],
+      });
+      let release: () => void = () => {};
+      context.adapter.status.mockReturnValue(new Promise<DownloadStatus[]>((resolve) => (release = () => resolve([]))));
+      return { ...context, release };
+    }
+
+    it('reports the other targets while it is still waiting', async () => {
+      const { service, direct, release } = stalledClient();
+
+      await service.tick();
+      await flush();
+
+      expect(direct.status).toHaveBeenCalledTimes(1);
+      release();
+      await service.whenPollsSettle();
+    });
+
+    it('does not queue a second read behind the one still in flight', async () => {
+      const { service, adapter, direct, release } = stalledClient();
+      const now = vi.spyOn(Date, 'now');
+
+      now.mockReturnValue(60_000);
+      await service.tick();
+      await flush();
+      now.mockReturnValue(90_000);
+      await service.tick();
+      await flush();
+
+      expect(adapter.status).toHaveBeenCalledTimes(1);
+      // The direct transfer is polled on both ticks, because nothing of its own is outstanding.
+      expect(direct.status).toHaveBeenCalledTimes(2);
+      release();
+      await service.whenPollsSettle();
+      now.mockRestore();
+    });
+  });
+
+  /**
+   * Direct progress lives in memory, so a restart leaves a transfer nothing can resume. The
+   * service reports it the way a client reports a torrent it does not hold - by leaving it out -
+   * and the reason says so rather than blaming a download client the transfer never used.
+   */
+  it('fails an interrupted direct transfer once its grace period is over', async () => {
+    const { service, fulfillment } = makeService({
+      active: [row({ source: 'direct_url', downloadClientId: null })],
+      statuses: [],
+    });
+
+    await polled(service);
+
+    expect(fulfillment.failDownload).toHaveBeenCalledWith(expect.objectContaining({ id: 11 }), expect.stringContaining('cannot be resumed'));
+  });
+
+  /**
+   * Import concurrency is one and a queued row receives no writes, so without this the watchdog
+   * ages a perfectly healthy import past its hour on queue depth alone.
+   */
+  it('tells the database that queued and running imports are still being worked on', async () => {
+    const now = vi.spyOn(Date, 'now');
+    now.mockReturnValue(500_000);
+    const context = makeService({ active: [], awaitingImport: [row({ id: 21, status: 'completed', bookDockFileId: null })] });
+    let finishImport: () => void = () => {};
+    context.imports.importDownload.mockReturnValue(new Promise<boolean>((resolve) => (finishImport = () => resolve(true))));
+
+    await polled(context.service);
+    await flush();
+    // A minute on, with the import still running and nothing else having written to its row.
+    now.mockReturnValue(600_000);
+    await polled(context.service);
+
+    expect(context.downloads.touch).toHaveBeenCalledWith([21]);
+    finishImport();
+    await importQueue(context.service).waitForIdle();
+    now.mockRestore();
+  });
+
+  it('does not start a second pass while one is still running', async () => {
+    const { service, downloads } = makeService();
+    // Resolved up front rather than from inside the mock: the tick reaches `findActive` several
+    // microtasks in, and a release wired on the call itself would fire before the call exists.
+    let release: () => void = () => {};
+    const blocked = new Promise<BookRequestDownloadRow[]>((resolve) => {
+      release = () => resolve([]);
+    });
+    downloads.findActive.mockReturnValue(blocked);
+
+    const first = service.tick();
+    await service.tick();
+    release();
+    await first;
+
+    expect(downloads.findActive).toHaveBeenCalledTimes(1);
+  });
+  /**
+   * qBittorrent has no error state for a refused announce, so the torrent reads as an ordinary
+   * stalled download. Without this the only symptom is a request that never starts and then fails
+   * twelve hours later saying nothing about why.
+   */
+  describe('a tracker that refuses the announce', () => {
+    const REFUSED = 'Unrecognized host/PassKey. (97.117.96.134)';
+
+    it("fails the download with the tracker's own message", async () => {
+      const { service, fulfillment } = makeService({
+        statuses: [status({ downloadedBytes: 0, progressPercent: 0, trackerError: REFUSED })],
+      });
+
+      await polled(service);
+
+      expect(fulfillment.failDownload).toHaveBeenCalledWith(expect.objectContaining({ id: 11 }), expect.stringContaining(REFUSED));
+    });
+
+    /** A tracker restart looks identical for the first few seconds, and costs nobody a download. */
+    it('gives a freshly grabbed torrent a grace window first', async () => {
+      const now = new Date();
+      const { service, fulfillment, downloads } = makeService({
+        active: [row({ grabbedAt: now, createdAt: now })],
+        statuses: [status({ downloadedBytes: 0, progressPercent: 0, trackerError: REFUSED })],
+      });
+
+      await polled(service);
+
+      expect(fulfillment.failDownload).not.toHaveBeenCalled();
+      expect(downloads.updateIf).toHaveBeenCalled();
+    });
+
+    /** Multi-tracker torrents download fine on one working tracker while another shouts. */
+    it('leaves a torrent alone once bytes are actually arriving', async () => {
+      const { service, fulfillment } = makeService({
+        statuses: [status({ downloadedBytes: 4096, trackerError: REFUSED })],
+      });
+
+      await polled(service);
+
+      expect(fulfillment.failDownload).not.toHaveBeenCalled();
+    });
+  });
+});
diff --git a/server/src/modules/book-request/fulfillment/download-monitor.service.ts b/server/src/modules/book-request/fulfillment/download-monitor.service.ts
new file mode 100644
index 000000000..f8a9f8ef1
--- /dev/null
+++ b/server/src/modules/book-request/fulfillment/download-monitor.service.ts
@@ -0,0 +1,350 @@
+import { Injectable, Logger, OnModuleDestroy } from '@nestjs/common';
+import { Cron } from '@nestjs/schedule';
+import { ACTIVE_BOOK_REQUEST_DOWNLOAD_STATUSES } from '@bookorbit/types';
+import type { BookRequestDownloadStatus, BookRequestStatus } from '@bookorbit/types';
+
+import { sanitizeLogValue } from '../../../common/utils/log-sanitize.utils';
+import type { BookRequestDownloadRow } from '../../../db/schema';
+import { BookRequestGateway } from '../book-request.gateway';
+import { BookRequestRepository } from '../book-request.repository';
+import { DownloadClientConfigService } from '../download-clients/download-client-config.service';
+import { DownloadClientRegistry } from '../download-clients/download-client-registry';
+import type { DownloadStatus } from '../download-clients/download-client-adapter';
+import { BookRequestDownloadRepository } from './book-request-download.repository';
+import { DirectDownloadService } from './direct-download.service';
+import { RequestFulfillmentService } from './request-fulfillment.service';
+import { RequestImportQueue } from './request-import-queue';
+
+import { RequestImportService } from './request-import.service';
+
+/**
+ * A torrent the client has never heard of is usually one it has not indexed yet. Only treat it
+ * as gone once it has had time to appear.
+ */
+const MISSING_TORRENT_GRACE_MS = 2 * 60 * 1000;
+
+/**
+ * A tracker that is briefly down is indistinguishable from one that is refusing us, and only the
+ * second is worth failing a request over. Short enough to beat the watchdog's twelve hours by a
+ * wide margin, long enough that a tracker restart does not cost anybody their download.
+ */
+const TRACKER_ERROR_GRACE_MS = 5 * 60 * 1000;
+const DIRECT_PROGRESS_INTERVAL_MS = 1_000;
+const TORRENT_PROGRESS_INTERVAL_MS = 5_000;
+/**
+ * The resume sweep is a scan for downloads nothing else will look at again, not a progress read,
+ * so it keeps its own slower cadence rather than following the poll interval down.
+ */
+const RESUME_SWEEP_INTERVAL_MS = 15_000;
+
+/**
+ * How often the queue tells the database that its members are still being worked on.
+ *
+ * Comfortably inside the watchdog's one-hour import timeout, and cheap: one statement per minute
+ * touching however many downloads are queued or extracting, which is at most a handful.
+ */
+const IMPORT_HEARTBEAT_INTERVAL_MS = 60_000;
+
+/**
+ * One import at a time, which is what the tick already did by awaiting them. Two large extractions
+ * competing for the same disk finish no sooner than one after the other, and the point of the
+ * queue is to get them off the poll loop rather than to run more of them at once.
+ */
+const IMPORT_CONCURRENCY = 1;
+
+/**
+ * The request states a live transfer may move to `downloading` from. Narrow on purpose: anything
+ * else has either not been grabbed yet or has already moved past the transfer, and a poll that
+ * started before a person settled the request must not drag it back.
+ */
+const DOWNLOADING_FROM: readonly BookRequestStatus[] = ['grabbed', 'downloading'];
+
+/** A client id, or the built-in downloader, which has no id because it has no row. */
+const DIRECT = 'direct' as const;
+type PollTarget = number | typeof DIRECT;
+
+@Injectable()
+export class DownloadMonitorService implements OnModuleDestroy {
+  private readonly logger = new Logger(DownloadMonitorService.name);
+  private running = false;
+  private lastResumeAt = 0;
+  private lastHeartbeatAt = 0;
+  private readonly lastClientPollAt = new Map<PollTarget, number>();
+  /** Targets whose previous poll has not come back yet, so a slow one is skipped rather than queued. */
+  private readonly pollsInFlight = new Map<PollTarget, Promise<void>>();
+  private readonly importQueue = new RequestImportQueue(
+    IMPORT_CONCURRENCY,
+    (downloadId) => this.runImport(downloadId),
+    (downloadId, error) => this.logImportFailure(downloadId, error),
+  );
+
+  constructor(
+    private readonly downloads: BookRequestDownloadRepository,
+    private readonly requests: BookRequestRepository,
+    private readonly clients: DownloadClientConfigService,
+    private readonly registry: DownloadClientRegistry,
+    private readonly direct: DirectDownloadService,
+    private readonly imports: RequestImportService,
+    private readonly fulfillment: RequestFulfillmentService,
+    private readonly gateway: BookRequestGateway,
+  ) {}
+
+  onModuleDestroy(): void {
+    this.importQueue.stop();
+  }
+
+  /** Direct transfers report once a second; external torrent clients are polled every five. */
+  @Cron('* * * * * *')
+  async tick(): Promise<void> {
+    if (this.running) return;
+    this.running = true;
+    try {
+      await this.poll();
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      this.logger.warn(`[book_request.monitor] [fail] error="${sanitizeLogValue(message)}" - download poll tick failed`);
+    } finally {
+      this.running = false;
+    }
+  }
+
+  private async poll(): Promise<void> {
+    const now = Date.now();
+    if (now - this.lastResumeAt >= RESUME_SWEEP_INTERVAL_MS) {
+      this.lastResumeAt = now;
+      await this.resumeUnimported();
+    }
+
+    if (now - this.lastHeartbeatAt >= IMPORT_HEARTBEAT_INTERVAL_MS) {
+      this.lastHeartbeatAt = now;
+      await this.heartbeatImports();
+    }
+
+    const active = await this.downloads.findActive();
+    if (active.length === 0) return;
+
+    const byTarget = new Map<PollTarget, BookRequestDownloadRow[]>();
+    for (const row of active) {
+      const target = pollTargetFor(row);
+      if (target === null) continue;
+      const bucket = byTarget.get(target) ?? [];
+
+      bucket.push(row);
+      byTarget.set(target, bucket);
+    }
+
+    for (const [target, rows] of byTarget) {
+      const interval = target === DIRECT ? DIRECT_PROGRESS_INTERVAL_MS : TORRENT_PROGRESS_INTERVAL_MS;
+      const lastPolledAt = this.lastClientPollAt.get(target) ?? 0;
+      if (now - lastPolledAt < interval) continue;
+      // A target that has not answered its previous poll is not one to ask again. One unreachable
+      // client burns a twenty-second timeout per read, and queueing the next read behind it is
+      // what turned one dead client into a monitor that stopped reporting direct-download
+      // progress, other clients' progress and completions along with it.
+      if (this.pollsInFlight.has(target)) continue;
+      this.lastClientPollAt.set(target, now);
+      // Dispatched rather than awaited, for the same reason. The tick's guard covers deciding what
+      // to poll, not waiting on it; `pollsInFlight` is what keeps one target's reads serial.
+      const poll = this.pollTarget(target, rows)
+        .catch((error: unknown) => {
+          const message = error instanceof Error ? error.message : String(error);
+          this.logger.warn(`[book_request.monitor] [fail] clientId=${target} error="${sanitizeLogValue(message)}" - handling a download poll failed`);
+        })
+        .finally(() => this.pollsInFlight.delete(target));
+      this.pollsInFlight.set(target, poll);
+    }
+  }
+
+  /** For tests, which are the only callers that need a dispatched poll to have finished writing. */
+  async whenPollsSettle(): Promise<void> {
+    while (this.pollsInFlight.size > 0) {
+      await Promise.allSettled([...this.pollsInFlight.values()]);
+    }
+  }
+
+  /**
+   * A download that finished but whose import never ran - the process died between the two, or the
+   * import threw before it could claim a Book Dock row. Nothing else would ever look at it again:
+   * `findActive()` stops at `downloading`, so it would sit untouched until the watchdog failed it
+   * an hour later with the bytes already on disk.
+   *
+   * A download stays `completed` for the whole extraction, so this keeps finding the one already
+   * being imported. The queue is what recognises it rather than starting it a second time.
+   */
+  private async resumeUnimported(): Promise<void> {
+    const rows = await this.downloads.findCompletedAwaitingImport();
+    for (const row of rows) {
+      if (!this.importQueue.enqueue(row.id)) continue;
+      this.logger.log(`[book_request.monitor] [start] requestId=${row.requestId} downloadId=${row.id} - resuming an import that never ran`);
+    }
+  }
+
+  /**
+   * Keeps the watchdog off the imports this process is actually working on.
+   *
+   * `findActive()` stops at `downloading`, so nothing else writes to a download once it is queued
+   * for import: with concurrency of one, a row can sit at `completed` for as long as everything
+   * ahead of it takes, and a large extraction writes nothing for its whole run. The watchdog ages
+   * both by `updatedAt` and fails them after an hour, so queue depth alone used to fail healthy
+   * imports and a genuinely slow one was failed while it was still running.
+   */
+  private async heartbeatImports(): Promise<void> {
+    const members = this.importQueue.members();
+    if (members.length === 0) return;
+    const touched = await this.downloads.touch(members);
+    if (touched === 0) return;
+    this.logger.debug(
+      `[book_request.monitor] [end] queued=${members.length} touched=${touched} - kept queued and running imports out of the watchdog`,
+    );
+  }
+
+  /**
+   * Re-read rather than handed the row the poll saw: an import can wait behind another one for as
+   * long as that one takes, and a cancellation or a manual fulfilment landing in between makes the
+   * row that was queued a description of something that is no longer true.
+   */
+  private async runImport(downloadId: number): Promise<void> {
+    const row = await this.downloads.findById(downloadId);
+    if (!row || row.status !== 'completed' || row.bookDockFileId !== null) return;
+    await this.imports.importDownload(row);
+  }
+
+  /**
+   * `importDownload` fails the attempt itself, so anything reaching here threw on the way to doing
+   * that. The watchdog is what settles a download this leaves behind.
+   */
+  private logImportFailure(downloadId: number, error: unknown): void {
+    const message = error instanceof Error ? error.message : String(error);
+    this.logger.error(
+      `[book_request.monitor] [fail] downloadId=${downloadId} errorClass="${sanitizeLogValue(error instanceof Error ? error.name : typeof error)}" error="${sanitizeLogValue(message)}" - import failed outside its own error handling`,
+    );
+  }
+
+  private async pollTarget(target: PollTarget, rows: BookRequestDownloadRow[]): Promise<void> {
+    // A refused attempt is a record of having asked, with nothing handed to anything: there is no
+    // hash to ask about, and it is never in a status this polls for anyway.
+    const polled = rows.filter((row): row is BookRequestDownloadRow & { clientHash: string } => row.clientHash !== null);
+    if (polled.length === 0) return;
+    const hashes = polled.map((row) => row.clientHash);
+
+    let statuses: DownloadStatus[];
+    try {
+      if (target === DIRECT) {
+        statuses = await this.direct.status(hashes);
+      } else {
+        const config = await this.clients.resolveConfig(target);
+        const adapter = this.registry.require(config.adapterType);
+        statuses = await adapter.status(hashes, config);
+      }
+    } catch (error) {
+      // A client that is down, misconfigured or mid-restart must not fail every download it
+      // holds. The watchdog is what eventually gives up on a download that never moves again.
+      const message = error instanceof Error ? error.message : String(error);
+      this.logger.warn(
+        `[book_request.monitor] [fail] clientId=${target} active=${rows.length} error="${sanitizeLogValue(message)}" - could not read download status`,
+      );
+      return;
+    }
+
+    const byHash = new Map(statuses.map((status) => [status.infoHash.toLowerCase(), status]));
+    // Once for the batch rather than once per progress tick: the audience of a tick is the same
+    // set the request list is scoped by, and reading it per download would add a round trip per
+    // active transfer per poll.
+    const viewers = await this.requests.findRequestViewerIds([...new Set(polled.map((row) => row.requestId))]);
+    for (const row of polled) {
+      const status = byHash.get(row.clientHash.toLowerCase());
+      if (!status) {
+        await this.handleMissing(row);
+        continue;
+      }
+      await this.applyStatus(row, status, viewers.get(row.requestId) ?? []);
+    }
+  }
+
+  /**
+   * A hash the target did not report. For a torrent that is usually a client that has not indexed
+   * it yet, so it gets a grace period; for a direct transfer it means startup could not resume it
+   * or the in-process transfer disappeared, so waiting longer cannot make it return.
+   */
+  private async handleMissing(row: BookRequestDownloadRow): Promise<void> {
+    if (!this.olderThan(row, MISSING_TORRENT_GRACE_MS)) return;
+    await this.fulfillment.failDownload(
+      row,
+      row.source === 'direct_url'
+        ? 'The download was interrupted before it finished and cannot be resumed'
+        : 'The download client no longer has this torrent',
+    );
+  }
+
+  private olderThan(row: BookRequestDownloadRow, graceMs: number): boolean {
+    return Date.now() - (row.grabbedAt ?? row.createdAt).getTime() >= graceMs;
+  }
+
+  private async applyStatus(row: BookRequestDownloadRow, status: DownloadStatus, viewerUserIds: readonly number[]): Promise<void> {
+    if (status.state === 'failed') {
+      await this.fulfillment.failDownload(row, status.errorMessage ?? 'The download client reported an error');
+      return;
+    }
+
+    // A refused announce is not a client-level error, so the torrent sits in an ordinary stalled
+    // state that reads as a healthy download. Left alone it would occupy the queue until the
+    // watchdog gave up on it half a day later, with nothing on the request saying why.
+    if (status.trackerError && status.downloadedBytes === 0 && this.olderThan(row, TRACKER_ERROR_GRACE_MS)) {
+      await this.fulfillment.failDownload(row, `The tracker rejected this download: ${status.trackerError}`);
+      return;
+    }
+
+    // `unknown` is a state this adapter has no mapping for, not an idle one: a torrent the client
+    // is working on must not read as queued, so it keeps the in-flight spelling.
+    const nextStatus: BookRequestDownloadStatus = status.state === 'completed' ? 'completed' : status.state === 'queued' ? 'queued' : 'downloading';
+
+    const movedBytes = status.downloadedBytes > row.downloadedBytes;
+    // Conditional on the attempt still being active, because this row was read before a poll that
+    // can take twenty seconds to answer. A cancellation that landed inside that window has already
+    // taken the attempt out of the active set, and writing this back would undo it: the request
+    // would return to `downloading`, and a completed transfer would go on to be imported for a
+    // request nobody wants any more. Nothing is skipped by doing so - the next tick reads a fresh
+    // row, or there is no next tick because the attempt is over.
+    const updated = await this.downloads.updateIf(row.id, ACTIVE_BOOK_REQUEST_DOWNLOAD_STATUSES, {
+      status: nextStatus,
+      progressPercent: status.progressPercent,
+      downloadedBytes: status.downloadedBytes,
+      totalBytes: status.totalBytes,
+      contentPath: status.contentPath ?? row.contentPath,
+      ...(movedBytes ? { lastProgressAt: new Date() } : {}),
+      ...(status.state === 'completed' ? { completedAt: row.completedAt ?? new Date() } : {}),
+      ...(row.source === 'direct_url' && status.state === 'completed' ? { directUrl: null, directEtag: null, directLastModified: null } : {}),
+    });
+    if (!updated) return;
+
+    if (row.status === 'queued' && status.state !== 'queued') {
+      await this.requests.updateIf(row.requestId, DOWNLOADING_FROM, { status: 'downloading' });
+    }
+
+    this.gateway.emitProgress(
+      {
+        requestId: updated.requestId,
+        downloadId: updated.id,
+        status: nextStatus,
+        progressPercent: updated.progressPercent,
+        downloadedBytes: updated.downloadedBytes,
+        totalBytes: updated.totalBytes,
+      },
+      viewerUserIds,
+    );
+
+    // Handed off rather than awaited: extracting a release takes minutes, and this runs inside the
+    // tick's process-wide guard, so awaiting it would stop progress polling for every other
+    // download until it finished.
+    if (status.state === 'completed') this.importQueue.enqueue(updated.id);
+  }
+}
+
+/**
+ * A direct file is ours to report on; anything else belongs to the client it was handed to. Null
+ * is a torrent whose client row has been deleted, which nothing can report on any more: the
+ * watchdog is what eventually gives up on it.
+ */
+function pollTargetFor(row: BookRequestDownloadRow): PollTarget | null {
+  return row.source === 'direct_url' ? DIRECT : row.downloadClientId;
+}
diff --git a/server/src/modules/book-request/fulfillment/download-removal.service.test.ts b/server/src/modules/book-request/fulfillment/download-removal.service.test.ts
new file mode 100644
index 000000000..1e35d16a1
--- /dev/null
+++ b/server/src/modules/book-request/fulfillment/download-removal.service.test.ts
@@ -0,0 +1,142 @@
+import type { BookRequestDownloadRow } from '../../../db/schema';
+import { DownloadRemovalService } from './download-removal.service';
+
+const INFO_HASH = 'c9e15763f722f23e98a29decdfae341b98d53056';
+
+function download(overrides: Partial<BookRequestDownloadRow> = {}): BookRequestDownloadRow {
+  return {
+    id: 11,
+    requestId: 7,
+    downloadClientId: 4,
+    clientHash: INFO_HASH,
+    source: 'torrent_file',
+    status: 'downloading',
+    ...overrides,
+  } as BookRequestDownloadRow;
+}
+
+function makeService(options: { latest?: BookRequestDownloadRow | null; removeError?: Error } = {}) {
+  const row = options.latest === undefined ? download() : options.latest;
+  const downloads = {
+    findLatestForRequests: vi.fn().mockResolvedValue(row ? new Map([[7, { download: row, downloadClientName: 'qbit' }]]) : new Map()),
+    findById: vi.fn().mockResolvedValue(row ?? undefined),
+    update: vi.fn().mockResolvedValue(undefined),
+    updateIf: vi
+      .fn()
+      .mockImplementation((id: number, expected: string[], patch: Record<string, unknown>) =>
+        Promise.resolve(expected.includes(row?.status ?? '') ? { ...row, id, ...patch } : undefined),
+      ),
+  };
+  const clients = { resolveConfig: vi.fn().mockResolvedValue({ id: 4, adapterType: 'qbittorrent' }) };
+  const adapter = {
+    remove: options.removeError ? vi.fn().mockRejectedValue(options.removeError) : vi.fn().mockResolvedValue(undefined),
+  };
+  const registry = { require: vi.fn().mockReturnValue(adapter) };
+  const direct = {
+    remove: options.removeError ? vi.fn().mockRejectedValue(options.removeError) : vi.fn().mockResolvedValue(undefined),
+  };
+
+  const service = new DownloadRemovalService(downloads as never, clients as never, registry as never, direct as never);
+  return { service, downloads, clients, adapter, registry, direct };
+}
+
+describe('DownloadRemovalService.removeLatestForRequest', () => {
+  it('hands the torrent to the client and fails the attempt behind it', async () => {
+    const { service, downloads, adapter } = makeService();
+
+    await expect(service.removeLatestForRequest(7, false, 'ann')).resolves.toEqual({ removed: true, error: null });
+
+    expect(adapter.remove).toHaveBeenCalledWith(INFO_HASH, expect.anything(), { deleteFiles: false });
+    expect(downloads.updateIf).toHaveBeenCalledWith(11, expect.arrayContaining(['downloading']), {
+      status: 'failed',
+      errorMessage: expect.stringContaining('ann'),
+    });
+  });
+
+  it('leaves a finished attempt alone: the book is filed, the seed is not the request', async () => {
+    const { service, downloads } = makeService({ latest: download({ status: 'imported' }) });
+
+    await expect(service.removeLatestForRequest(7, false, 'ann')).resolves.toEqual({ removed: true, error: null });
+
+    // The conditional write is offered and refused, which is what leaves an imported row alone.
+    expect(downloads.updateIf).toHaveBeenCalledWith(11, expect.not.arrayContaining(['imported']), expect.anything());
+  });
+
+  it('deletes partial direct-download staging when a request is cancelled', async () => {
+    const staged = download({ source: 'direct_url', downloadClientId: null });
+    const { service, direct, clients } = makeService({ latest: staged });
+
+    await service.removeLatestForRequest(7, false, 'ann');
+
+    expect(direct.remove).toHaveBeenCalledWith(INFO_HASH, { deleteFiles: true });
+    expect(clients.resolveConfig).not.toHaveBeenCalled();
+  });
+
+  it('reports nothing to remove for a request that was never grabbed', async () => {
+    const { service, adapter } = makeService({ latest: null });
+
+    await expect(service.removeLatestForRequest(7, false, 'ann')).resolves.toEqual({ removed: false, error: null });
+    expect(adapter.remove).not.toHaveBeenCalled();
+  });
+
+  it('reports a torrent the download client no longer owns rather than resolving a config for null', async () => {
+    const { service, clients } = makeService({ latest: download({ source: 'torrent_file', downloadClientId: null }) });
+
+    await expect(service.removeLatestForRequest(7, false, 'ann')).resolves.toEqual({ removed: false, error: null });
+    expect(clients.resolveConfig).not.toHaveBeenCalled();
+  });
+
+  /**
+   * The caller is stopping or deleting the request itself. A client that is down must not be what
+   * keeps a stuck request stuck, so the refusal comes back as a value and the caller decides.
+   */
+  it('carries a client refusal back instead of throwing', async () => {
+    const { service } = makeService({ removeError: new Error('connection refused') });
+
+    await expect(service.removeLatestForRequest(7, false, 'ann')).resolves.toEqual({ removed: false, error: 'connection refused' });
+  });
+
+  /**
+   * The caller is settling the request whatever the client says. An attempt left in flight is one
+   * the poll loop keeps asking about and keeps writing progress back from, onto a row that has
+   * already been cancelled.
+   */
+  it('takes the attempt out of the in-flight set even when the client refused the detach', async () => {
+    const { service, downloads } = makeService({ removeError: new Error('connection refused') });
+
+    await service.removeLatestForRequest(7, false, 'ann');
+
+    expect(downloads.updateIf).toHaveBeenCalledWith(11, expect.arrayContaining(['downloading']), {
+      status: 'failed',
+      errorMessage: expect.stringContaining('connection refused'),
+    });
+  });
+});
+
+describe('DownloadRemovalService.cleanupStagedDirectDownload', () => {
+  it('deletes direct-download staging once the Book Dock owns the file', async () => {
+    const staged = download({ source: 'direct_url', status: 'importing', downloadClientId: null });
+    const { service, direct } = makeService({ latest: staged });
+
+    await service.cleanupStagedDirectDownload(staged);
+
+    expect(direct.remove).toHaveBeenCalledWith(INFO_HASH, { deleteFiles: true });
+  });
+
+  it('does not remove torrent data during import', async () => {
+    const torrent = download({ source: 'torrent_file', status: 'importing' });
+    const { service, adapter, direct } = makeService({ latest: torrent });
+
+    await service.cleanupStagedDirectDownload(torrent);
+
+    expect(adapter.remove).not.toHaveBeenCalled();
+    expect(direct.remove).not.toHaveBeenCalled();
+  });
+
+  it('does not fail an imported book when staging cleanup fails', async () => {
+    const staged = download({ source: 'direct_url', status: 'importing', downloadClientId: null });
+    const { service } = makeService({ latest: staged, removeError: new Error('busy') });
+
+    await expect(service.cleanupStagedDirectDownload(staged)).resolves.toBeUndefined();
+  });
+});
diff --git a/server/src/modules/book-request/fulfillment/download-removal.service.ts b/server/src/modules/book-request/fulfillment/download-removal.service.ts
new file mode 100644
index 000000000..02d8d77b9
--- /dev/null
+++ b/server/src/modules/book-request/fulfillment/download-removal.service.ts
@@ -0,0 +1,152 @@
+import { BadRequestException, Injectable, Logger, NotFoundException } from '@nestjs/common';
+import { IN_FLIGHT_BOOK_REQUEST_DOWNLOAD_STATUSES } from '@bookorbit/types';
+
+import { sanitizeLogValue } from '../../../common/utils/log-sanitize.utils';
+import type { BookRequestDownloadRow } from '../../../db/schema';
+import { DownloadClientConfigService } from '../download-clients/download-client-config.service';
+import { DownloadClientRegistry } from '../download-clients/download-client-registry';
+import { BookRequestDownloadRepository } from './book-request-download.repository';
+import { DirectDownloadService } from './direct-download.service';
+
+export interface DownloadRemovalOutcome {
+  /** True when a download was actually handed to the client. False when there was nothing to remove. */
+  removed: boolean;
+  /** The client's refusal, when it had one. Best-effort callers report it; strict callers throw. */
+  error: string | null;
+}
+
+/**
+ * The one action BookOrbit takes against a download it grabbed. It lives on its own because both
+ * ends of the request lifecycle need it: an operator removing a seed, a request being cancelled
+ * under a live transfer, and direct-download staging being cleaned after it reaches the Book Dock.
+ */
+@Injectable()
+export class DownloadRemovalService {
+  private readonly logger = new Logger(DownloadRemovalService.name);
+
+  constructor(
+    private readonly downloads: BookRequestDownloadRepository,
+    private readonly clients: DownloadClientConfigService,
+    private readonly registry: DownloadClientRegistry,
+    private readonly direct: DirectDownloadService,
+  ) {}
+
+  /**
+   * Strict: an operator who pressed Remove wants the client's own refusal, not a shrug. Resolves
+   * to whether the attempt was still working, which is what decides the request's own fate.
+   */
+  async removeAttempt(requestId: number, downloadId: number, deleteFiles: boolean, actor: string): Promise<boolean> {
+    const download = await this.downloads.findById(downloadId);
+    if (!download || download.requestId !== requestId) throw new NotFoundException('That download attempt does not belong to this request');
+    if (download.source !== 'direct_url' && download.downloadClientId === null) {
+      throw new BadRequestException('That attempt is no longer attached to a download client');
+    }
+
+    await this.detach(download, deleteFiles);
+    return this.failIfInFlight(download, `Removed from the download client by ${actor}`);
+  }
+
+  /**
+   * Best-effort: the caller is stopping or deleting the request itself, and a download client that
+   * is down must not be what keeps a stuck request stuck. The outcome carries the failure so the
+   * caller can record that a transfer may still be sitting in the client.
+   */
+  async removeLatestForRequest(requestId: number, deleteFiles: boolean, actor: string): Promise<DownloadRemovalOutcome> {
+    const latest = (await this.downloads.findLatestForRequests([requestId])).get(requestId);
+    const download = latest?.download;
+    if (!download || (download.source !== 'direct_url' && download.downloadClientId === null)) return { removed: false, error: null };
+
+    let error: string | null = null;
+    try {
+      await this.detach(download, deleteFiles);
+    } catch (caught: unknown) {
+      error = caught instanceof Error ? caught.message : String(caught);
+      this.logger.warn(
+        `[book_request.remove_download] [fail] requestId=${requestId} downloadId=${download.id} clientId=${download.downloadClientId ?? 'direct'} source=${download.source} errorClass=${(caught as Error)?.constructor?.name ?? 'Error'} error="${sanitizeLogValue(error)}" - download could not be detached from the client`,
+      );
+    }
+
+    // The attempt leaves the in-flight set either way. A client that refused the detach is worth
+    // telling the caller about, but it is not a reason to leave a live attempt behind a request
+    // somebody is settling: the next poll would write its progress straight back onto the settled
+    // row, and the monitor would go on asking the client about it forever.
+    await this.failIfInFlight(
+      download,
+      error ? `Removed by ${actor}, but the download client refused: ${error}` : `Removed from the download client by ${actor}`,
+    );
+    return { removed: error === null, error };
+  }
+
+  /**
+   * Best-effort detach of one attempt, for a caller that is about to lose the row it belongs to.
+   *
+   * Unlike the two above it leaves the attempt's status alone: the row is on its way out with the
+   * request it hangs off, and writing a status onto something that is about to be deleted only
+   * risks failing before the detach that actually mattered. Resolves to the client's refusal, or
+   * null when there was nothing to detach or the detach worked.
+   */
+  async detachAttempt(download: BookRequestDownloadRow, deleteFiles: boolean): Promise<string | null> {
+    try {
+      await this.detach(download, deleteFiles);
+      return null;
+    } catch (caught: unknown) {
+      const error = caught instanceof Error ? caught.message : String(caught);
+      this.logger.warn(
+        `[book_request.remove_download] [fail] requestId=${download.requestId} downloadId=${download.id} clientId=${download.downloadClientId ?? 'direct'} source=${download.source} errorClass=${(caught as Error)?.constructor?.name ?? 'Error'} error="${sanitizeLogValue(error)}" - download could not be detached from the client`,
+      );
+      return error;
+    }
+  }
+
+  /** A direct file has no seed to preserve once its Book Dock copy exists. Cleanup is best-effort. */
+  async cleanupStagedDirectDownload(download: BookRequestDownloadRow): Promise<void> {
+    if (download.source !== 'direct_url') return;
+
+    try {
+      await this.detach(download, true);
+    } catch (error: unknown) {
+      const message = error instanceof Error ? error.message : String(error);
+      this.logger.warn(
+        `[book_request.staging_cleanup] [fail] requestId=${download.requestId} downloadId=${download.id} errorClass=${(error as Error)?.constructor?.name ?? 'Error'} error="${sanitizeLogValue(message)}" - direct-download staging was left on disk`,
+      );
+    }
+  }
+
+  /** A direct file is ours to drop; a torrent is detached from the client that holds it. */
+  private async detach(download: BookRequestDownloadRow, deleteFiles: boolean): Promise<void> {
+    // An attempt a source refused was never handed to anything, so there is nothing holding it.
+    if (download.clientHash === null) return;
+
+    const isDirect = download.source === 'direct_url';
+    // There is no swarm to preserve on a staged file, so its bytes always go with the attempt.
+    const shouldDeleteFiles = isDirect || deleteFiles;
+
+    if (isDirect) {
+      await this.direct.remove(download.clientHash, { deleteFiles: shouldDeleteFiles });
+    } else {
+      const config = await this.clients.resolveConfig(download.downloadClientId as number);
+      const adapter = this.registry.require(config.adapterType);
+      await adapter.remove(download.clientHash, config, { deleteFiles: shouldDeleteFiles });
+    }
+
+    this.logger.log(
+      `[book_request.remove_download] [end] requestId=${download.requestId} downloadId=${download.id} clientId=${download.downloadClientId ?? 'direct'} source=${download.source} deleteFiles=${shouldDeleteFiles} - download removed`,
+    );
+  }
+
+  /**
+   * Removing a transfer that is still working takes the attempt with it, because nothing else is
+   * going to finish it. The row is failed here directly rather than through the retry path, so
+   * automation does not immediately undo a removal a person asked for.
+   *
+   * Conditional on the row as it stands rather than as it was read: an attempt the poll loop
+   * finished or failed in the meantime keeps the outcome it reached.
+   */
+  private async failIfInFlight(download: BookRequestDownloadRow, reason: string): Promise<boolean> {
+    const failed = await this.downloads.updateIf(download.id, IN_FLIGHT_BOOK_REQUEST_DOWNLOAD_STATUSES, {
+      status: 'failed',
+      errorMessage: reason,
+    });
+    return failed !== undefined;
+  }
+}
diff --git a/server/src/modules/book-request/fulfillment/request-automation-search-delay.service.test.ts b/server/src/modules/book-request/fulfillment/request-automation-search-delay.service.test.ts
new file mode 100644
index 000000000..92b864c76
--- /dev/null
+++ b/server/src/modules/book-request/fulfillment/request-automation-search-delay.service.test.ts
@@ -0,0 +1,28 @@
+import { RequestAutomationSearchDelay } from './request-automation-search-delay.service';
+
+describe('RequestAutomationSearchDelay', () => {
+  beforeEach(() => {
+    vi.useFakeTimers();
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+    vi.useRealTimers();
+  });
+
+  it.each([
+    [0, 1_000],
+    [0.5, 1_500],
+    [0.999999, 2_000],
+  ])('waits an inclusive random duration for random=%s', async (random, expectedMs) => {
+    vi.spyOn(Math, 'random').mockReturnValue(random);
+    const setTimeoutSpy = vi.spyOn(globalThis, 'setTimeout');
+    const service = new RequestAutomationSearchDelay();
+
+    const waiting = service.wait();
+
+    expect(setTimeoutSpy).toHaveBeenCalledWith(expect.any(Function), expectedMs);
+    await vi.runAllTimersAsync();
+    await waiting;
+  });
+});
diff --git a/server/src/modules/book-request/fulfillment/request-automation-search-delay.service.ts b/server/src/modules/book-request/fulfillment/request-automation-search-delay.service.ts
new file mode 100644
index 000000000..4e04aa49c
--- /dev/null
+++ b/server/src/modules/book-request/fulfillment/request-automation-search-delay.service.ts
@@ -0,0 +1,12 @@
+import { Injectable } from '@nestjs/common';
+
+const MIN_SEARCH_DELAY_MS = 1_000;
+const MAX_SEARCH_DELAY_MS = 2_000;
+
+@Injectable()
+export class RequestAutomationSearchDelay {
+  async wait(): Promise<void> {
+    const durationMs = Math.floor(Math.random() * (MAX_SEARCH_DELAY_MS - MIN_SEARCH_DELAY_MS + 1)) + MIN_SEARCH_DELAY_MS;
+    await new Promise((resolve) => setTimeout(resolve, durationMs));
+  }
+}
diff --git a/server/src/modules/book-request/fulfillment/request-automation-settings.service.test.ts b/server/src/modules/book-request/fulfillment/request-automation-settings.service.test.ts
new file mode 100644
index 000000000..d4eebea18
--- /dev/null
+++ b/server/src/modules/book-request/fulfillment/request-automation-settings.service.test.ts
@@ -0,0 +1,287 @@
+import { BadRequestException } from '@nestjs/common';
+import {
+  BOOK_REQUEST_AUTOMATION_SETTING_KEYS,
+  bookRequestDefaultFolderKey,
+  bookRequestDefaultLibraryKey,
+  bookRequestReleaseProfileKey,
+  DEFAULT_BOOK_REQUEST_AUTOMATION_SETTINGS,
+  emptyReleaseProfiles,
+} from '@bookorbit/types';
+
+import { RequestAutomationSettingsService } from './request-automation-settings.service';
+
+const KEYS = BOOK_REQUEST_AUTOMATION_SETTING_KEYS;
+
+function makeService(stored: Record<string, string> = {}, repoOverrides: Record<string, unknown> = {}) {
+  const appSettings = {
+    getValues: vi.fn().mockResolvedValue(new Map(Object.entries(stored))),
+    setValue: vi.fn().mockResolvedValue(undefined),
+  };
+  const repo = {
+    folderBelongsToLibrary: vi.fn().mockResolvedValue(true),
+    findFirstFolderId: vi.fn().mockResolvedValue(9),
+    ...repoOverrides,
+  };
+  return { service: new RequestAutomationSettingsService(appSettings as never, repo as never), appSettings, repo };
+}
+
+const NO_DESTINATIONS = {
+  ebook: { libraryId: null, folderId: null },
+  audiobook: { libraryId: null, folderId: null },
+  comic: { libraryId: null, folderId: null },
+};
+
+describe('RequestAutomationSettingsService.get', () => {
+  it('ships with unattended grabbing off', async () => {
+    const { service } = makeService();
+    await expect(service.get()).resolves.toEqual(DEFAULT_BOOK_REQUEST_AUTOMATION_SETTINGS);
+  });
+
+  it('reads every knob back in one round trip', async () => {
+    const { service, appSettings } = makeService({
+      [KEYS.AUTO_GRAB_ENABLED]: 'true',
+      [KEYS.AUTO_GRAB_MIN_SCORE]: '90',
+      [KEYS.AUTO_RETRY_ENABLED]: 'false',
+      [KEYS.MAX_AUTO_GRAB_ATTEMPTS]: '2',
+      [KEYS.VERIFICATION_ENABLED]: 'false',
+      [KEYS.VERIFICATION_THRESHOLD]: '85',
+      [KEYS.IMPORT_FORMATS]: 'preferred',
+      [KEYS.AUTO_SEARCH_ENABLED]: 'true',
+      [KEYS.AUTO_SEARCH_INTERVAL_HOURS]: '12',
+      [KEYS.AUTO_SEARCH_MAX_AGE_DAYS]: '90',
+    });
+
+    await expect(service.get()).resolves.toEqual({
+      autoGrabEnabled: true,
+      autoGrabMinScore: 90,
+      autoRetryEnabled: false,
+      maxAutoGrabAttempts: 2,
+      autoSearchEnabled: true,
+      autoSearchIntervalHours: 12,
+      autoSearchMaxAgeDays: 90,
+      verificationEnabled: false,
+      verificationThreshold: 85,
+      importFormats: 'preferred',
+      destinations: NO_DESTINATIONS,
+      profiles: emptyReleaseProfiles(),
+    });
+    expect(appSettings.getValues).toHaveBeenCalledTimes(1);
+  });
+
+  /**
+   * A hand-edited row must not be able to stop the pipeline, and it must not be able to smuggle a
+   * floor past the bound the endpoint enforces: both revert to the shipped default.
+   */
+  it('falls back to the default for a value that is not a usable one', async () => {
+    const { service } = makeService({
+      [KEYS.AUTO_GRAB_MIN_SCORE]: 'quite high',
+      [KEYS.MAX_AUTO_GRAB_ATTEMPTS]: '0',
+      [KEYS.VERIFICATION_THRESHOLD]: '900',
+      [KEYS.AUTO_GRAB_ENABLED]: 'yes',
+    });
+
+    await expect(service.get()).resolves.toEqual(DEFAULT_BOOK_REQUEST_AUTOMATION_SETTINGS);
+  });
+
+  it('reverts a score floor below the hard minimum rather than honouring it', async () => {
+    const { service } = makeService({ [KEYS.AUTO_GRAB_MIN_SCORE]: '10' });
+    await expect(service.get()).resolves.toMatchObject({ autoGrabMinScore: DEFAULT_BOOK_REQUEST_AUTOMATION_SETTINGS.autoGrabMinScore });
+  });
+});
+
+describe('RequestAutomationSettingsService.update', () => {
+  it('writes only the knobs the caller named', async () => {
+    const { service, appSettings } = makeService();
+
+    await service.update({ autoGrabEnabled: true });
+
+    expect(appSettings.setValue).toHaveBeenCalledTimes(1);
+    expect(appSettings.setValue).toHaveBeenCalledWith(KEYS.AUTO_GRAB_ENABLED, 'true');
+  });
+
+  it('refuses a score floor below the hard minimum', async () => {
+    const { service, appSettings } = makeService();
+
+    await expect(service.update({ autoGrabMinScore: 5 })).rejects.toBeInstanceOf(BadRequestException);
+    expect(appSettings.setValue).not.toHaveBeenCalled();
+  });
+
+  it('refuses an unbounded number of attempts', async () => {
+    const { service } = makeService();
+    await expect(service.update({ maxAutoGrabAttempts: 0 })).rejects.toBeInstanceOf(BadRequestException);
+    await expect(service.update({ maxAutoGrabAttempts: 99 })).rejects.toBeInstanceOf(BadRequestException);
+  });
+
+  it('reports the settings as they now stand', async () => {
+    const { service, appSettings } = makeService();
+    appSettings.getValues.mockResolvedValue(new Map([[KEYS.VERIFICATION_THRESHOLD, '60']]));
+
+    await expect(service.update({ verificationThreshold: 60 })).resolves.toMatchObject({ verificationThreshold: 60 });
+  });
+});
+
+describe('RequestAutomationSettingsService destinations', () => {
+  it('reads a default destination per medium', async () => {
+    const { service } = makeService({
+      [bookRequestDefaultLibraryKey('ebook')]: '4',
+      [bookRequestDefaultFolderKey('ebook')]: '9',
+      [bookRequestDefaultLibraryKey('audiobook')]: '5',
+      [bookRequestDefaultFolderKey('audiobook')]: '12',
+    });
+
+    const { destinations } = await service.get();
+
+    expect(destinations.ebook).toEqual({ libraryId: 4, folderId: 9 });
+    expect(destinations.audiobook).toEqual({ libraryId: 5, folderId: 12 });
+    expect(destinations.comic).toEqual({ libraryId: null, folderId: null });
+  });
+
+  /** A folder on its own files into whichever library that folder belongs to, which nobody chose. */
+  it('drops a stored folder whose library is unset', async () => {
+    const { service } = makeService({ [bookRequestDefaultFolderKey('comic')]: '12' });
+
+    await expect(service.get()).resolves.toMatchObject({ destinations: NO_DESTINATIONS });
+  });
+
+  it('writes one medium without touching the others', async () => {
+    const { service, appSettings } = makeService();
+
+    await service.update({ destinations: { audiobook: { libraryId: 5, folderId: 12 } } });
+
+    expect(appSettings.setValue).toHaveBeenCalledWith(bookRequestDefaultLibraryKey('audiobook'), '5');
+    expect(appSettings.setValue).toHaveBeenCalledWith(bookRequestDefaultFolderKey('audiobook'), '12');
+    expect(appSettings.setValue).not.toHaveBeenCalledWith(bookRequestDefaultLibraryKey('ebook'), expect.anything());
+  });
+
+  it('fills in the library first folder when none was named', async () => {
+    const { service, appSettings } = makeService();
+
+    await service.update({ destinations: { ebook: { libraryId: 4, folderId: null } } });
+
+    expect(appSettings.setValue).toHaveBeenCalledWith(bookRequestDefaultFolderKey('ebook'), '9');
+  });
+
+  it('refuses a folder that belongs to a different library', async () => {
+    const { service, appSettings } = makeService({}, { folderBelongsToLibrary: vi.fn().mockResolvedValue(false) });
+
+    await expect(service.update({ destinations: { ebook: { libraryId: 4, folderId: 99 } } })).rejects.toBeInstanceOf(BadRequestException);
+    expect(appSettings.setValue).not.toHaveBeenCalled();
+  });
+
+  it('refuses a library with nowhere to file a book', async () => {
+    const { service } = makeService({}, { findFirstFolderId: vi.fn().mockResolvedValue(null) });
+
+    await expect(service.update({ destinations: { ebook: { libraryId: 4, folderId: null } } })).rejects.toBeInstanceOf(BadRequestException);
+  });
+
+  it('clears a medium when its library is set to null', async () => {
+    const { service, appSettings } = makeService();
+
+    await service.update({ destinations: { comic: { libraryId: null, folderId: null } } });
+
+    expect(appSettings.setValue).toHaveBeenCalledWith(bookRequestDefaultLibraryKey('comic'), '');
+    expect(appSettings.setValue).toHaveBeenCalledWith(bookRequestDefaultFolderKey('comic'), '');
+  });
+});
+
+describe('RequestAutomationSettingsService.resolveDestinationFor', () => {
+  it('resolves the stored destination for the medium asked about', async () => {
+    const { service } = makeService({
+      [bookRequestDefaultLibraryKey('audiobook')]: '5',
+      [bookRequestDefaultFolderKey('audiobook')]: '12',
+    });
+
+    await expect(service.resolveDestinationFor('audiobook')).resolves.toEqual({ libraryId: 5, folderId: 12 });
+  });
+
+  it('resolves to nothing for a medium with no default', async () => {
+    const { service } = makeService();
+
+    await expect(service.resolveDestinationFor('ebook')).resolves.toEqual({ libraryId: null, folderId: null });
+  });
+
+  /**
+   * The setting is not rewritten when a library is deleted, so a stored id outlives its row. It
+   * has to resolve to nothing rather than to a destination that cannot take a file.
+   */
+  it('resolves to nothing when the stored library no longer exists', async () => {
+    const { service } = makeService(
+      { [bookRequestDefaultLibraryKey('ebook')]: '4', [bookRequestDefaultFolderKey('ebook')]: '9' },
+      { folderBelongsToLibrary: vi.fn().mockResolvedValue(false), findFirstFolderId: vi.fn().mockResolvedValue(null) },
+    );
+
+    await expect(service.resolveDestinationFor('ebook')).resolves.toEqual({ libraryId: null, folderId: null });
+  });
+
+  it('falls back to the library first folder when the stored folder is gone', async () => {
+    const { service } = makeService(
+      { [bookRequestDefaultLibraryKey('ebook')]: '4', [bookRequestDefaultFolderKey('ebook')]: '99' },
+      { folderBelongsToLibrary: vi.fn().mockResolvedValue(false), findFirstFolderId: vi.fn().mockResolvedValue(9) },
+    );
+
+    await expect(service.resolveDestinationFor('ebook')).resolves.toEqual({ libraryId: 4, folderId: 9 });
+  });
+  describe('release profiles', () => {
+    const tier = (over = {}) => ({ id: 't1', name: 'M4B single file', conditions: { formats: ['m4b'], fileLayout: 'single' as const }, ...over });
+
+    it('reads no profile as an empty list for every medium', async () => {
+      const { service } = makeService();
+
+      await expect(service.get()).resolves.toMatchObject({ profiles: emptyReleaseProfiles() });
+    });
+
+    it('round-trips a stored profile', async () => {
+      const { service } = makeService({ [bookRequestReleaseProfileKey('audiobook')]: JSON.stringify([tier()]) });
+
+      const { profiles } = await service.get();
+      expect(profiles.audiobook).toEqual([tier()]);
+      expect(profiles.ebook).toEqual([]);
+    });
+
+    it('writes one medium without touching the others', async () => {
+      const { service, appSettings } = makeService();
+
+      await service.update({ profiles: { audiobook: [tier()] } });
+
+      expect(appSettings.setValue).toHaveBeenCalledWith(bookRequestReleaseProfileKey('audiobook'), JSON.stringify([tier()]));
+      expect(appSettings.setValue).not.toHaveBeenCalledWith(bookRequestReleaseProfileKey('ebook'), expect.anything());
+    });
+
+    it('clears a profile with an empty list', async () => {
+      const { service, appSettings } = makeService();
+
+      await service.update({ profiles: { comic: [] } });
+
+      expect(appSettings.setValue).toHaveBeenCalledWith(bookRequestReleaseProfileKey('comic'), '[]');
+    });
+
+    it('refuses a tier with no name, since the release row has nothing to show', async () => {
+      const { service } = makeService();
+
+      await expect(service.update({ profiles: { ebook: [tier({ name: '  ' })] } })).rejects.toBeInstanceOf(BadRequestException);
+    });
+
+    /** Two tiers sharing an id make "which tier matched" unanswerable, and a reorder ambiguous. */
+    it('refuses two tiers that share an id', async () => {
+      const { service } = makeService();
+
+      await expect(service.update({ profiles: { ebook: [tier(), tier({ name: 'Other' })] } })).rejects.toBeInstanceOf(BadRequestException);
+    });
+
+    /**
+     * A hand-edited row must not take the automation down: an unreadable profile reverts to none,
+     * which grabs on score alone rather than refusing to read the settings at all.
+     */
+    it('reads an unparseable profile as no profile', async () => {
+      const { service } = makeService({ [bookRequestReleaseProfileKey('ebook')]: 'not json' });
+
+      await expect(service.get()).resolves.toMatchObject({ profiles: emptyReleaseProfiles() });
+    });
+
+    it('reads a profile that is not a list as no profile', async () => {
+      const { service } = makeService({ [bookRequestReleaseProfileKey('ebook')]: '{"formats":["epub"]}' });
+
+      await expect(service.get()).resolves.toMatchObject({ profiles: emptyReleaseProfiles() });
+    });
+  });
+});
diff --git a/server/src/modules/book-request/fulfillment/request-automation-settings.service.ts b/server/src/modules/book-request/fulfillment/request-automation-settings.service.ts
new file mode 100644
index 000000000..9a7fb9b37
--- /dev/null
+++ b/server/src/modules/book-request/fulfillment/request-automation-settings.service.ts
@@ -0,0 +1,278 @@
+import { BadRequestException, Injectable } from '@nestjs/common';
+import {
+  BOOK_REQUEST_AUTOMATION_SETTING_KEYS,
+  BOOK_REQUEST_DESTINATION_SETTING_KEYS,
+  BOOK_REQUEST_IMPORT_FORMATS,
+  BOOK_REQUEST_MEDIA_KINDS,
+  BOOK_REQUEST_PROFILE_SETTING_KEYS,
+  bookRequestDefaultFolderKey,
+  bookRequestDefaultLibraryKey,
+  bookRequestReleaseProfileKey,
+  DEFAULT_BOOK_REQUEST_AUTOMATION_SETTINGS,
+  emptyReleaseProfiles,
+  emptyRequestDestinationDefaults,
+  MAX_AUTO_GRAB_ATTEMPTS_LIMIT,
+  MAX_AUTO_SEARCH_INTERVAL_HOURS,
+  MAX_AUTO_SEARCH_MAX_AGE_DAYS,
+  MAX_RELEASE_TIER_NAME_LENGTH,
+  MAX_RELEASE_TIERS,
+  MIN_AUTO_GRAB_SCORE_FLOOR,
+  MIN_AUTO_SEARCH_INTERVAL_HOURS,
+  MIN_AUTO_SEARCH_MAX_AGE_DAYS,
+} from '@bookorbit/types';
+import type {
+  BookRequestAutomationSettings,
+  BookRequestImportFormats,
+  BookRequestMediaKind,
+  ReleaseProfiles,
+  ReleaseTier,
+  RequestDestination,
+  RequestDestinationDefaults,
+  UpdateBookRequestAutomationSettingsPayload,
+} from '@bookorbit/types';
+
+import { AppSettingsService } from '../../app-settings/app-settings.service';
+import { BookRequestRepository } from '../book-request.repository';
+
+const KEYS = BOOK_REQUEST_AUTOMATION_SETTING_KEYS;
+
+/**
+ * The automation knobs, read from `app_settings` and validated on the way in.
+ *
+ * Every read falls back to the shipped default rather than throwing, so a hand-edited row cannot
+ * stop the pipeline: a nonsense value reverts to the default and the operator sees the default in
+ * the settings form, which is the state the instance is actually in.
+ */
+@Injectable()
+export class RequestAutomationSettingsService {
+  constructor(
+    private readonly appSettings: AppSettingsService,
+    private readonly repo: BookRequestRepository,
+  ) {}
+
+  async get(): Promise<BookRequestAutomationSettings> {
+    const values = await this.appSettings.getValues([
+      ...Object.values(KEYS),
+      ...BOOK_REQUEST_DESTINATION_SETTING_KEYS,
+      ...BOOK_REQUEST_PROFILE_SETTING_KEYS,
+    ]);
+    const defaults = DEFAULT_BOOK_REQUEST_AUTOMATION_SETTINGS;
+
+    return {
+      autoGrabEnabled: parseBoolean(values.get(KEYS.AUTO_GRAB_ENABLED), defaults.autoGrabEnabled),
+      autoGrabMinScore: parseInteger(values.get(KEYS.AUTO_GRAB_MIN_SCORE), defaults.autoGrabMinScore, MIN_AUTO_GRAB_SCORE_FLOOR, 100),
+      autoRetryEnabled: parseBoolean(values.get(KEYS.AUTO_RETRY_ENABLED), defaults.autoRetryEnabled),
+      maxAutoGrabAttempts: parseInteger(values.get(KEYS.MAX_AUTO_GRAB_ATTEMPTS), defaults.maxAutoGrabAttempts, 1, MAX_AUTO_GRAB_ATTEMPTS_LIMIT),
+      autoSearchEnabled: parseBoolean(values.get(KEYS.AUTO_SEARCH_ENABLED), defaults.autoSearchEnabled),
+      autoSearchIntervalHours: parseInteger(
+        values.get(KEYS.AUTO_SEARCH_INTERVAL_HOURS),
+        defaults.autoSearchIntervalHours,
+        MIN_AUTO_SEARCH_INTERVAL_HOURS,
+        MAX_AUTO_SEARCH_INTERVAL_HOURS,
+      ),
+      autoSearchMaxAgeDays: parseInteger(
+        values.get(KEYS.AUTO_SEARCH_MAX_AGE_DAYS),
+        defaults.autoSearchMaxAgeDays,
+        MIN_AUTO_SEARCH_MAX_AGE_DAYS,
+        MAX_AUTO_SEARCH_MAX_AGE_DAYS,
+      ),
+      verificationEnabled: parseBoolean(values.get(KEYS.VERIFICATION_ENABLED), defaults.verificationEnabled),
+      verificationThreshold: parseInteger(values.get(KEYS.VERIFICATION_THRESHOLD), defaults.verificationThreshold, 0, 100),
+      importFormats: parseImportFormats(values.get(KEYS.IMPORT_FORMATS), defaults.importFormats),
+      destinations: parseDestinations(values),
+      profiles: parseProfiles(values),
+    };
+  }
+
+  /**
+   * The instance default for one medium, checked against the libraries that exist right now.
+   *
+   * A library or folder can be deleted long after it was set here, and nothing rewrites the
+   * setting when that happens. So the stored ids are a hint rather than a destination: a library
+   * that is gone resolves to nothing and the request falls back to needing a human, which is the
+   * same place it would have been without a default at all.
+   */
+  async resolveDestinationFor(mediaKind: BookRequestMediaKind): Promise<RequestDestination> {
+    const { destinations } = await this.get();
+    const stored = destinations[mediaKind];
+    if (stored.libraryId === null) return { libraryId: null, folderId: null };
+
+    const folderId =
+      stored.folderId !== null && (await this.repo.folderBelongsToLibrary(stored.folderId, stored.libraryId))
+        ? stored.folderId
+        : await this.repo.findFirstFolderId(stored.libraryId);
+
+    // No folder means either the library is gone or it has none, and neither can hold a book.
+    return folderId === null ? { libraryId: null, folderId: null } : { libraryId: stored.libraryId, folderId };
+  }
+
+  async update(payload: UpdateBookRequestAutomationSettingsPayload): Promise<BookRequestAutomationSettings> {
+    const writes: Array<Promise<void>> = [];
+
+    if (payload.autoGrabEnabled !== undefined) {
+      writes.push(this.appSettings.setValue(KEYS.AUTO_GRAB_ENABLED, String(payload.autoGrabEnabled)));
+    }
+    if (payload.autoGrabMinScore !== undefined) {
+      assertRange('The auto-grab score floor', payload.autoGrabMinScore, MIN_AUTO_GRAB_SCORE_FLOOR, 100);
+      writes.push(this.appSettings.setValue(KEYS.AUTO_GRAB_MIN_SCORE, String(payload.autoGrabMinScore)));
+    }
+    if (payload.autoRetryEnabled !== undefined) {
+      writes.push(this.appSettings.setValue(KEYS.AUTO_RETRY_ENABLED, String(payload.autoRetryEnabled)));
+    }
+    if (payload.maxAutoGrabAttempts !== undefined) {
+      assertRange('The attempt limit', payload.maxAutoGrabAttempts, 1, MAX_AUTO_GRAB_ATTEMPTS_LIMIT);
+      writes.push(this.appSettings.setValue(KEYS.MAX_AUTO_GRAB_ATTEMPTS, String(payload.maxAutoGrabAttempts)));
+    }
+    if (payload.autoSearchEnabled !== undefined) {
+      writes.push(this.appSettings.setValue(KEYS.AUTO_SEARCH_ENABLED, String(payload.autoSearchEnabled)));
+    }
+    if (payload.autoSearchIntervalHours !== undefined) {
+      assertRange('The re-search interval', payload.autoSearchIntervalHours, MIN_AUTO_SEARCH_INTERVAL_HOURS, MAX_AUTO_SEARCH_INTERVAL_HOURS);
+      writes.push(this.appSettings.setValue(KEYS.AUTO_SEARCH_INTERVAL_HOURS, String(payload.autoSearchIntervalHours)));
+    }
+    if (payload.autoSearchMaxAgeDays !== undefined) {
+      assertRange('The re-search cut-off', payload.autoSearchMaxAgeDays, MIN_AUTO_SEARCH_MAX_AGE_DAYS, MAX_AUTO_SEARCH_MAX_AGE_DAYS);
+      writes.push(this.appSettings.setValue(KEYS.AUTO_SEARCH_MAX_AGE_DAYS, String(payload.autoSearchMaxAgeDays)));
+    }
+    if (payload.verificationEnabled !== undefined) {
+      writes.push(this.appSettings.setValue(KEYS.VERIFICATION_ENABLED, String(payload.verificationEnabled)));
+    }
+    if (payload.verificationThreshold !== undefined) {
+      assertRange('The verification threshold', payload.verificationThreshold, 0, 100);
+      writes.push(this.appSettings.setValue(KEYS.VERIFICATION_THRESHOLD, String(payload.verificationThreshold)));
+    }
+    if (payload.importFormats !== undefined) {
+      if (!BOOK_REQUEST_IMPORT_FORMATS.includes(payload.importFormats)) {
+        throw new BadRequestException(`Import formats must be one of: ${BOOK_REQUEST_IMPORT_FORMATS.join(', ')}`);
+      }
+      writes.push(this.appSettings.setValue(KEYS.IMPORT_FORMATS, payload.importFormats));
+    }
+    if (payload.destinations !== undefined) {
+      for (const mediaKind of BOOK_REQUEST_MEDIA_KINDS) {
+        const destination = payload.destinations[mediaKind];
+        if (destination === undefined) continue;
+        const checked = await this.checkDestination(mediaKind, destination);
+        writes.push(this.appSettings.setValue(bookRequestDefaultLibraryKey(mediaKind), checked.libraryId?.toString() ?? ''));
+        writes.push(this.appSettings.setValue(bookRequestDefaultFolderKey(mediaKind), checked.folderId?.toString() ?? ''));
+      }
+    }
+
+    if (payload.profiles !== undefined) {
+      for (const mediaKind of BOOK_REQUEST_MEDIA_KINDS) {
+        const tiers = payload.profiles[mediaKind];
+        if (tiers === undefined) continue;
+        writes.push(this.appSettings.setValue(bookRequestReleaseProfileKey(mediaKind), JSON.stringify(checkTiers(mediaKind, tiers))));
+      }
+    }
+
+    await Promise.all(writes);
+    return this.get();
+  }
+
+  /**
+   * Refused at the form rather than stored and discovered later: a folder in another library would
+   * carry every request of this medium into that other library at finalize time, and both ids are
+   * individually valid so nothing downstream can tell the difference.
+   */
+  private async checkDestination(mediaKind: BookRequestMediaKind, destination: RequestDestination): Promise<RequestDestination> {
+    if (destination.libraryId === null) return { libraryId: null, folderId: null };
+
+    const folderId = destination.folderId ?? (await this.repo.findFirstFolderId(destination.libraryId));
+    if (folderId === null) {
+      throw new BadRequestException(`The default ${mediaKind} library has no folder to file books into`);
+    }
+    if (!(await this.repo.folderBelongsToLibrary(folderId, destination.libraryId))) {
+      throw new BadRequestException(`The default ${mediaKind} folder is not part of the library chosen beside it`);
+    }
+    return { libraryId: destination.libraryId, folderId };
+  }
+}
+
+/**
+ * A stored id whose row has since been deleted parses fine, so this only settles the shape. What
+ * still exists is decided at resolve time, against the libraries there are.
+ */
+function parseDestinations(values: Map<string, string>): RequestDestinationDefaults {
+  const destinations = emptyRequestDestinationDefaults();
+  for (const mediaKind of BOOK_REQUEST_MEDIA_KINDS) {
+    const libraryId = parseId(values.get(bookRequestDefaultLibraryKey(mediaKind)));
+    // A folder without a library is not a destination, so it is not carried on its own.
+    destinations[mediaKind] =
+      libraryId === null ? { libraryId: null, folderId: null } : { libraryId, folderId: parseId(values.get(bookRequestDefaultFolderKey(mediaKind))) };
+  }
+  return destinations;
+}
+
+/**
+ * A stored profile that will not parse reverts to no profile rather than throwing. The tier axis
+ * then disengages and the instance grabs on score alone, which is a working instance; refusing to
+ * read the settings at all would take the whole automation down over one malformed row.
+ */
+function parseProfiles(values: Map<string, string>): ReleaseProfiles {
+  const profiles = emptyReleaseProfiles();
+  for (const mediaKind of BOOK_REQUEST_MEDIA_KINDS) {
+    const raw = values.get(bookRequestReleaseProfileKey(mediaKind));
+    if (!raw) continue;
+    try {
+      const parsed: unknown = JSON.parse(raw);
+      if (Array.isArray(parsed)) profiles[mediaKind] = checkTiers(mediaKind, parsed as ReleaseTier[]);
+    } catch {
+      // Left empty on purpose; see above.
+    }
+  }
+  return profiles;
+}
+
+/**
+ * Refused at the form rather than stored: a tier with no id cannot survive a reorder, and two
+ * tiers sharing one id make "which tier matched" unanswerable on the release row.
+ */
+function checkTiers(mediaKind: BookRequestMediaKind, tiers: readonly ReleaseTier[]): ReleaseTier[] {
+  if (!Array.isArray(tiers)) throw new BadRequestException(`The ${mediaKind} profile must be a list of tiers`);
+  if (tiers.length > MAX_RELEASE_TIERS) {
+    throw new BadRequestException(`A profile may hold at most ${MAX_RELEASE_TIERS} tiers`);
+  }
+
+  const seen = new Set<string>();
+  return tiers.map((tier) => {
+    const id = typeof tier?.id === 'string' ? tier.id.trim() : '';
+    const name = typeof tier?.name === 'string' ? tier.name.trim() : '';
+    if (!id) throw new BadRequestException('Every tier needs an id');
+    if (seen.has(id)) throw new BadRequestException('Two tiers share the same id');
+    seen.add(id);
+    if (!name) throw new BadRequestException('Every tier needs a name');
+    if (name.length > MAX_RELEASE_TIER_NAME_LENGTH) {
+      throw new BadRequestException(`A tier name may be at most ${MAX_RELEASE_TIER_NAME_LENGTH} characters`);
+    }
+    return { id, name, conditions: tier.conditions ?? {} };
+  });
+}
+
+function parseId(raw: string | undefined): number | null {
+  if (!raw) return null;
+  const parsed = Number.parseInt(raw, 10);
+  return Number.isInteger(parsed) && parsed > 0 ? parsed : null;
+}
+
+function assertRange(label: string, value: number, min: number, max: number): void {
+  if (!Number.isInteger(value) || value < min || value > max) {
+    throw new BadRequestException(`${label} must be a whole number between ${min} and ${max}`);
+  }
+}
+
+function parseImportFormats(raw: string | undefined, fallback: BookRequestImportFormats): BookRequestImportFormats {
+  return BOOK_REQUEST_IMPORT_FORMATS.includes(raw as BookRequestImportFormats) ? (raw as BookRequestImportFormats) : fallback;
+}
+
+function parseBoolean(raw: string | undefined, fallback: boolean): boolean {
+  if (raw === 'true') return true;
+  if (raw === 'false') return false;
+  return fallback;
+}
+
+function parseInteger(raw: string | undefined, fallback: number, min: number, max: number): number {
+  if (raw === undefined) return fallback;
+  const parsed = Number.parseInt(raw, 10);
+  if (!Number.isFinite(parsed) || parsed < min || parsed > max) return fallback;
+  return parsed;
+}
diff --git a/server/src/modules/book-request/fulfillment/request-automation.service.test.ts b/server/src/modules/book-request/fulfillment/request-automation.service.test.ts
new file mode 100644
index 000000000..3d780c82c
--- /dev/null
+++ b/server/src/modules/book-request/fulfillment/request-automation.service.test.ts
@@ -0,0 +1,893 @@
+import { BadRequestException } from '@nestjs/common';
+import { DEFAULT_BOOK_REQUEST_AUTOMATION_SETTINGS } from '@bookorbit/types';
+import type { BookRequestAutomationSettings, GrabFailureCode, IndexerSearchStatus, ReleaseCandidateItem } from '@bookorbit/types';
+
+import type { BookRequestDownloadRow, BookRequestRow } from '../../../db/schema';
+import { BOOK_REQUEST_DOWNLOAD_FAILED } from '../book-request-events.service';
+import { RequestAlreadyClaimedException } from './request-fulfillment.service';
+import { RequestAutomationService } from './request-automation.service';
+
+function release(overrides: Partial<ReleaseCandidateItem> = {}): ReleaseCandidateItem {
+  return {
+    indexerId: 9,
+    indexerName: 'tracker',
+    guid: 'release-1',
+    title: 'Dune [epub]',
+    sizeBytes: 2_000_000,
+    seeders: 40,
+    leechers: 1,
+    format: 'epub',
+    language: 'en',
+    freeleech: false,
+    publishedAt: null,
+    score: 92,
+    reasons: [],
+    ...overrides,
+  };
+}
+
+/** A refusal shaped the way the fulfilment service shapes one, which is what carries the scope. */
+function refusal(errorCode: GrabFailureCode, message: string): BadRequestException {
+  return new BadRequestException({ message, errorCode, statusCode: 400 });
+}
+
+function indexerStatus(indexerId: number, seedsBack: boolean): IndexerSearchStatus {
+  return { indexerId, indexerName: `indexer-${indexerId}`, ok: true, count: 1, filtered: 0, seedsBack };
+}
+
+function joined(overrides: Partial<BookRequestRow> = {}) {
+  return {
+    request: {
+      id: 7,
+      title: 'Dune',
+      status: 'approved',
+      targetLibraryId: 2,
+      mediaKind: 'ebook',
+      authors: ['Frank Herbert'],
+      ...overrides,
+    } as BookRequestRow,
+    requesterUsername: 'bob',
+    requesterName: 'Bob',
+    decidedByUsername: null,
+    targetLibraryName: 'Books',
+  };
+}
+
+function makeService(
+  options: {
+    settings?: Partial<BookRequestAutomationSettings>;
+    request?: Partial<BookRequestRow>;
+    releases?: ReleaseCandidateItem[];
+    indexers?: IndexerSearchStatus[];
+    /** What the instance had to search with. Defaults to one working source, as every case assumes. */
+    sourceCounts?: { enabledIndexerCount?: number; configuredIndexerCount?: number; uncoveredIndexerCount?: number };
+    attempts?: number;
+    tried?: string[];
+    /** What the wanted-list sweep finds waiting. Empty everywhere the sweep is not what is under test. */
+    due?: Array<{ id: number }>;
+    download?: Partial<BookRequestDownloadRow> | null;
+  } = {},
+) {
+  const settings = {
+    get: vi.fn().mockResolvedValue({ ...DEFAULT_BOOK_REQUEST_AUTOMATION_SETTINGS, autoGrabEnabled: true, ...options.settings }),
+  };
+  const requests = {
+    findById: vi.fn().mockResolvedValue(joined(options.request)),
+    findDueForResearch: vi.fn().mockResolvedValue(options.due ?? []),
+  };
+  const downloads = {
+    findById: vi
+      .fn()
+      .mockResolvedValue(
+        options.download === null ? undefined : ({ id: 11, requestId: 7, automated: true, ...options.download } as BookRequestDownloadRow),
+      ),
+    countAutomatedForRequest: vi.fn().mockResolvedValue(options.attempts ?? 0),
+    findTriedReleaseKeys: vi.fn().mockResolvedValue(new Set(options.tried ?? [])),
+  };
+  const releases = {
+    search: vi.fn().mockResolvedValue({
+      releases: options.releases ?? [release()],
+      indexers: options.indexers ?? [],
+      enabledIndexerCount: options.sourceCounts?.enabledIndexerCount ?? 1,
+      configuredIndexerCount: options.sourceCounts?.configuredIndexerCount ?? 1,
+      uncoveredIndexerCount: options.sourceCounts?.uncoveredIndexerCount ?? 0,
+      searchedAt: '',
+      cached: false,
+    }),
+  };
+  const fulfillment = { grab: vi.fn().mockResolvedValue(undefined), setRequestStatus: vi.fn().mockResolvedValue(true) };
+  const events = { on: vi.fn() };
+  const notifier = { notifyApprovers: vi.fn().mockResolvedValue(undefined) };
+  const searchDelay = { wait: vi.fn().mockResolvedValue(undefined) };
+
+  const service = new RequestAutomationService(
+    settings as never,
+    requests as never,
+    downloads as never,
+    releases as never,
+    fulfillment as never,
+    events as never,
+    notifier as never,
+    searchDelay as never,
+  );
+
+  return { service, settings, requests, downloads, releases, fulfillment, events, notifier, searchDelay };
+}
+
+/**
+ * Every terminal write is conditional on the status the pass believes the request is in, so the
+ * assertions name it: a decline that ran before the claim may only write from what it read, and
+ * one that ran after may only write from the `searching` this pass claimed.
+ */
+const FROM_APPROVED = ['approved'];
+const FROM_SEARCHING = ['searching'];
+
+/** `considerRequest` is fire and forget by design, so a test has to let its microtasks drain. */
+async function settle(): Promise<void> {
+  await new Promise((resolve) => setImmediate(resolve));
+}
+
+describe('RequestAutomationService.considerRequest', () => {
+  it('does nothing at all while unattended grabbing is off', async () => {
+    const { service, fulfillment, releases, notifier } = makeService({ settings: { autoGrabEnabled: false } });
+
+    service.considerRequest(7);
+    await settle();
+
+    expect(releases.search).not.toHaveBeenCalled();
+    expect(fulfillment.grab).not.toHaveBeenCalled();
+    // An approver approved this one and is looking at the queue, so there is nobody to tell and
+    // no reason to stamp "automation is off" on an approval nobody asked automation to handle.
+    expect(fulfillment.setRequestStatus).not.toHaveBeenCalled();
+    expect(notifier.notifyApprovers).not.toHaveBeenCalled();
+  });
+
+  /**
+   * The stall this whole fix exists for. Nobody decided on the request, its requester cannot open
+   * the picker, and with automation off nothing was ever going to look at it.
+   */
+  it('says why, and tells the approvers, when an auto-approved request meets automation switched off', async () => {
+    const { service, fulfillment, notifier } = makeService({ settings: { autoGrabEnabled: false } });
+
+    service.considerRequest(7, 'auto_approval');
+    await settle();
+
+    expect(fulfillment.setRequestStatus).toHaveBeenCalledWith(
+      7,
+      'approved',
+      expect.stringContaining('Automatic grabbing is off'),
+      { code: 'AUTOMATION_DISABLED', meta: undefined },
+      FROM_APPROVED,
+    );
+    expect(notifier.notifyApprovers).toHaveBeenCalledWith(
+      'book_request_needs_release',
+      expect.objectContaining({ message: expect.stringContaining('Dune'), meta: { requestId: 7 } }),
+    );
+  });
+
+  /**
+   * `considerRequest` is fire and forget, so the request can be gone by the time it runs. Declining
+   * before checking would write `approved` over a status somebody deliberately moved on from.
+   */
+  it('does not resurrect a request that was cancelled before the attempt ran', async () => {
+    const { service, fulfillment, notifier } = makeService({ settings: { autoGrabEnabled: false }, request: { status: 'cancelled' } });
+
+    service.considerRequest(7, 'auto_approval');
+    await settle();
+
+    expect(fulfillment.setRequestStatus).not.toHaveBeenCalled();
+    expect(notifier.notifyApprovers).not.toHaveBeenCalled();
+  });
+
+  /** Every other hand-back already wrote a reason; what none of them did was tell anybody. */
+  it('tells the approvers when an auto-approved request is handed back for any other reason', async () => {
+    const { service, notifier } = makeService({ releases: [release({ score: 61 })], settings: { autoGrabMinScore: 80 } });
+
+    service.considerRequest(7, 'auto_approval');
+    await settle();
+
+    expect(notifier.notifyApprovers).toHaveBeenCalledTimes(1);
+  });
+
+  /**
+   * The counterpart, and the reason the trigger exists at all: bulk-approving twenty requests must
+   * not fan out twenty notifications to every approver about work they are already looking at.
+   */
+  it('stays quiet when an approver is the one who set the attempt off', async () => {
+    const { service, fulfillment, notifier } = makeService({ releases: [release({ score: 61 })], settings: { autoGrabMinScore: 80 } });
+
+    service.considerRequest(7);
+    await settle();
+
+    expect(fulfillment.setRequestStatus).toHaveBeenLastCalledWith(7, 'approved', expect.any(String), expect.any(Object), FROM_SEARCHING);
+    expect(notifier.notifyApprovers).not.toHaveBeenCalled();
+  });
+
+  it('grabs the top release when it clears the floor', async () => {
+    const { service, fulfillment } = makeService();
+
+    service.considerRequest(7);
+    await settle();
+
+    expect(fulfillment.setRequestStatus).toHaveBeenCalledWith(7, 'searching', null, null, FROM_APPROVED);
+    expect(fulfillment.grab).toHaveBeenCalledWith(7, { indexerId: 9, releaseGuid: 'release-1' }, null);
+  });
+
+  /**
+   * `considerRequest` is fire and forget, and the guards above the claim ran against a row read
+   * some time ago. A request cancelled in between would otherwise cost a search against every
+   * enabled tracker for a book nobody is waiting for any more.
+   */
+  it('searches nothing when the request was settled before the claim landed', async () => {
+    const { service, fulfillment, releases } = makeService();
+    fulfillment.setRequestStatus.mockResolvedValue(false);
+
+    service.considerRequest(7);
+    await settle();
+
+    expect(releases.search).not.toHaveBeenCalled();
+    expect(fulfillment.grab).not.toHaveBeenCalled();
+  });
+
+  /**
+   * `searching` is deliberately grabbable, so an approver can pick a release while a pass is
+   * running. Everything the pass hands over afterwards is refused, and its "no release could be
+   * started" used to land on the healthy download they just started - which then invited a retry
+   * that would grab the same book a second time.
+   */
+  describe('an approver who grabs a release mid-pass', () => {
+    function refusedPass() {
+      const harness = makeService();
+      harness.fulfillment.grab.mockRejectedValue(refusal('GRAB_RELEASE_REFUSED', 'Another release is already being sent for this request'));
+      return harness;
+    }
+
+    it('writes the failure only from the searching this pass claimed', async () => {
+      const { service, fulfillment } = refusedPass();
+
+      service.considerRequest(7);
+      await settle();
+
+      const terminal = fulfillment.setRequestStatus.mock.calls.filter(([, status]) => status === 'failed');
+      expect(terminal).toHaveLength(1);
+      expect(terminal[0]).toEqual([7, 'failed', expect.any(String), null, FROM_SEARCHING]);
+    });
+
+    it('claims searching only from the status the guards read', async () => {
+      const { service, fulfillment } = makeService({ request: { status: 'failed' } });
+
+      service.considerRequest(7);
+      await settle();
+
+      expect(fulfillment.setRequestStatus).toHaveBeenCalledWith(7, 'searching', null, null, ['failed']);
+    });
+
+    /** Every remaining candidate would be refused for the same reason, so the list is not worked down. */
+    it('stops the candidate list on a claim conflict rather than burning it', async () => {
+      const { service, fulfillment } = makeService({
+        releases: [release({ guid: 'a', indexerId: 9 }), release({ guid: 'b', indexerId: 8 }), release({ guid: 'c', indexerId: 7 })],
+      });
+      fulfillment.grab.mockRejectedValue(new RequestAlreadyClaimedException('Another release is already being sent for this request'));
+
+      service.considerRequest(7);
+      await settle();
+
+      expect(fulfillment.grab).toHaveBeenCalledTimes(1);
+    });
+  });
+
+  it('stops after the recommended ISBN when it finds a release that clears the floor', async () => {
+    const { service, releases, searchDelay } = makeService({ request: { isbn13: '9780441172719' } });
+
+    service.considerRequest(7);
+    await settle();
+
+    expect(releases.search).toHaveBeenCalledTimes(1);
+    expect(releases.search).toHaveBeenCalledWith(expect.objectContaining({ id: 7 }), { indexerMode: 'all' });
+    expect(searchDelay.wait).not.toHaveBeenCalled();
+  });
+
+  it('waits once and searches one alternate ISBN when the recommended ISBN is not good enough', async () => {
+    const { service, releases, fulfillment, searchDelay } = makeService({
+      request: {
+        isbn13: '9780441172719',
+        metadataSources: [
+          {
+            providerKey: 'google',
+            providerId: 'dune-alt',
+            providerLabel: 'Google Books',
+            isbn10: null,
+            isbn13: '9780593098233',
+          },
+        ],
+      },
+    });
+    releases.search
+      .mockResolvedValueOnce({ releases: [release({ guid: 'weak', score: 60 })], indexers: [], searchedAt: '', cached: false })
+      .mockResolvedValueOnce({ releases: [release({ guid: 'alternate', score: 88 })], indexers: [], searchedAt: '', cached: false });
+
+    service.considerRequest(7);
+    await settle();
+
+    expect(searchDelay.wait).toHaveBeenCalledTimes(1);
+    expect(releases.search).toHaveBeenNthCalledWith(2, expect.objectContaining({ id: 7 }), {
+      indexerMode: 'isbn-capable',
+      overrides: { isbn: '9780593098233' },
+    });
+    expect(fulfillment.grab).toHaveBeenCalledWith(7, { indexerId: 9, releaseGuid: 'alternate' }, null);
+  });
+
+  it('waits twice and falls back to title and author after two ISBN searches', async () => {
+    const { service, releases, fulfillment, searchDelay } = makeService({
+      request: {
+        isbn13: '9780441172719',
+        metadataSources: [
+          {
+            providerKey: 'google',
+            providerId: 'dune-alt',
+            providerLabel: 'Google Books',
+            isbn10: null,
+            isbn13: '9780593098233',
+          },
+        ],
+      },
+    });
+    releases.search
+      .mockResolvedValueOnce({ releases: [], indexers: [], searchedAt: '', cached: false })
+      .mockResolvedValueOnce({ releases: [], indexers: [], searchedAt: '', cached: false })
+      .mockResolvedValueOnce({ releases: [release({ guid: 'title-match', score: 86 })], indexers: [], searchedAt: '', cached: false });
+
+    service.considerRequest(7);
+    await settle();
+
+    expect(searchDelay.wait).toHaveBeenCalledTimes(2);
+    expect(releases.search).toHaveBeenNthCalledWith(3, expect.objectContaining({ id: 7 }), {
+      indexerMode: 'isbn-capable',
+      overrides: { isbn: null },
+    });
+    expect(fulfillment.grab).toHaveBeenCalledWith(7, { indexerId: 9, releaseGuid: 'title-match' }, null);
+  });
+
+  it('waits once before title and author when only one ISBN is available', async () => {
+    const { service, releases, fulfillment, searchDelay } = makeService({ request: { isbn13: '9780441172719' } });
+    releases.search
+      .mockResolvedValueOnce({ releases: [release({ guid: 'same-release', score: 60 })], indexers: [], searchedAt: '', cached: false })
+      .mockResolvedValueOnce({ releases: [release({ guid: 'same-release', score: 86 })], indexers: [], searchedAt: '', cached: false });
+
+    service.considerRequest(7);
+    await settle();
+
+    expect(searchDelay.wait).toHaveBeenCalledTimes(1);
+    expect(releases.search).toHaveBeenNthCalledWith(2, expect.objectContaining({ id: 7 }), {
+      indexerMode: 'isbn-capable',
+      overrides: { isbn: null },
+    });
+    expect(fulfillment.grab).toHaveBeenCalledWith(7, { indexerId: 9, releaseGuid: 'same-release' }, null);
+  });
+
+  it('searches title and author once without waiting when the request has no ISBN', async () => {
+    const { service, releases, searchDelay } = makeService({ releases: [] });
+
+    service.considerRequest(7);
+    await settle();
+
+    expect(releases.search).toHaveBeenCalledTimes(1);
+    expect(releases.search).toHaveBeenCalledWith(expect.objectContaining({ id: 7 }), { indexerMode: 'all' });
+    expect(searchDelay.wait).not.toHaveBeenCalled();
+  });
+
+  /** The whole point of the floor: a poor best release is not grabbed just for being the best. */
+  it('hands a request back to the approver when nothing clears the floor', async () => {
+    const { service, fulfillment } = makeService({ releases: [release({ score: 61 })], settings: { autoGrabMinScore: 80 } });
+
+    service.considerRequest(7);
+    await settle();
+
+    expect(fulfillment.grab).not.toHaveBeenCalled();
+    expect(fulfillment.setRequestStatus).toHaveBeenLastCalledWith(
+      7,
+      'approved',
+      expect.stringContaining('80'),
+      {
+        code: 'BELOW_SCORE_FLOOR',
+        meta: { floor: 80 },
+      },
+      FROM_SEARCHING,
+    );
+  });
+
+  /**
+   * The floor, the profile and the tried list are all answers about releases. Reporting one of them
+   * for a search that never ran sends the approver to tune a number that had no bearing on it.
+   */
+  it('says nothing was searched rather than blaming the score floor when no source is enabled', async () => {
+    const { service, fulfillment } = makeService({
+      releases: [],
+      sourceCounts: { enabledIndexerCount: 0, configuredIndexerCount: 0 },
+    });
+
+    service.considerRequest(7);
+    await settle();
+
+    expect(fulfillment.setRequestStatus).toHaveBeenLastCalledWith(
+      7,
+      'approved',
+      expect.any(String),
+      {
+        code: 'NO_SOURCES_CONFIGURED',
+        meta: undefined,
+      },
+      FROM_SEARCHING,
+    );
+  });
+
+  it('separates every source being switched off from having none at all', async () => {
+    const { service, fulfillment } = makeService({
+      releases: [],
+      sourceCounts: { enabledIndexerCount: 0, configuredIndexerCount: 4 },
+    });
+
+    service.considerRequest(7);
+    await settle();
+
+    expect(fulfillment.setRequestStatus).toHaveBeenLastCalledWith(
+      7,
+      'approved',
+      expect.any(String),
+      {
+        code: 'NO_SOURCES_ENABLED',
+        meta: undefined,
+      },
+      FROM_SEARCHING,
+    );
+  });
+
+  it('says so when sources are enabled but none of them carries this medium', async () => {
+    const { service, fulfillment } = makeService({
+      releases: [],
+      indexers: [],
+      sourceCounts: { enabledIndexerCount: 2, configuredIndexerCount: 2, uncoveredIndexerCount: 2 },
+    });
+
+    service.considerRequest(7);
+    await settle();
+
+    expect(fulfillment.setRequestStatus).toHaveBeenLastCalledWith(
+      7,
+      'approved',
+      expect.any(String),
+      {
+        code: 'MEDIUM_UNCOVERED',
+        meta: undefined,
+      },
+      FROM_SEARCHING,
+    );
+  });
+
+  it('leaves a request with nowhere to file the book for a human, without searching', async () => {
+    const { service, fulfillment, releases } = makeService({ request: { targetLibraryId: null } });
+
+    service.considerRequest(7);
+    await settle();
+
+    expect(releases.search).not.toHaveBeenCalled();
+    expect(fulfillment.setRequestStatus).toHaveBeenCalledWith(
+      7,
+      'approved',
+      expect.stringContaining('destination library'),
+      { code: 'NO_DESTINATION', meta: undefined },
+      FROM_APPROVED,
+    );
+  });
+
+  it('ignores a request that is not in a state a grab may start from', async () => {
+    const { service, fulfillment } = makeService({ request: { status: 'pending' } });
+
+    service.considerRequest(7);
+    await settle();
+
+    expect(fulfillment.setRequestStatus).not.toHaveBeenCalled();
+  });
+
+  /**
+   * Nobody classified this one, so nobody can say what a second attempt would do differently.
+   * Working down the list on a failure we do not understand is guessing with the budget.
+   */
+  it('stops at an unclassified failure rather than working down the list', async () => {
+    const { service, fulfillment } = makeService();
+    fulfillment.grab.mockRejectedValue(new Error('qBittorrent rejected the torrent'));
+
+    service.considerRequest(7);
+    await settle();
+
+    expect(fulfillment.grab).toHaveBeenCalledTimes(1);
+    expect(fulfillment.setRequestStatus).toHaveBeenLastCalledWith(7, 'failed', 'qBittorrent rejected the torrent', null, FROM_SEARCHING);
+  });
+
+  /**
+   * The failure this whole path exists for: one tracker refusing an account says nothing about
+   * the next source down, and the request used to end there with a second source untouched.
+   */
+  it('moves to the next source when a tracker refuses the release', async () => {
+    const { service, fulfillment } = makeService({
+      settings: { autoGrabMinScore: 70 },
+      releases: [
+        release({ indexerId: 9, guid: 'mam-1', score: 89 }),
+        release({ indexerId: 9, guid: 'mam-2', score: 85 }),
+        release({ indexerId: 5, indexerName: 'libgen', guid: 'libgen-1', score: 70 }),
+      ],
+    });
+    fulfillment.grab.mockRejectedValueOnce(refusal('GRAB_SOURCE_REFUSED', 'tracker: the tracker answered 406'));
+
+    service.considerRequest(7);
+    await settle();
+
+    // The refusing source's second release is never tried: it would answer the same way.
+    expect(fulfillment.grab.mock.calls.map((call) => (call[1] as { releaseGuid: string }).releaseGuid)).toEqual(['mam-1', 'libgen-1']);
+    expect(fulfillment.setRequestStatus).toHaveBeenLastCalledWith(7, 'searching', null, null, FROM_APPROVED);
+  });
+
+  /** A tracker that will not serve a VIP-only release to a free account still serves the rest. */
+  it('skips only the VIP-only releases of a source that refused one', async () => {
+    const { service, fulfillment } = makeService({
+      releases: [
+        release({ guid: 'vip-1', vipOnly: true, score: 92 }),
+        release({ guid: 'vip-2', vipOnly: true, score: 90 }),
+        release({ guid: 'open-1', vipOnly: false, score: 84 }),
+      ],
+    });
+    fulfillment.grab.mockRejectedValueOnce(refusal('GRAB_VIP_REQUIRED', 'you are not VIP or higher'));
+
+    service.considerRequest(7);
+    await settle();
+
+    expect(fulfillment.grab.mock.calls.map((call) => (call[1] as { releaseGuid: string }).releaseGuid)).toEqual(['vip-1', 'open-1']);
+  });
+
+  /**
+   * A download client that is down refuses every torrent alike, and says nothing at all about a
+   * source BookOrbit downloads from itself.
+   */
+  it('keeps trying direct downloads after the torrent client refuses one', async () => {
+    const { service, fulfillment } = makeService({
+      settings: { autoGrabMinScore: 70 },
+      releases: [
+        release({ indexerId: 9, guid: 'torrent-1', score: 92 }),
+        release({ indexerId: 4, indexerName: 'other-tracker', guid: 'torrent-2', score: 88 }),
+        release({ indexerId: 5, indexerName: 'libgen', guid: 'direct-1', score: 70 }),
+      ],
+      indexers: [indexerStatus(9, true), indexerStatus(4, true), indexerStatus(5, false)],
+    });
+    fulfillment.grab.mockRejectedValueOnce(refusal('GRAB_CLIENT_REFUSED', 'qBittorrent rejected the torrent'));
+
+    service.considerRequest(7);
+    await settle();
+
+    expect(fulfillment.grab.mock.calls.map((call) => (call[1] as { releaseGuid: string }).releaseGuid)).toEqual(['torrent-1', 'direct-1']);
+  });
+
+  /** The switch is what "stop at the first failure" means, so it has to stop a classified one too. */
+  it('stops at the first refusal when falling back is turned off', async () => {
+    const { service, fulfillment } = makeService({
+      settings: { autoRetryEnabled: false },
+      releases: [release({ guid: 'first' }), release({ indexerId: 5, guid: 'second', score: 80 })],
+    });
+    fulfillment.grab.mockRejectedValueOnce(refusal('GRAB_SOURCE_REFUSED', 'the tracker answered 406'));
+
+    service.considerRequest(7);
+    await settle();
+
+    expect(fulfillment.grab).toHaveBeenCalledTimes(1);
+    expect(fulfillment.setRequestStatus).toHaveBeenLastCalledWith(7, 'failed', 'the tracker answered 406', null, FROM_SEARCHING);
+  });
+
+  it('spends no more than the configured attempts however many sources are left', async () => {
+    const { service, fulfillment } = makeService({
+      settings: { maxAutoGrabAttempts: 2 },
+      releases: [
+        release({ indexerId: 9, guid: 'one', score: 92 }),
+        release({ indexerId: 5, indexerName: 'two', guid: 'two', score: 88 }),
+        release({ indexerId: 3, indexerName: 'three', guid: 'three', score: 84 }),
+      ],
+    });
+    fulfillment.grab.mockRejectedValue(refusal('GRAB_SOURCE_REFUSED', 'refused'));
+
+    service.considerRequest(7);
+    await settle();
+
+    expect(fulfillment.grab).toHaveBeenCalledTimes(2);
+  });
+
+  /** One refusal explains itself; several need the count, or the last one reads as the only one. */
+  it('summarises the chain on the request when more than one release was refused', async () => {
+    const { service, fulfillment } = makeService({
+      releases: [
+        release({ indexerId: 9, indexerName: 'tracker', guid: 'one', score: 92 }),
+        release({ indexerId: 5, indexerName: 'libgen', guid: 'two', score: 88 }),
+      ],
+    });
+    fulfillment.grab
+      .mockRejectedValueOnce(refusal('GRAB_SOURCE_REFUSED', 'tracker: the tracker answered 406'))
+      .mockRejectedValueOnce(refusal('GRAB_SOURCE_REFUSED', 'libgen: the mirror answered 503'));
+
+    service.considerRequest(7);
+    await settle();
+
+    const [, , reason] = fulfillment.setRequestStatus.mock.calls.at(-1) as [number, string, string];
+    expect(reason).toContain('Tried 2 releases from 2 sources');
+    expect(reason).toContain('libgen: the mirror answered 503');
+  });
+
+  /**
+   * The one automation dead end that used to announce nothing. With the download client down,
+   * every auto-approved request landed in `failed` with nobody told: its requester was never told
+   * it existed and cannot open the picker, and the approvers had no reason to look.
+   */
+  it('tells the approvers when every release an auto-approved request tried was refused', async () => {
+    const { service, notifier, fulfillment } = makeService({ releases: [release({ score: 92 })] });
+    fulfillment.grab.mockRejectedValue(refusal('GRAB_CLIENT_REFUSED', 'the download client refused the torrent'));
+
+    service.considerRequest(7, 'auto_approval');
+    await settle();
+
+    expect(fulfillment.setRequestStatus).toHaveBeenLastCalledWith(7, 'failed', expect.any(String), null, FROM_SEARCHING);
+    expect(notifier.notifyApprovers).toHaveBeenCalledTimes(1);
+  });
+
+  /** An approver watching the queue does not need telling about a request they just approved. */
+  it('stays quiet about refused releases when an approver set the attempt off', async () => {
+    const { service, notifier, fulfillment } = makeService({ releases: [release({ score: 92 })] });
+    fulfillment.grab.mockRejectedValue(refusal('GRAB_CLIENT_REFUSED', 'the download client refused the torrent'));
+
+    service.considerRequest(7);
+    await settle();
+
+    expect(notifier.notifyApprovers).not.toHaveBeenCalled();
+  });
+
+  /** A request an approver grabbed mid-pass keeps their download, and nobody is told it failed. */
+  it('announces nothing when the failures could not be written', async () => {
+    const { service, notifier, fulfillment } = makeService({ releases: [release({ score: 92 })] });
+    fulfillment.grab.mockRejectedValue(refusal('GRAB_CLIENT_REFUSED', 'the download client refused the torrent'));
+    fulfillment.setRequestStatus.mockImplementation((_id: number, status: string) => Promise.resolve(status !== 'failed'));
+
+    service.considerRequest(7, 'auto_approval');
+    await settle();
+
+    expect(notifier.notifyApprovers).not.toHaveBeenCalled();
+  });
+});
+
+describe('RequestAutomationService retry', () => {
+  function fail(service: RequestAutomationService, events: { on: ReturnType<typeof vi.fn> }, downloadId = 11) {
+    service.onModuleInit();
+    const [event, listener] = events.on.mock.calls[0] as [string, (id: number) => void];
+    expect(event).toBe(BOOK_REQUEST_DOWNLOAD_FAILED);
+    listener(downloadId);
+    return settle();
+  }
+
+  it('falls back to the next-best release the request has not already tried', async () => {
+    const { service, events, fulfillment } = makeService({
+      request: { status: 'failed' },
+      releases: [release({ guid: 'tried-one' }), release({ guid: 'next-best', score: 88 })],
+      tried: ['9:tried-one'],
+      attempts: 1,
+    });
+
+    await fail(service, events);
+
+    expect(fulfillment.grab).toHaveBeenCalledWith(7, { indexerId: 9, releaseGuid: 'next-best' }, null);
+  });
+
+  /**
+   * A release an approver picked failed for a reason they chose. Swapping in the runner-up behind
+   * their back is not automation, it is overruling them.
+   */
+  it('leaves a hand-picked release alone', async () => {
+    const { service, events, fulfillment } = makeService({ request: { status: 'failed' }, download: { automated: false } });
+
+    await fail(service, events);
+
+    expect(fulfillment.grab).not.toHaveBeenCalled();
+  });
+
+  /**
+   * And leaves the request exactly as the failure left it: "gave up after three attempts" would
+   * overwrite what actually went wrong, which is the part an approver has to read.
+   */
+  it('stops once the attempt limit is spent, without rewriting the failure reason', async () => {
+    const { service, events, fulfillment } = makeService({ request: { status: 'failed' }, attempts: 3, settings: { maxAutoGrabAttempts: 3 } });
+
+    await fail(service, events);
+
+    expect(fulfillment.grab).not.toHaveBeenCalled();
+    expect(fulfillment.setRequestStatus).not.toHaveBeenCalled();
+  });
+
+  it('does not leave a request sitting at searching when the indexers could not be reached', async () => {
+    const { service, events, fulfillment, releases } = makeService({ request: { status: 'failed' }, attempts: 1 });
+    releases.search.mockRejectedValue(new Error('every indexer timed out'));
+
+    await fail(service, events);
+
+    expect(fulfillment.setRequestStatus).toHaveBeenLastCalledWith(
+      7,
+      'failed',
+      expect.stringContaining('every indexer timed out'),
+      {
+        code: 'SEARCH_FAILED',
+        meta: { detail: 'every indexer timed out' },
+      },
+      FROM_SEARCHING,
+    );
+  });
+
+  it('does not retry when the operator turned retries off', async () => {
+    const { service, events, fulfillment, downloads } = makeService({ request: { status: 'failed' }, settings: { autoRetryEnabled: false } });
+
+    await fail(service, events);
+
+    expect(downloads.findById).not.toHaveBeenCalled();
+    expect(fulfillment.grab).not.toHaveBeenCalled();
+  });
+
+  /** Turning auto-grab off mid-flight is an operator saying stop, retries included. */
+  it('does not retry once unattended grabbing has been turned off', async () => {
+    const { service, events, fulfillment } = makeService({ request: { status: 'failed' }, settings: { autoGrabEnabled: false } });
+
+    await fail(service, events);
+
+    expect(fulfillment.grab).not.toHaveBeenCalled();
+  });
+
+  it('returns a request to failed, not approved, when a retry finds nothing left to try', async () => {
+    const { service, events, fulfillment } = makeService({
+      request: { status: 'failed' },
+      releases: [release({ guid: 'tried-one' })],
+      tried: ['9:tried-one'],
+      attempts: 1,
+    });
+
+    await fail(service, events);
+
+    expect(fulfillment.setRequestStatus).toHaveBeenLastCalledWith(
+      7,
+      'failed',
+      expect.any(String),
+      { code: 'ALL_TRIED', meta: undefined },
+      FROM_SEARCHING,
+    );
+  });
+
+  /**
+   * "Nothing scored well enough" sends an approver off to add indexers they do not need. Having
+   * already tried the only good release is a different problem and has to say so.
+   */
+  it('says the good releases are spent rather than claiming none were good enough', async () => {
+    const { service, events, fulfillment } = makeService({
+      request: { status: 'failed' },
+      releases: [release({ guid: 'tried-one', score: 95 })],
+      tried: ['9:tried-one'],
+      attempts: 1,
+    });
+
+    await fail(service, events);
+
+    const [, , reason] = fulfillment.setRequestStatus.mock.calls.at(-1) as [number, string, string];
+    expect(reason).toContain('already been tried');
+    expect(reason).not.toContain('scored');
+  });
+
+  it('still reports a genuinely weak field as nothing clearing the floor', async () => {
+    const { service, events, fulfillment } = makeService({
+      request: { status: 'failed' },
+      releases: [release({ guid: 'weak', score: 20 })],
+      attempts: 1,
+    });
+
+    await fail(service, events);
+
+    expect(fulfillment.setRequestStatus).toHaveBeenLastCalledWith(
+      7,
+      'failed',
+      expect.stringContaining('scored 80 or better'),
+      {
+        code: 'BELOW_SCORE_FLOOR',
+        meta: { floor: 80 },
+      },
+      FROM_SEARCHING,
+    );
+  });
+});
+
+/**
+ * The wanted list. Every other path here is set off by something a person did; without this one a
+ * request declined for want of a good enough release, or for a book whose first release is posted
+ * next month, sits at `approved` forever and looks like work somebody has already taken.
+ */
+describe('RequestAutomationService.sweepUnfulfilled', () => {
+  const searchable = { autoSearchEnabled: true, autoGrabEnabled: true };
+
+  it('searches again for every request that is due', async () => {
+    const { service, requests, releases } = makeService({ settings: searchable, due: [{ id: 7 }, { id: 7 }] });
+
+    await service.sweepUnfulfilled();
+
+    expect(requests.findDueForResearch).toHaveBeenCalledWith(24, 60, 8, 7 * 24 * 60 * 60 * 1000, 25);
+    expect(releases.search).toHaveBeenCalledTimes(2);
+  });
+
+  it('grabs a release that has since appeared', async () => {
+    const { service, fulfillment } = makeService({ settings: searchable, due: [{ id: 7 }] });
+
+    await service.sweepUnfulfilled();
+
+    expect(fulfillment.grab).toHaveBeenCalledWith(7, { indexerId: 9, releaseGuid: 'release-1' }, null);
+  });
+
+  it('asks for nothing while the sweep is switched off', async () => {
+    const { service, requests } = makeService({ settings: { autoSearchEnabled: false, autoGrabEnabled: true }, due: [{ id: 7 }] });
+
+    await service.sweepUnfulfilled();
+
+    expect(requests.findDueForResearch).not.toHaveBeenCalled();
+  });
+
+  /** A search has nothing to do with what it finds while auto-grab is off: it only costs traffic. */
+  it('asks for nothing while unattended grabbing is off', async () => {
+    const { service, requests } = makeService({ settings: { autoSearchEnabled: true, autoGrabEnabled: false }, due: [{ id: 7 }] });
+
+    await service.sweepUnfulfilled();
+
+    expect(requests.findDueForResearch).not.toHaveBeenCalled();
+  });
+
+  it('waits between requests rather than searching every tracker at once', async () => {
+    const { service, searchDelay } = makeService({ settings: searchable, due: [{ id: 7 }, { id: 7 }, { id: 7 }] });
+
+    await service.sweepUnfulfilled();
+
+    // Between the requests, not before the first: three requests, two waits.
+    expect(searchDelay.wait.mock.calls.length).toBeGreaterThanOrEqual(2);
+  });
+
+  /** The next tick reaches every row again, so one bad request must not end the sweep it is in. */
+  it('carries on past a request that threw', async () => {
+    const { service, requests, releases } = makeService({ settings: searchable, due: [{ id: 7 }, { id: 7 }] });
+    requests.findById.mockRejectedValueOnce(new Error('the database went away'));
+
+    await expect(service.sweepUnfulfilled()).resolves.toBeUndefined();
+    expect(releases.search).toHaveBeenCalledTimes(1);
+  });
+
+  /** A sweep can outlast its own interval on a slow tracker, and two would search everything twice. */
+  it('does not start a second sweep on top of one already running', async () => {
+    const { service, requests } = makeService({ settings: searchable, due: [{ id: 7 }] });
+    let release!: () => void;
+    requests.findDueForResearch.mockImplementationOnce(() => new Promise((resolve) => (release = () => resolve([]))));
+
+    const first = service.sweepUnfulfilled();
+    await service.sweepUnfulfilled();
+    release();
+    await first;
+
+    expect(requests.findDueForResearch).toHaveBeenCalledTimes(1);
+  });
+
+  /**
+   * A budget spent is a fact an approver already read off the row. Restating it nightly would
+   * overwrite what actually went wrong and broadcast a change nobody made.
+   */
+  it('leaves a request whose attempt budget is spent exactly as it found it', async () => {
+    const { service, fulfillment } = makeService({
+      settings: { ...searchable, maxAutoGrabAttempts: 3 },
+      attempts: 3,
+      due: [{ id: 7 }],
+    });
+
+    await service.sweepUnfulfilled();
+
+    expect(fulfillment.setRequestStatus).not.toHaveBeenCalled();
+  });
+});
diff --git a/server/src/modules/book-request/fulfillment/request-automation.service.ts b/server/src/modules/book-request/fulfillment/request-automation.service.ts
new file mode 100644
index 000000000..82d508390
--- /dev/null
+++ b/server/src/modules/book-request/fulfillment/request-automation.service.ts
@@ -0,0 +1,643 @@
+import { Injectable, Logger, OnModuleInit } from '@nestjs/common';
+import { Cron, CronExpression } from '@nestjs/schedule';
+import {
+  AUTO_SEARCH_BACKOFF_WEEK_MS,
+  compareByTier,
+  findGrabRefusal,
+  isGrabbableBookRequestStatus,
+  MAX_AUTO_SEARCH_BACKOFF_FACTOR,
+  NotificationType,
+  releaseProfileIsActive,
+} from '@bookorbit/types';
+import type {
+  BookRequestAutomationSettings,
+  BookRequestFailureMeta,
+  BookRequestHandbackCode,
+  BookRequestStatus,
+  GrabFailureCode,
+  GrabRefusal,
+  IndexerSearchStatus,
+  ReleaseCandidateItem,
+} from '@bookorbit/types';
+
+import { sanitizeLogValue } from '../../../common/utils/log-sanitize.utils';
+import type { BookRequestRow } from '../../../db/schema';
+import { BOOK_REQUEST_DOWNLOAD_FAILED, BookRequestEventsService } from '../book-request-events.service';
+import { BookRequestNotifier } from '../book-request-notifier.service';
+import { BookRequestRepository } from '../book-request.repository';
+import { bookRequestSearchIsbns, type IndexerSearchMode, IndexerSearchService } from '../indexers/indexer-search.service';
+import { BookRequestDownloadRepository } from './book-request-download.repository';
+import { grabFailureCode, RequestAlreadyClaimedException, RequestFulfillmentService } from './request-fulfillment.service';
+import { RequestAutomationSearchDelay } from './request-automation-search-delay.service';
+import { RequestAutomationSettingsService } from './request-automation-settings.service';
+
+/**
+ * What set an attempt off, which decides where a request lands when nothing is grabbable and
+ * whether anybody is told about it.
+ *
+ * `approval` and `auto_approval` behave identically until automation gives up. They differ in who
+ * is watching: an approver who just approved is looking at the queue, while an auto-approved
+ * request was never in anybody's queue and its requester cannot open the picker, so a hand-back
+ * nobody announces is a request that waits forever.
+ */
+type AutomationTrigger = 'approval' | 'auto_approval' | 'retry' | 'periodic';
+
+/**
+ * One sweep's worth of requests to look for again. A backlog is worked off over several ticks
+ * rather than in one pass that would search every enabled tracker fifty times in a row.
+ */
+const RESEARCH_SWEEP_LIMIT = 25;
+
+/**
+ * The one status an automation pass may write a terminal result from: the one it claimed itself.
+ *
+ * `searching` is deliberately grabbable, so an approver can pick a release mid-pass. Everything
+ * the pass tries afterwards is refused, and without this its "no release could be started" would
+ * land on the healthy download they just started.
+ */
+const CLAIMED_BY_THIS_PASS: readonly BookRequestStatus[] = ['searching'];
+
+/** The prose that accompanies each code. English on purpose; the code is what the UI translates. */
+interface Handback {
+  code: BookRequestHandbackCode;
+  reason: string;
+  meta?: BookRequestFailureMeta;
+}
+
+/** One release that was handed over and refused, kept for the reason the request ends up carrying. */
+interface AttemptFailure {
+  indexerName: string;
+  message: string;
+}
+
+/**
+ * Grabs without an approver, when the top release is good enough to be worth grabbing unattended.
+ *
+ * Off by default. Book matching is hard - editions, abridgements, translations, three different
+ * books called It - so this is a score floor an operator raises or lowers deliberately, and a
+ * request that clears nothing simply waits for a human with the reason written on it.
+ */
+@Injectable()
+export class RequestAutomationService implements OnModuleInit {
+  private readonly logger = new Logger(RequestAutomationService.name);
+  /** A sweep can outlast an hour on a slow tracker, and two of them would search everything twice. */
+  private sweeping = false;
+
+  constructor(
+    private readonly settings: RequestAutomationSettingsService,
+    private readonly requests: BookRequestRepository,
+    private readonly downloads: BookRequestDownloadRepository,
+    private readonly releases: IndexerSearchService,
+    private readonly fulfillment: RequestFulfillmentService,
+    private readonly events: BookRequestEventsService,
+    private readonly notifier: BookRequestNotifier,
+    private readonly searchDelay: RequestAutomationSearchDelay,
+  ) {}
+
+  onModuleInit(): void {
+    this.events.on(BOOK_REQUEST_DOWNLOAD_FAILED, (downloadId: number) => {
+      void this.handleFailure(downloadId).catch((error: unknown) => {
+        const message = sanitizeLogValue(error instanceof Error ? error.message : String(error));
+        this.logger.error(`[book_request.auto_retry] [fail] downloadId=${downloadId} error="${message}" - retry handler failed`);
+      });
+    });
+  }
+
+  /**
+   * Called after an approval, and after an auto-approved user submits. Deliberately fire and
+   * forget: searching every enabled indexer can take twenty seconds, and an approver should not
+   * hold an HTTP request open for it. The request moves to `searching` so the UI says what is
+   * happening, and the gateway pushes it on from there.
+   */
+  considerRequest(requestId: number, trigger: Exclude<AutomationTrigger, 'retry'> = 'approval'): void {
+    void this.runAttempt(requestId, trigger).catch((error: unknown) => {
+      const message = sanitizeLogValue(error instanceof Error ? error.message : String(error));
+      this.logger.error(`[book_request.auto_grab] [fail] requestId=${requestId} error="${message}" - auto-grab attempt failed`);
+    });
+  }
+
+  /**
+   * The wanted list: approved requests nothing has found a release for yet, looked for again.
+   *
+   * Everywhere else in this service an attempt is set off by something a person did. Without this
+   * one, a request declined for want of a good enough release - or for a book whose first release
+   * is posted next month - sits at `approved` forever, and the only thing that would ever find it
+   * is somebody reopening the picker by hand. That is the one gap the pipeline has no other answer
+   * to, and it is invisible: the request looks like work somebody has already taken.
+   *
+   * Hourly rather than on the operator's interval, because the interval is per request and each
+   * row carries its own clock. A tick with nothing due costs one bounded query.
+   *
+   * Sequential, like `runBulk` and for the same reason: twenty-five simultaneous searches against
+   * one private tracker is what a rate limit looks like from the other side. `runAttempt` claims
+   * conditionally and is safe to re-enter, so a request an approver acts on mid-sweep is left
+   * alone by the pass that reaches it.
+   */
+  @Cron(CronExpression.EVERY_HOUR)
+  async sweepUnfulfilled(): Promise<void> {
+    if (this.sweeping) return;
+    const startedAt = Date.now();
+    this.sweeping = true;
+    try {
+      await this.researchDueRequests();
+    } catch (error: unknown) {
+      const message = sanitizeLogValue(error instanceof Error ? error.message : String(error));
+      const errorClass = error instanceof Error ? error.constructor.name : 'UnknownError';
+      this.logger.warn(
+        `[book_request.auto_search] [fail] durationMs=${Date.now() - startedAt} errorClass=${errorClass} error="${message}" - the periodic re-search sweep failed`,
+      );
+    } finally {
+      this.sweeping = false;
+    }
+  }
+
+  private async researchDueRequests(): Promise<void> {
+    const settings = await this.settings.get();
+    // Both, because an unattended search has nothing to do with what it finds while auto-grab is
+    // off: every request it touched would be handed straight back, having cost a real search.
+    if (!settings.autoSearchEnabled || !settings.autoGrabEnabled) return;
+
+    const due = await this.requests.findDueForResearch(
+      settings.autoSearchIntervalHours,
+      settings.autoSearchMaxAgeDays,
+      MAX_AUTO_SEARCH_BACKOFF_FACTOR,
+      AUTO_SEARCH_BACKOFF_WEEK_MS,
+      RESEARCH_SWEEP_LIMIT,
+    );
+    if (due.length === 0) return;
+
+    const startedAt = Date.now();
+    this.logger.log(
+      `[book_request.auto_search] [start] due=${due.length} intervalHours=${settings.autoSearchIntervalHours} maxAgeDays=${settings.autoSearchMaxAgeDays} - looking again for requests nothing has found`,
+    );
+
+    let searched = 0;
+    for (const [index, row] of due.entries()) {
+      if (index > 0) await this.searchDelay.wait();
+      // Each pass reloads the row and re-runs every guard, so one that throws must not take the
+      // rest of the sweep with it; the next tick will reach the row again either way.
+      const requestStartedAt = Date.now();
+      try {
+        await this.runAttempt(row.id, 'periodic', settings);
+        searched++;
+      } catch (error: unknown) {
+        const message = sanitizeLogValue(error instanceof Error ? error.message : String(error));
+        const errorClass = error instanceof Error ? error.constructor.name : 'UnknownError';
+        this.logger.warn(
+          `[book_request.auto_search] [fail] requestId=${row.id} durationMs=${Date.now() - requestStartedAt} errorClass=${errorClass} error="${message}" - re-searching this request failed`,
+        );
+      }
+    }
+
+    this.logger.log(
+      `[book_request.auto_search] [end] due=${due.length} searched=${searched} limit=${RESEARCH_SWEEP_LIMIT} durationMs=${Date.now() - startedAt} - periodic re-search finished`,
+    );
+  }
+
+  private async handleFailure(downloadId: number): Promise<void> {
+    const settings = await this.settings.get();
+    if (!settings.autoRetryEnabled) return;
+
+    const download = await this.downloads.findById(downloadId);
+    // A release an approver picked by hand failed for a reason they chose. Replacing it with the
+    // runner-up behind their back is not automation, it is overruling them.
+    if (!download?.automated) return;
+
+    await this.runAttempt(download.requestId, 'retry', settings);
+  }
+
+  private async runAttempt(requestId: number, trigger: AutomationTrigger, preloaded?: BookRequestAutomationSettings): Promise<void> {
+    const settings = preloaded ?? (await this.settings.get());
+
+    const joined = await this.requests.findById(requestId);
+    if (!joined) return;
+    const request = joined.request;
+    if (!isGrabbableBookRequestStatus(request.status as BookRequestStatus)) return;
+
+    // What the guards below are reasoning about, and therefore the only status any of them may
+    // write a decision from. Every one of them runs before this pass has claimed anything, so a
+    // request that moves on underneath them belongs to whoever moved it.
+    const observed: readonly BookRequestStatus[] = [request.status as BookRequestStatus];
+
+    // After the guards, not before them: this writes a status, and `considerRequest` is fire and
+    // forget, so a request cancelled in the meantime would otherwise be resurrected to `approved`.
+    if (!settings.autoGrabEnabled) {
+      // An approver who just approved is about to open the picker, and stamping "automatic
+      // grabbing is off" on every approval an operator never asked to automate is noise. An
+      // auto-approved request has nobody behind it, so the same silence strands it.
+      if (trigger === 'auto_approval') {
+        await this.decline(requestId, trigger, observed, {
+          code: 'AUTOMATION_DISABLED',
+          reason: 'Automatic grabbing is off, so this one needs a release picked by hand',
+        });
+      }
+      return;
+    }
+
+    // Grab refuses a request with nowhere to file the book, so say so here rather than letting a
+    // whole download run and stop at the last step.
+    if (request.targetLibraryId === null) {
+      await this.decline(requestId, trigger, observed, {
+        code: 'NO_DESTINATION',
+        reason: 'Automatic grab needs a destination library on the request',
+      });
+      return;
+    }
+
+    const spent = await this.downloads.countAutomatedForRequest(requestId);
+    if (spent >= settings.maxAutoGrabAttempts) {
+      this.logger.log(
+        `[book_request.auto_grab] [end] requestId=${requestId} trigger=${trigger} attempts=${spent} limit=${settings.maxAutoGrabAttempts} - attempt limit reached, leaving it for an approver`,
+      );
+      // A spent budget leaves the request exactly as the failure left it. "Gave up after three
+      // attempts" would overwrite what actually went wrong, which is the part an approver needs.
+      // Only said to whoever just approved, too: a periodic pass restating it every night would
+      // rewrite the same reason and broadcast a change nobody made.
+      if (trigger === 'approval' || trigger === 'auto_approval') {
+        await this.decline(requestId, trigger, observed, {
+          code: 'ATTEMPT_LIMIT',
+          reason: `Automatic fulfilment gave up after ${spent} attempts`,
+          meta: { attempts: spent },
+        });
+      }
+      return;
+    }
+
+    // The claim on the work, and the last check before anything is asked of a tracker. A plain
+    // compare-and-set against the status the guards above ran on: this is fire and forget, so a
+    // request cancelled in the meantime would otherwise cost a search against every enabled
+    // indexer, and one somebody grabbed a release for by hand would have `searching` stamped over
+    // a live download.
+    if (!(await this.fulfillment.setRequestStatus(requestId, 'searching', null, null, [request.status as BookRequestStatus]))) {
+      this.logger.log(
+        `[book_request.auto_grab] [end] requestId=${requestId} trigger=${trigger} from=${request.status} - the request moved on before the search started, so nothing was searched`,
+      );
+      return;
+    }
+
+    const pick = await this.pickReleases(request, settings).catch((error: unknown) => {
+      const message = error instanceof Error ? error.message : String(error);
+      this.logger.warn(
+        `[book_request.auto_grab] [fail] requestId=${requestId} trigger=${trigger} error="${sanitizeLogValue(message)}" - release search failed`,
+      );
+      return new Error(message);
+    });
+
+    // A search that threw must not leave the request sitting at "searching" with nobody told.
+    if (pick instanceof Error) {
+      await this.decline(requestId, trigger, CLAIMED_BY_THIS_PASS, {
+        code: 'SEARCH_FAILED',
+        reason: `Could not search for a release: ${pick.message}`,
+        meta: { detail: pick.message },
+      });
+      return;
+    }
+
+    if (pick.candidates.length === 0) {
+      // "Nothing scored well enough" and "everything that did has already been tried" are
+      // different problems, and only one of them is fixed by adding an indexer. A search that
+      // never ran is a third: reporting a score floor for it points the operator at a number that
+      // had no bearing on anything, and reads as a judgement about a book nothing ever looked for.
+      const scoredNothing: Handback = pick.profileExcludedAll
+        ? {
+            code: 'PROFILE_EXCLUDED_ALL',
+            reason: 'No release matched the profile for this medium, so this one needs a release picked by hand',
+          }
+        : pick.allTried
+          ? {
+              code: 'ALL_TRIED',
+              reason: 'Every release good enough to grab has already been tried for this request, so it needs a release picked by hand',
+            }
+          : {
+              code: 'BELOW_SCORE_FLOOR',
+              reason: `No release scored ${settings.autoGrabMinScore} or better, so this one needs a release picked by hand`,
+              meta: { floor: settings.autoGrabMinScore },
+            };
+      const handback = this.nothingSearched(pick) ?? scoredNothing;
+      this.logger.log(
+        `[book_request.auto_grab] [end] requestId=${requestId} trigger=${trigger} attempt=${spent + 1} picked=none code=${handback.code} enabled=${pick.enabledIndexerCount} allTried=${pick.allTried} floor=${settings.autoGrabMinScore} - nothing left to grab`,
+      );
+      await this.decline(requestId, trigger, CLAIMED_BY_THIS_PASS, handback);
+      return;
+    }
+
+    await this.grabFirstThatStarts(requestId, trigger, settings, pick, spent);
+  }
+
+  /**
+   * Works down the ranked list until something is actually downloading.
+   *
+   * A refusal is an answer about one thing, and the failover is built on which thing: a tracker
+   * that will not serve a VIP-only release still serves its ordinary ones, a tracker that rejects
+   * the account serves nothing, and a download client that is down refuses every torrent while
+   * saying nothing about a source BookOrbit fetches from itself. Skipping what the refusal already
+   * ruled out is what stops the budget being spent three times on the same "no".
+   */
+  private async grabFirstThatStarts(
+    requestId: number,
+    trigger: AutomationTrigger,
+    settings: BookRequestAutomationSettings,
+    pick: ReleasePicks,
+    alreadySpent: number,
+  ): Promise<void> {
+    const blocked = new BlockedSources(pick.indexers);
+    const failures: AttemptFailure[] = [];
+    const limit = settings.maxAutoGrabAttempts;
+    let spent = alreadySpent;
+    let skipped = 0;
+
+    for (const release of pick.candidates) {
+      if (spent >= limit) break;
+      if (blocked.blocks(release)) {
+        skipped++;
+        continue;
+      }
+
+      spent++;
+      try {
+        await this.fulfillment.grab(requestId, { indexerId: release.indexerId, releaseGuid: release.guid }, null);
+        this.logger.log(
+          `[book_request.auto_grab] [end] requestId=${requestId} trigger=${trigger} attempt=${spent}/${limit} indexerId=${release.indexerId} indexer="${sanitizeLogValue(release.indexerName)}" score=${release.score} skipped=${skipped} refused=${failures.length} floor=${settings.autoGrabMinScore} - grabbed unattended`,
+        );
+        return;
+      } catch (error: unknown) {
+        const message = error instanceof Error ? error.message : String(error);
+        const code = grabFailureCode(error);
+        failures.push({ indexerName: release.indexerName, message });
+
+        // An untagged failure is one nobody classified, which means nobody can say what a second
+        // attempt would do differently. Stopping is the honest answer; so is stopping when the
+        // operator asked for a single attempt, and so is somebody else having taken the request:
+        // every remaining candidate would be refused for that same reason.
+        const claimed = error instanceof RequestAlreadyClaimedException;
+        const halt = claimed || code === null || !settings.autoRetryEnabled;
+        if (code !== null && !claimed) blocked.record(release, code);
+
+        this.logger.warn(
+          `[book_request.auto_grab] [fail] requestId=${requestId} trigger=${trigger} attempt=${spent}/${limit} indexerId=${release.indexerId} indexer="${sanitizeLogValue(release.indexerName)}" release="${sanitizeLogValue(release.title)}" score=${release.score} code=${code ?? 'unclassified'} error="${sanitizeLogValue(message)}" - ${nextStepDescription(code, halt)}`,
+        );
+        if (halt) break;
+      }
+    }
+
+    this.logger.log(
+      `[book_request.auto_grab] [end] requestId=${requestId} trigger=${trigger} attempts=${spent}/${limit} refused=${failures.length} skipped=${skipped} candidates=${pick.candidates.length} - no release could be started`,
+    );
+
+    // Something was handed over and refused, so the request failed whatever set it off: `failed`
+    // is the status whose picker leads with the reason and offers another release. Conditional on
+    // this pass's own claim, so an approver who grabbed a release mid-pass keeps their download
+    // rather than watching it be stamped failed.
+    if (failures.length > 0) {
+      if (!(await this.fulfillment.setRequestStatus(requestId, 'failed', summarizeFailures(failures), null, CLAIMED_BY_THIS_PASS))) {
+        this.logger.log(
+          `[book_request.auto_grab] [end] requestId=${requestId} trigger=${trigger} - the request was taken over while the pass was running, so its failures were not written`,
+        );
+        return;
+      }
+      // The same reason `decline` announces: an auto-approved request has nobody behind it. Nobody
+      // was told it existed and its requester cannot open the picker, so a `failed` row nothing
+      // announces is a dead end - which, with the download client down, is where every
+      // auto-approved request quietly ends up.
+      await this.announceUnattended(
+        requestId,
+        trigger,
+        'GRABS_REFUSED',
+        (title) => `"${title}" was approved without a decision and every release BookOrbit tried was refused`,
+      );
+      return;
+    }
+    await this.decline(requestId, trigger, CLAIMED_BY_THIS_PASS, {
+      code: 'ALL_BLOCKED',
+      reason: 'Every release good enough to grab was ruled out by an earlier failure, so this one needs a release picked by hand',
+    });
+  }
+
+  /**
+   * Why no source was asked anything, where that is what happened. Null when a search really ran
+   * and the empty list is a fact about the book rather than about the instance.
+   */
+  private nothingSearched(pick: ReleasePicks): Handback | null {
+    if (pick.enabledIndexerCount === 0) {
+      return pick.configuredIndexerCount === 0
+        ? { code: 'NO_SOURCES_CONFIGURED', reason: 'No search source is configured, so nothing was searched' }
+        : { code: 'NO_SOURCES_ENABLED', reason: 'Every search source is switched off, so nothing was searched' };
+    }
+    if (pick.indexers.length === 0 && pick.uncoveredIndexerCount > 0) {
+      return { code: 'MEDIUM_UNCOVERED', reason: 'No enabled search source carries this kind of book, so nothing was searched' };
+    }
+    return null;
+  }
+
+  /**
+   * Searches the recommended ISBN, one alternate ISBN, then title and author, stopping as soon as
+   * an untried release clears the profile and score floor. Indexers without ISBN search support
+   * participate in the first pass by title and author and are not called again.
+   *
+   * `allTried` separates the two ways of coming back empty, because they read very differently to
+   * whoever picks up the request: nothing was good enough, or nothing new is left.
+   */
+  private async pickReleases(request: BookRequestRow, settings: BookRequestAutomationSettings): Promise<ReleasePicks> {
+    const profiled = releaseProfileIsActive(settings.profiles[request.mediaKind]);
+    const tried = await this.downloads.findTriedReleaseKeys(request.id);
+    const releases = new Map<string, ReleaseCandidateItem>();
+    const indexers = new Map<number, IndexerSearchStatus>();
+    const isbns = bookRequestSearchIsbns(request).slice(0, 2);
+    const variants: AutomationSearchVariant[] =
+      isbns.length === 0
+        ? [{ indexerMode: 'all' }]
+        : [
+            { indexerMode: 'all' },
+            ...isbns.slice(1).map((isbn) => ({ indexerMode: 'isbn-capable' as const, isbn })),
+            { indexerMode: 'isbn-capable', isbn: null },
+          ];
+
+    let picks: ReleasePicks = {
+      candidates: [],
+      indexers: [],
+      allTried: false,
+      profileExcludedAll: false,
+      enabledIndexerCount: 0,
+      configuredIndexerCount: 0,
+      uncoveredIndexerCount: 0,
+    };
+
+    for (const [index, variant] of variants.entries()) {
+      if (index > 0) await this.searchDelay.wait();
+
+      const result = await this.releases.search(request, {
+        indexerMode: variant.indexerMode,
+        ...(variant.isbn !== undefined ? { overrides: { isbn: variant.isbn } } : {}),
+      });
+      for (const status of result.indexers) indexers.set(status.indexerId, status);
+      for (const release of result.releases) {
+        const key = `${release.indexerId}:${release.guid}`;
+        const current = releases.get(key);
+        if (!current || release.score > current.score) releases.set(key, release);
+      }
+
+      const ranked = [...releases.values()].sort(
+        (a, b) => compareByTier(a.tier, b.tier) || b.score - a.score || (b.seeders ?? -1) - (a.seeders ?? -1),
+      );
+
+      // A release matching no tier is never grabbed unattended. It stays in the picker for a person
+      // to choose, which is the whole point of the untiered state: the operator said what they want,
+      // and anything else is a decision they have not delegated.
+      const inProfile = profiled ? ranked.filter((release) => release.tier !== null) : ranked;
+      const cleared = inProfile.filter((release) => release.score >= settings.autoGrabMinScore);
+      const candidates = cleared.filter((release) => !tried.has(`${release.indexerId}:${release.guid}`));
+
+      picks = {
+        candidates,
+        indexers: [...indexers.values()],
+        allTried: candidates.length === 0 && cleared.length > 0,
+        // Only when the profile is what emptied the list. Without this the operator is told nothing
+        // scored well enough, while the picker in front of them is full of releases that did.
+        profileExcludedAll: profiled && inProfile.length === 0 && ranked.length > 0,
+        enabledIndexerCount: result.enabledIndexerCount,
+        configuredIndexerCount: result.configuredIndexerCount,
+        // From whichever variant ran last. The medium filter runs before the ISBN-capable
+        // narrowing, so every variant of one pass reports the same number.
+        uncoveredIndexerCount: result.uncoveredIndexerCount,
+      };
+      if (candidates.length > 0) return picks;
+    }
+
+    return picks;
+  }
+
+  /**
+   * Hands the request back to a person with the reason on it. A retry that finds nothing returns
+   * to `failed`, because something did go wrong; an approval that finds nothing returns to
+   * `approved`, which is exactly where an approver picks a release themselves.
+   *
+   * An auto-approved request is the one case where handing back is not enough. Nobody was told it
+   * existed, its requester cannot open the picker, and it now sits in a queue looking like work
+   * somebody has already taken. A retry is not announced here because `failDownload` has already
+   * notified the approvers about the failure that set it off.
+   */
+  private async decline(requestId: number, trigger: AutomationTrigger, from: readonly BookRequestStatus[], handback: Handback): Promise<void> {
+    // Nothing is announced unless the handback itself committed: a request somebody cancelled,
+    // filed or grabbed a release for while automation was running is not one to hand back, and
+    // telling the approvers it needs a release would point them at work that is already over.
+    const handedBack = await this.fulfillment.setRequestStatus(
+      requestId,
+      trigger === 'retry' ? 'failed' : 'approved',
+      handback.reason,
+      { code: handback.code, meta: handback.meta },
+      from,
+    );
+
+    if (!handedBack) return;
+    await this.announceUnattended(
+      requestId,
+      trigger,
+      handback.code,
+      (title) => `"${title}" was approved without a decision and needs a release picked by hand`,
+    );
+  }
+
+  /**
+   * Tells the approvers about a request that has run out of automation, for the one trigger where
+   * nobody is already watching it.
+   *
+   * Only `auto_approval` reaches anybody here. An approval has the approver in front of the queue,
+   * and a retry was set off by a failure `failDownload` already announced; an auto-approved request
+   * has neither, so this is the only thing standing between it and a row nobody knows about.
+   */
+  private async announceUnattended(requestId: number, trigger: AutomationTrigger, code: string, describe: (title: string) => string): Promise<void> {
+    if (trigger !== 'auto_approval') return;
+
+    const joined = await this.requests.findById(requestId);
+    const title = joined?.request.title ?? `request #${requestId}`;
+
+    this.logger.log(`[book_request.auto_grab] [end] requestId=${requestId} trigger=${trigger} code=${code} - handed back to the approvers`);
+
+    await this.notifier.notifyApprovers(NotificationType.BookRequestNeedsRelease, {
+      title: 'Book request needs a release',
+      message: describe(title),
+      actionUrl: '/requests',
+      meta: { requestId },
+    });
+  }
+}
+
+interface ReleasePicks {
+  candidates: ReleaseCandidateItem[];
+  indexers: IndexerSearchStatus[];
+  allTried: boolean;
+  /** The medium has a profile and nothing the search returned fell into any of its tiers. */
+  profileExcludedAll: boolean;
+  /**
+   * What the instance had to search with. An empty candidate list has several causes and only
+   * these separate the ones a score floor cannot explain, so they travel with the picks rather
+   * than being read again after the fact.
+   */
+  enabledIndexerCount: number;
+  configuredIndexerCount: number;
+  uncoveredIndexerCount: number;
+}
+
+interface AutomationSearchVariant {
+  indexerMode: IndexerSearchMode;
+  /** Undefined uses the request's recommended ISBN; null explicitly searches title and author. */
+  isbn?: string | null;
+}
+
+/**
+ * What earlier refusals in this pass have already ruled out.
+ *
+ * Held for the pass rather than persisted: it is a record of what just happened, not a judgement
+ * about the source. A tracker that was rate limiting five seconds ago deserves the next request's
+ * first attempt, and an operator who buys VIP should not have to clear a flag to use it.
+ */
+class BlockedSources {
+  private readonly refusals: GrabRefusal[] = [];
+  /** Whether a grab from each source joins a swarm, which is the same thing as needing a client. */
+  private readonly seedsBack: Map<number, boolean>;
+
+  constructor(indexers: IndexerSearchStatus[]) {
+    this.seedsBack = new Map(indexers.map((indexer) => [indexer.indexerId, indexer.seedsBack]));
+  }
+
+  blocks(release: ReleaseCandidateItem): boolean {
+    // A source the search never reported on cannot be shown to be a direct download, and a
+    // torrent is the safer thing to assume: it is the shape that needs a client.
+    const seedsBack = this.seedsBack.get(release.indexerId) ?? true;
+    return findGrabRefusal({ indexerId: release.indexerId, vipOnly: release.vipOnly, seedsBack }, this.refusals) !== null;
+  }
+
+  record(release: ReleaseCandidateItem, code: GrabFailureCode): void {
+    this.refusals.push({ indexerId: release.indexerId, code });
+  }
+}
+
+/** The tail of the attempt log line: what the failover does with this refusal. */
+function nextStepDescription(code: GrabFailureCode | null, halt: boolean): string {
+  if (halt) return code === null ? 'unclassified failure, stopping here' : 'not retrying, leaving it for an approver';
+  switch (code) {
+    case 'GRAB_VIP_REQUIRED':
+      return "skipping this source's other VIP-only releases and trying the next one";
+    case 'GRAB_SOURCE_REFUSED':
+    case 'GRAB_SOURCE_UNAVAILABLE':
+      return "skipping this source's remaining releases and trying the next one";
+    case 'GRAB_CLIENT_REFUSED':
+    case 'GRAB_CLIENT_UNAVAILABLE':
+      return 'skipping every release needing that download client and trying the next one';
+    default:
+      return 'trying the next release down';
+  }
+}
+
+/**
+ * What the request carries once the chain is over. One refusal is its own explanation; several
+ * need the count, or the last sentence reads as though nothing else was tried.
+ */
+function summarizeFailures(failures: AttemptFailure[]): string {
+  const last = failures[failures.length - 1]!;
+  if (failures.length === 1) return last.message;
+
+  const sources = new Set(failures.map((failure) => failure.indexerName)).size;
+  const sourceLabel = sources === 1 ? '1 source' : `${sources} sources`;
+  return `Tried ${failures.length} releases from ${sourceLabel} and none could be started. Last: ${last.message}`;
+}
diff --git a/server/src/modules/book-request/fulfillment/request-fulfillment.service.test.ts b/server/src/modules/book-request/fulfillment/request-fulfillment.service.test.ts
new file mode 100644
index 000000000..12123bde2
--- /dev/null
+++ b/server/src/modules/book-request/fulfillment/request-fulfillment.service.test.ts
@@ -0,0 +1,903 @@
+import { BadRequestException, ConflictException, NotFoundException, ServiceUnavailableException } from '@nestjs/common';
+import { NotificationType, UNSETTLED_BOOK_REQUEST_DOWNLOAD_STATUSES, WORKER_WRITABLE_BOOK_REQUEST_STATUSES } from '@bookorbit/types';
+
+import type { RequestUser } from '../../../common/types/request-user';
+import type { BookRequestDownloadRow, BookRequestRow } from '../../../db/schema';
+import { IndexerSearchException } from '../indexers/indexer-adapter';
+import { RequestFulfillmentService } from './request-fulfillment.service';
+
+const INFO_HASH = 'c9e15763f722f23e98a29decdfae341b98d53056';
+const MAGNET = `magnet:?xt=urn:btih:${INFO_HASH}&dn=Dune`;
+
+function bencodeString(value: string): Buffer {
+  return Buffer.from(`${Buffer.byteLength(value)}:${value}`, 'utf8');
+}
+
+function torrentBytes(name = 'dune.epub'): Buffer {
+  return Buffer.concat([Buffer.from('d4:infod4:name'), bencodeString(name), Buffer.from('ee')]);
+}
+
+function multiFileTorrent(names: string[]): Buffer {
+  const files = names.map((name) => Buffer.concat([Buffer.from('d6:lengthi1e4:pathl'), bencodeString(name), Buffer.from('ee')]));
+  return Buffer.concat([Buffer.from('d4:infod5:filesl'), ...files, Buffer.from('e4:name7:releaseee')]);
+}
+
+function user(): RequestUser {
+  return { id: 1, name: 'Ann', isSuperuser: false, permissions: [] } as unknown as RequestUser;
+}
+
+function joined(overrides: Partial<BookRequestRow> = {}) {
+  return {
+    request: {
+      id: 7,
+      userId: 3,
+      title: 'Dune',
+      status: 'approved',
+      targetLibraryId: 2,
+      createdAt: new Date('2026-08-18T00:00:00Z'),
+      updatedAt: new Date('2026-08-18T00:00:00Z'),
+      ...overrides,
+    } as BookRequestRow,
+    requesterUsername: 'bob',
+    requesterName: 'Bob',
+    decidedByUsername: null,
+    targetLibraryName: 'Books',
+  };
+}
+
+function makeService(
+  overrides: {
+    requests?: Record<string, unknown>;
+    downloads?: Record<string, unknown>;
+    clients?: Record<string, unknown>;
+    indexers?: Record<string, unknown>;
+    releases?: Record<string, unknown>;
+    indexerAdapter?: Record<string, unknown>;
+  } = {},
+) {
+  const requests = {
+    findById: vi.fn().mockResolvedValue(joined()),
+    claimForGrab: vi.fn().mockResolvedValue('claimed'),
+    update: vi.fn().mockResolvedValue(undefined),
+    updateIf: vi.fn().mockImplementation((id: number, _expected: unknown, patch: Record<string, unknown>) => Promise.resolve({ id, ...patch })),
+    findSubscribers: vi.fn().mockResolvedValue(new Map()),
+    findDismissedRequestIds: vi.fn().mockResolvedValue(new Set()),
+    clearDismissals: vi.fn().mockResolvedValue(undefined),
+    findInterestedUserIds: vi.fn().mockResolvedValue([3]),
+    ...overrides.requests,
+  };
+  const downloads = {
+    create: vi.fn().mockImplementation((data: Record<string, unknown>) => Promise.resolve({ id: 11, ...data } as BookRequestDownloadRow)),
+    update: vi.fn().mockResolvedValue(undefined),
+    updateIf: vi.fn().mockImplementation((id: number, _expected: unknown, patch: Record<string, unknown>) => Promise.resolve({ id, ...patch })),
+    findLatestForRequests: vi.fn().mockResolvedValue(new Map()),
+    ...overrides.downloads,
+  };
+  const clients = {
+    findOne: vi.fn().mockResolvedValue({ id: 4, name: 'qbit', adapterType: 'qbittorrent', enabled: true, pathMappings: [{ id: 1 }] }),
+    findPreferredEnabled: vi.fn().mockResolvedValue({ id: 4 }),
+    resolveConfig: vi.fn().mockResolvedValue({ id: 4, adapterType: 'qbittorrent' }),
+    ...overrides.clients,
+  };
+  const adapter = { add: vi.fn().mockResolvedValue({ clientHash: INFO_HASH }) };
+  const registry = { require: vi.fn().mockReturnValue(adapter) };
+  const direct = { add: vi.fn().mockResolvedValue({ clientHash: INFO_HASH }) };
+  const indexers = {
+    resolveConfig: vi.fn().mockResolvedValue({ id: 9, name: 'tracker', adapterType: 'torznab' }),
+    ...overrides.indexers,
+  };
+  const indexerAdapter = { fetchTorrentFile: vi.fn(), ...overrides.indexerAdapter };
+  const indexerRegistry = { require: vi.fn().mockReturnValue(indexerAdapter) };
+  const releases = { find: vi.fn().mockReturnValue(undefined), search: vi.fn(), forget: vi.fn(), ...overrides.releases };
+  const notifier = {
+    notifyApprovers: vi.fn().mockResolvedValue(undefined),
+    notifyInterested: vi.fn().mockResolvedValue(undefined),
+    notifyResponsible: vi.fn().mockResolvedValue(undefined),
+  };
+  const gateway = { emitChanged: vi.fn(), emitProgress: vi.fn() };
+  const events = { emit: vi.fn() };
+
+  const service = new RequestFulfillmentService(
+    requests as never,
+    downloads as never,
+    clients as never,
+    registry as never,
+    direct as never,
+    indexers as never,
+    indexerRegistry as never,
+    releases as never,
+    notifier as never,
+    gateway as never,
+    events as never,
+  );
+
+  return {
+    service,
+    requests,
+    downloads,
+    clients,
+    adapter,
+    direct,
+    registry,
+    indexers,
+    indexerAdapter,
+    indexerRegistry,
+    releases,
+    notifier,
+    gateway,
+    events,
+  };
+}
+
+describe('RequestFulfillmentService.grab', () => {
+  it('records the attempt before calling the client, so an add never outlives its row', async () => {
+    const { service, downloads, adapter } = makeService();
+
+    await service.grab(7, { magnet: MAGNET }, user());
+
+    expect(downloads.create).toHaveBeenCalledWith(
+      expect.objectContaining({ requestId: 7, source: 'magnet', clientHash: INFO_HASH, status: 'queued', releaseTitle: 'Dune' }),
+    );
+    expect(downloads.create.mock.invocationCallOrder[0]).toBeLessThan(adapter.add.mock.invocationCallOrder[0]);
+  });
+
+  it('marks who grabbed it, because only an unattended attempt may be retried unattended', async () => {
+    const { service, downloads } = makeService();
+
+    await service.grab(7, { magnet: MAGNET }, user());
+    expect(downloads.create).toHaveBeenCalledWith(expect.objectContaining({ automated: false }));
+
+    await service.grab(7, { magnet: MAGNET }, null);
+    expect(downloads.create).toHaveBeenLastCalledWith(expect.objectContaining({ automated: true }));
+  });
+
+  /**
+   * The infohash is derived from the trimmed link, so the client has to be handed the same one.
+   * qBittorrent splits its `urls` field on newlines, and a pasted trailing one is invisible.
+   */
+  it('hands the client the trimmed magnet the hash was derived from', async () => {
+    const { service, adapter } = makeService();
+    await service.grab(7, { magnet: `  ${MAGNET}\n` }, user());
+    expect(adapter.add).toHaveBeenCalledWith(expect.objectContaining({ magnet: MAGNET, infoHash: INFO_HASH }), expect.anything());
+  });
+
+  /** The size of what the release carries; a magnet does not state one, so it stays null. */
+  it('records no release size for a magnet', async () => {
+    const { service, downloads } = makeService();
+    await service.grab(7, { magnet: MAGNET }, user());
+    expect(downloads.create).toHaveBeenCalledWith(expect.objectContaining({ releaseSizeBytes: null }));
+  });
+
+  it('moves the request to grabbed once the client has it', async () => {
+    const { service, requests } = makeService();
+    await service.grab(7, { magnet: MAGNET }, user());
+    expect(requests.updateIf).toHaveBeenCalledWith(7, ['grabbed'], { status: 'grabbed', statusReason: null });
+  });
+
+  /** Someone who hid the failure still wants the book, so the retry puts it back on their list. */
+  it('un-hides a request that someone had dismissed as failed', async () => {
+    const { service, requests } = makeService();
+    await service.grab(7, { magnet: MAGNET }, user());
+    expect(requests.clearDismissals).toHaveBeenCalledWith(7);
+  });
+
+  it('fails the attempt but not the request when the client rejects the add', async () => {
+    const { service, downloads, registry, requests } = makeService();
+    registry.require.mockReturnValue({ add: vi.fn().mockRejectedValue(new BadRequestException('qBittorrent rejected the torrent')) });
+
+    await expect(service.grab(7, { magnet: MAGNET }, user())).rejects.toThrow(BadRequestException);
+
+    expect(downloads.update).toHaveBeenCalledWith(11, expect.objectContaining({ status: 'failed' }));
+    // The grab claimed the request before calling out, so the request does get written: back to
+    // exactly where it started, which is what keeps the picker offering another release. Only if
+    // the claim is still ours, so a cancellation that landed mid-grab is not rolled back over.
+    expect(requests.updateIf).toHaveBeenCalledWith(7, ['grabbed'], { status: 'approved' });
+    expect(requests.updateIf).not.toHaveBeenCalledWith(7, expect.anything(), expect.objectContaining({ status: 'failed' }));
+  });
+
+  it('retries one transient client failure for automation without creating another attempt', async () => {
+    vi.useFakeTimers();
+    try {
+      const { service, downloads, adapter } = makeService();
+      adapter.add
+        .mockRejectedValueOnce(new ServiceUnavailableException('qBittorrent is restarting'))
+        .mockResolvedValueOnce({ clientHash: INFO_HASH });
+
+      const grabbed = service.grab(7, { magnet: MAGNET }, null);
+      await vi.advanceTimersByTimeAsync(500);
+      await grabbed;
+
+      expect(adapter.add).toHaveBeenCalledTimes(2);
+      expect(downloads.create).toHaveBeenCalledTimes(1);
+      expect(downloads.update).not.toHaveBeenCalledWith(11, expect.objectContaining({ status: 'failed' }));
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
+  it('does not retry a transient client failure from a manual grab', async () => {
+    const { service, downloads, adapter } = makeService();
+    adapter.add.mockRejectedValue(new ServiceUnavailableException('qBittorrent is restarting'));
+
+    await expect(service.grab(7, { magnet: MAGNET }, user())).rejects.toMatchObject({
+      status: 503,
+      response: { errorCode: 'GRAB_CLIENT_UNAVAILABLE' },
+    });
+
+    expect(adapter.add).toHaveBeenCalledTimes(1);
+    expect(downloads.create).toHaveBeenCalledTimes(1);
+  });
+
+  /** Two approvers on one request: whoever loses the claim is told, not silently ignored. */
+  it('refuses a second concurrent grab rather than starting two releases for one request', async () => {
+    const { service, downloads, requests } = makeService();
+    requests.claimForGrab.mockResolvedValue('moved');
+
+    await expect(service.grab(7, { magnet: MAGNET }, user())).rejects.toThrow(ConflictException);
+    expect(downloads.create).not.toHaveBeenCalled();
+  });
+
+  /**
+   * The documented retry path: the work was requested again while this one sat at `failed`, so the
+   * new request holds the dedupe claim and re-grabbing the old one collides with it. A coded 409,
+   * not the raw Postgres violation the approver used to get as a 500.
+   */
+  it('refuses a re-grab whose work another live request has taken over', async () => {
+    const { service, downloads, requests } = makeService();
+    requests.claimForGrab.mockResolvedValue('duplicate');
+
+    await expect(service.grab(7, { magnet: MAGNET }, user())).rejects.toThrow(/already requested this book again/);
+    await expect(service.grab(7, { magnet: MAGNET }, user())).rejects.toThrow(ConflictException);
+    expect(downloads.create).not.toHaveBeenCalled();
+  });
+
+  it('reads the infohash and name out of a .torrent upload', async () => {
+    const { service, downloads } = makeService();
+    // d4:infod4:name8:dune.epubee - a minimal bencoded dictionary with a name.
+    const torrent = Buffer.from('d4:infod4:name9:dune.epubee').toString('base64');
+
+    await service.grab(7, { torrentFileBase64: torrent, torrentFileName: 'upload.torrent' }, user());
+
+    expect(downloads.create).toHaveBeenCalledWith(expect.objectContaining({ source: 'torrent_file', releaseTitle: 'dune.epub' }));
+  });
+
+  it('refuses both a magnet and a file at once', async () => {
+    const { service } = makeService();
+    await expect(service.grab(7, { magnet: MAGNET, torrentFileBase64: 'ZA==' }, user())).rejects.toThrow(BadRequestException);
+  });
+
+  it('refuses neither', async () => {
+    const { service } = makeService();
+    await expect(service.grab(7, {}, user())).rejects.toThrow(BadRequestException);
+  });
+
+  /**
+   * Finalize resolves its destination from the request row. Without a library the download would
+   * run to completion and then stop at "missing destination".
+   */
+  it('refuses a request with no destination library before anything is downloaded', async () => {
+    const { service, adapter } = makeService({ requests: { findById: vi.fn().mockResolvedValue(joined({ targetLibraryId: null })) } });
+
+    await expect(service.grab(7, { magnet: MAGNET }, user())).rejects.toThrow(BadRequestException);
+    expect(adapter.add).not.toHaveBeenCalled();
+  });
+
+  it('refuses to grab a request that is still pending approval', async () => {
+    const { service } = makeService({ requests: { findById: vi.fn().mockResolvedValue(joined({ status: 'pending' })) } });
+    await expect(service.grab(7, { magnet: MAGNET }, user())).rejects.toThrow(BadRequestException);
+  });
+
+  it('allows a re-grab after a failed attempt', async () => {
+    const { service, adapter } = makeService({ requests: { findById: vi.fn().mockResolvedValue(joined({ status: 'failed' })) } });
+    await service.grab(7, { magnet: MAGNET }, user());
+    expect(adapter.add).toHaveBeenCalled();
+  });
+
+  it('reports a duplicate infohash as a conflict rather than a 500', async () => {
+    const { service } = makeService({
+      downloads: { create: vi.fn().mockRejectedValue(new Error('Failed query', { cause: Object.assign(new Error('dup'), { code: '23505' }) })) },
+    });
+    await expect(service.grab(7, { magnet: MAGNET }, user())).rejects.toThrow(ConflictException);
+  });
+
+  it('explains that no download client is configured', async () => {
+    const { service } = makeService({ clients: { findPreferredEnabled: vi.fn().mockResolvedValue(undefined) } });
+    await expect(service.grab(7, { magnet: MAGNET }, user())).rejects.toThrow(BadRequestException);
+  });
+
+  it('refuses a client the operator has disabled', async () => {
+    const { service } = makeService({ clients: { findOne: vi.fn().mockResolvedValue({ id: 4, name: 'qbit', enabled: false }) } });
+    await expect(service.grab(7, { downloadClientId: 4, magnet: MAGNET }, user())).rejects.toThrow(BadRequestException);
+  });
+
+  /**
+   * A client with no mapping declares no directory the import may read out of, so the attempt
+   * would seed for hours and then be refused. Rows predating that rule are what reaches this.
+   */
+  it('refuses a client with no path mapping rather than downloading something it cannot import', async () => {
+    const { service, downloads } = makeService({
+      clients: { findOne: vi.fn().mockResolvedValue({ id: 4, name: 'qbit', adapterType: 'qbittorrent', enabled: true, pathMappings: [] }) },
+    });
+
+    await expect(service.grab(7, { downloadClientId: 4, magnet: MAGNET }, user())).rejects.toThrow(BadRequestException);
+    expect(downloads.create).not.toHaveBeenCalled();
+  });
+
+  it('404s an unknown request', async () => {
+    const { service } = makeService({ requests: { findById: vi.fn().mockResolvedValue(undefined) } });
+    await expect(service.grab(7, { magnet: MAGNET }, user())).rejects.toThrow(NotFoundException);
+  });
+});
+
+describe('RequestFulfillmentService.grab from a picked release', () => {
+  const RELEASE = {
+    indexerId: 9,
+    guid: 'r-1',
+    title: 'Dune - Frank Herbert [EPUB]',
+    downloadUrl: 'https://tracker.example.com/download?tid=1',
+    sizeBytes: 2_000_000,
+    seeders: 31,
+    leechers: 2,
+    format: 'epub',
+    freeleech: true,
+    /** Stated by the tracker itself, which is the only source of either goal now. */
+    seedRatioGoal: 2,
+    seedTimeMinutes: 4320,
+  };
+
+  it('resolves the release server-side and snapshots what the indexer said about it', async () => {
+    const { service, downloads, indexerAdapter } = makeService({
+      releases: { find: vi.fn().mockReturnValue(RELEASE) },
+      indexerAdapter: { fetchTorrentFile: vi.fn().mockResolvedValue(torrentBytes()) },
+    });
+
+    await service.grab(7, { indexerId: 9, releaseGuid: 'r-1' }, user());
+
+    expect(indexerAdapter.fetchTorrentFile).toHaveBeenCalled();
+    expect(downloads.create).toHaveBeenCalledWith(
+      expect.objectContaining({
+        indexerId: 9,
+        releaseGuid: 'r-1',
+        releaseTitle: 'Dune - Frank Herbert [EPUB]',
+        releaseSeeders: 31,
+        releaseFormat: 'epub',
+        freeleech: true,
+        source: 'torrent_file',
+      }),
+    );
+  });
+
+  it('hands a magnet redirect from a Torznab download endpoint to the torrent client', async () => {
+    const { service, downloads, adapter } = makeService({
+      releases: { find: vi.fn().mockReturnValue(RELEASE) },
+      indexerAdapter: { fetchTorrentFile: vi.fn().mockResolvedValue({ magnet: MAGNET }) },
+    });
+
+    await service.grab(7, { indexerId: 9, releaseGuid: 'r-1' }, user());
+
+    expect(downloads.create).toHaveBeenCalledWith(expect.objectContaining({ source: 'magnet', clientHash: INFO_HASH }));
+    expect(adapter.add).toHaveBeenCalledWith(expect.objectContaining({ magnet: MAGNET, infoHash: INFO_HASH }), expect.anything());
+  });
+
+  it('inspects the torrent without creating an attempt and reuses it for the following grab', async () => {
+    const { service, downloads, adapter, indexerAdapter } = makeService({
+      releases: { find: vi.fn().mockReturnValue(RELEASE) },
+      indexerAdapter: { fetchTorrentFile: vi.fn().mockResolvedValue(torrentBytes()) },
+    });
+
+    await expect(service.inspectRelease(7, { indexerId: 9, releaseGuid: 'r-1' })).resolves.toMatchObject({
+      source: 'torrent_file',
+      status: 'ready',
+      totalFiles: 1,
+      primaryFileCount: 1,
+      files: [{ path: 'dune.epub', bookFile: true }],
+    });
+    expect(downloads.create).not.toHaveBeenCalled();
+    expect(adapter.add).not.toHaveBeenCalled();
+
+    await service.grab(7, { indexerId: 9, releaseGuid: 'r-1' }, user());
+    expect(indexerAdapter.fetchTorrentFile).toHaveBeenCalledTimes(1);
+  });
+
+  /**
+   * RAR and ZIP packaging is ordinary on private trackers. The layout is genuinely unknowable
+   * until the archive is open, so it is reported as unknown and judged after the download rather
+   * than refused on a guess.
+   */
+  it('sends an archived release and reports its contents as unknown until it is extracted', async () => {
+    const { service, downloads, adapter } = makeService({
+      releases: { find: vi.fn().mockReturnValue(RELEASE) },
+      indexerAdapter: { fetchTorrentFile: vi.fn().mockResolvedValue(torrentBytes('wrapped.zip')) },
+    });
+
+    await expect(service.inspectRelease(7, { indexerId: 9, releaseGuid: 'r-1' })).resolves.toMatchObject({
+      status: 'contents_unknown',
+      unitCount: 0,
+      containerCount: 1,
+    });
+
+    await service.grab(7, { indexerId: 9, releaseGuid: 'r-1' }, user());
+    expect(downloads.create).toHaveBeenCalled();
+    expect(adapter.add).toHaveBeenCalled();
+  });
+
+  /**
+   * The bytes are the expensive part. A release holding several books is sent and the question is
+   * asked once it has landed, rather than refused on a guess and downloaded again later.
+   */
+  it('sends a release holding several books and says how many it holds', async () => {
+    const { service, downloads, adapter } = makeService({
+      releases: { find: vi.fn().mockReturnValue(RELEASE) },
+      indexerAdapter: { fetchTorrentFile: vi.fn().mockResolvedValue(multiFileTorrent(['one.epub', 'two.epub', 'cover.jpg'])) },
+    });
+
+    await expect(service.inspectRelease(7, { indexerId: 9, releaseGuid: 'r-1' })).resolves.toMatchObject({
+      status: 'multiple_supported_files',
+      unitCount: 2,
+    });
+
+    await service.grab(7, { indexerId: 9, releaseGuid: 'r-1' }, user());
+    expect(downloads.create).toHaveBeenCalled();
+    expect(adapter.add).toHaveBeenCalled();
+  });
+
+  /** One book in several parts is a clean import now, so the picker must not call it a problem. */
+  it('reports a multipart audiobook as ready rather than as many book files', async () => {
+    const { service } = makeService({
+      releases: { find: vi.fn().mockReturnValue(RELEASE) },
+      indexerAdapter: { fetchTorrentFile: vi.fn().mockResolvedValue(multiFileTorrent(['Chapter 1.mp3', 'Chapter 2.mp3', 'cover.jpg'])) },
+    });
+
+    await expect(service.inspectRelease(7, { indexerId: 9, releaseGuid: 'r-1' })).resolves.toMatchObject({
+      status: 'ready',
+      unitCount: 1,
+      units: [expect.objectContaining({ mediaKind: 'audiobook', contentFileCount: 2 })],
+    });
+  });
+
+  it('bounds the manifest response even when every listed file is supported', async () => {
+    const names = Array.from({ length: 201 }, (_, index) => `book-${index}.epub`);
+    const { service } = makeService({
+      releases: { find: vi.fn().mockReturnValue(RELEASE) },
+      indexerAdapter: { fetchTorrentFile: vi.fn().mockResolvedValue(multiFileTorrent(names)) },
+    });
+
+    const inspection = await service.inspectRelease(7, { indexerId: 9, releaseGuid: 'r-1' });
+    expect(inspection).toMatchObject({
+      status: 'multiple_supported_files',
+      totalFiles: 201,
+      primaryFileCount: 201,
+      truncated: true,
+    });
+    expect(inspection.files).toHaveLength(200);
+  });
+
+  it('explains that a magnet needs swarm metadata before its files are knowable', async () => {
+    const { service, indexerAdapter } = makeService({ releases: { find: vi.fn().mockReturnValue({ ...RELEASE, magnet: MAGNET }) } });
+
+    await expect(service.inspectRelease(7, { indexerId: 9, releaseGuid: 'r-1' })).resolves.toEqual({
+      source: 'magnet',
+      status: 'metadata_unavailable',
+      files: [],
+      totalFiles: null,
+      primaryFileCount: null,
+      truncated: false,
+      units: [],
+      unitCount: 0,
+      ignoredFileCount: 0,
+      containerCount: 0,
+    });
+    expect(indexerAdapter.fetchTorrentFile).not.toHaveBeenCalled();
+  });
+
+  it('refuses qBittorrent for a direct-file release before recording an attempt', async () => {
+    const directRelease = { ...RELEASE, downloadUrl: 'https://www.gutenberg.org/ebooks/2868.epub', format: 'epub' };
+    const { service, downloads } = makeService({
+      clients: {
+        findOne: vi.fn().mockResolvedValue({ id: 4, name: 'qBittorrent', adapterType: 'qbittorrent', enabled: true, pathMappings: [{ id: 1 }] }),
+      },
+      indexers: {
+        resolveConfig: vi.fn().mockResolvedValue({
+          id: 9,
+          name: 'Project Gutenberg',
+          adapterType: 'project-gutenberg',
+          seedRatioGoal: null,
+        }),
+      },
+      releases: { find: vi.fn().mockReturnValue(directRelease) },
+      indexerAdapter: {
+        resolveFile: vi.fn().mockResolvedValue({
+          url: directRelease.downloadUrl,
+          fileName: '2868.epub',
+          sizeBytes: 1234,
+          format: 'epub',
+        }),
+      },
+    });
+
+    await expect(service.grab(7, { indexerId: 9, releaseGuid: 'r-1', downloadClientId: 4 }, user())).rejects.toMatchObject({
+      status: 400,
+      message: 'Download client "qBittorrent" cannot fetch a direct file',
+    });
+    expect(downloads.create).not.toHaveBeenCalled();
+  });
+
+  it('routes a direct-file release to the built-in downloader when no client is named', async () => {
+    const directRelease = { ...RELEASE, downloadUrl: 'https://www.gutenberg.org/ebooks/2868.epub', format: 'epub' };
+    const { service, clients, downloads, direct, adapter } = makeService({
+      indexers: {
+        resolveConfig: vi.fn().mockResolvedValue({
+          id: 9,
+          name: 'Project Gutenberg',
+          adapterType: 'project-gutenberg',
+          seedRatioGoal: null,
+        }),
+      },
+      releases: { find: vi.fn().mockReturnValue(directRelease) },
+      indexerAdapter: {
+        resolveFile: vi.fn().mockResolvedValue({
+          url: directRelease.downloadUrl,
+          fileName: '2868.epub',
+          sizeBytes: 1234,
+          format: 'epub',
+        }),
+      },
+    });
+
+    await service.grab(7, { indexerId: 9, releaseGuid: 'r-1' }, user());
+
+    // No client is resolved at all: there is no row for the built-in downloader to be found in.
+    expect(clients.findPreferredEnabled).not.toHaveBeenCalled();
+    expect(downloads.create).toHaveBeenCalledWith(expect.objectContaining({ downloadClientId: null, source: 'direct_url' }));
+    expect(direct.add).toHaveBeenCalledWith(expect.objectContaining({ fileUrl: directRelease.downloadUrl, fileName: '2868.epub' }));
+    expect(adapter.add).not.toHaveBeenCalled();
+  });
+
+  /**
+   * A direct source states its format out of band, and its URL often ends in something that is not
+   * a filename at all. Staging that answer unchanged is how a release was reported ready, fetched
+   * in full, and only then refused by an importer that classifies by extension alone.
+   */
+  it('stages a nameless direct file under its declared format, and reports it ready', async () => {
+    const directRelease = { ...RELEASE, downloadUrl: 'https://archive.org/download/frankenstein/get', format: 'epub' };
+    const { service, direct } = makeService({
+      indexers: {
+        resolveConfig: vi.fn().mockResolvedValue({ id: 9, name: 'Internet Archive', adapterType: 'internet-archive', seedRatioGoal: null }),
+      },
+      releases: { find: vi.fn().mockReturnValue(directRelease) },
+      indexerAdapter: {
+        resolveFile: vi.fn().mockResolvedValue({ url: directRelease.downloadUrl, fileName: 'download', sizeBytes: 1234, format: 'epub' }),
+      },
+    });
+
+    expect(await service.inspectRelease(7, { indexerId: 9, releaseGuid: 'r-1' })).toMatchObject({
+      status: 'ready',
+      primaryFileCount: 1,
+      files: [expect.objectContaining({ path: 'download.epub', bookFile: true })],
+    });
+
+    await service.grab(7, { indexerId: 9, releaseGuid: 'r-1' }, user());
+    expect(direct.add).toHaveBeenCalledWith(expect.objectContaining({ downloadId: 11, fileName: 'download.epub' }));
+  });
+
+  /** Refused at inspection, which is before the fetch, rather than after downloading the whole file. */
+  it('refuses a direct file whose declared format nothing can import', async () => {
+    const directRelease = { ...RELEASE, downloadUrl: 'https://example.com/read/frankenstein', format: 'html' };
+    const { service, downloads, direct } = makeService({
+      indexers: { resolveConfig: vi.fn().mockResolvedValue({ id: 9, name: 'Somewhere', adapterType: 'torznab', seedRatioGoal: null }) },
+      releases: { find: vi.fn().mockReturnValue(directRelease) },
+      indexerAdapter: {
+        resolveFile: vi.fn().mockResolvedValue({ url: directRelease.downloadUrl, fileName: 'download', sizeBytes: 1234, format: 'html' }),
+      },
+    });
+
+    expect(await service.inspectRelease(7, { indexerId: 9, releaseGuid: 'r-1' })).toMatchObject({ status: 'no_supported_file' });
+
+    // Recorded as a refused attempt the way any other unimportable release is, and never fetched.
+    await expect(service.grab(7, { indexerId: 9, releaseGuid: 'r-1' }, user())).rejects.toMatchObject({ status: 400 });
+    expect(direct.add).not.toHaveBeenCalled();
+    expect(downloads.create).toHaveBeenCalledWith(expect.objectContaining({ status: 'failed', clientHash: null }));
+  });
+
+  /** A `.zip` holding an epub is an archive the importer extracts, and `book.zip.epub` is not. */
+  it('leaves a direct file that already carries an extension alone', async () => {
+    const directRelease = { ...RELEASE, downloadUrl: 'https://example.com/frankenstein.zip', format: 'epub' };
+    const { service, direct } = makeService({
+      indexers: { resolveConfig: vi.fn().mockResolvedValue({ id: 9, name: 'Somewhere', adapterType: 'torznab', seedRatioGoal: null }) },
+      releases: { find: vi.fn().mockReturnValue(directRelease) },
+      indexerAdapter: {
+        resolveFile: vi.fn().mockResolvedValue({ url: directRelease.downloadUrl, fileName: 'frankenstein.zip', sizeBytes: 1234, format: 'epub' }),
+      },
+    });
+
+    await service.grab(7, { indexerId: 9, releaseGuid: 'r-1' }, user());
+
+    expect(direct.add).toHaveBeenCalledWith(expect.objectContaining({ fileName: 'frankenstein.zip' }));
+  });
+
+  /** The tracker states both goals and the client enforces them; BookOrbit never stops a seed. */
+  it("passes the release's own seed goals to the download client at add time", async () => {
+    const { service, adapter } = makeService({
+      releases: { find: vi.fn().mockReturnValue(RELEASE) },
+      indexerAdapter: { fetchTorrentFile: vi.fn().mockResolvedValue(torrentBytes()) },
+    });
+
+    await service.grab(7, { indexerId: 9, releaseGuid: 'r-1' }, user());
+
+    expect(adapter.add).toHaveBeenCalledWith(expect.objectContaining({ seedRatioGoal: 2, seedTimeMinutes: 4320 }), expect.anything());
+  });
+
+  /** Torznab states no format, so what the approver saw came off the release name. Record that. */
+  it('snapshots the format the picker showed rather than the empty field the indexer sent', async () => {
+    const { service, downloads } = makeService({
+      releases: { find: vi.fn().mockReturnValue({ ...RELEASE, format: undefined }) },
+      indexerAdapter: { fetchTorrentFile: vi.fn().mockResolvedValue(torrentBytes()) },
+    });
+
+    await service.grab(7, { indexerId: 9, releaseGuid: 'r-1' }, user());
+
+    expect(downloads.create).toHaveBeenCalledWith(expect.objectContaining({ releaseFormat: 'epub' }));
+  });
+
+  it('uses the magnet directly when the indexer published one, without fetching a .torrent', async () => {
+    const { service, downloads, indexerAdapter } = makeService({ releases: { find: vi.fn().mockReturnValue({ ...RELEASE, magnet: MAGNET }) } });
+
+    await service.grab(7, { indexerId: 9, releaseGuid: 'r-1' }, user());
+
+    expect(indexerAdapter.fetchTorrentFile).not.toHaveBeenCalled();
+    expect(downloads.create).toHaveBeenCalledWith(expect.objectContaining({ source: 'magnet', clientHash: INFO_HASH }));
+  });
+
+  /**
+   * The tracker refuses individual releases for reasons only it knows ("VIP torrent and you are
+   * not VIP or higher"). Rethrown as-is that reaches the approver as a 500 with no reason at all,
+   * when the reason is the one thing that tells them to pick a different release.
+   */
+  it('reports a tracker refusing the release as a bad request carrying the reason the tracker gave', async () => {
+    const { service, adapter, direct } = makeService({
+      releases: { find: vi.fn().mockReturnValue(RELEASE) },
+      indexerAdapter: {
+        fetchTorrentFile: vi.fn().mockRejectedValue(new IndexerSearchException('error', 'tracker answered 406: Download blocked: VIP torrent')),
+      },
+    });
+
+    await expect(service.grab(7, { indexerId: 9, releaseGuid: 'r-1' }, user())).rejects.toMatchObject({
+      status: 400,
+      message: 'tracker answered 406: Download blocked: VIP torrent',
+      response: { errorCode: 'GRAB_SOURCE_REFUSED' },
+    });
+    // Nothing was handed anywhere; the row that is written is the record of having asked.
+    expect(adapter.add).not.toHaveBeenCalled();
+    expect(direct.add).not.toHaveBeenCalled();
+  });
+
+  /**
+   * A request that ends up downloading from its second source looks unremarkable on its own row.
+   * The first source having been asked and having refused is only visible if it was recorded.
+   */
+  it('keeps a refused release as an attempt of its own, with the reason on it', async () => {
+    const { service, downloads } = makeService({
+      releases: { find: vi.fn().mockReturnValue(RELEASE) },
+      indexerAdapter: {
+        fetchTorrentFile: vi.fn().mockRejectedValue(new IndexerSearchException('error', 'tracker answered 406: Download blocked: VIP torrent')),
+      },
+    });
+
+    await expect(service.grab(7, { indexerId: 9, releaseGuid: 'r-1' }, user())).rejects.toMatchObject({ status: 400 });
+
+    expect(downloads.create).toHaveBeenCalledWith(
+      expect.objectContaining({
+        requestId: 7,
+        indexerId: 9,
+        status: 'failed',
+        // No client took it and no hash exists, which is what tells a refusal from a failed download.
+        downloadClientId: null,
+        clientHash: null,
+        releaseGuid: 'r-1',
+        errorMessage: 'tracker answered 406: Download blocked: VIP torrent',
+      }),
+    );
+  });
+
+  /** A hand-pasted magnet came from no source, so there is nothing to attribute a refusal to. */
+  it('records nothing for a refusal that was not about a release in the list', async () => {
+    const { service, downloads } = makeService({ releases: { find: vi.fn().mockReturnValue(undefined) } });
+
+    await expect(service.grab(7, { indexerId: 9, releaseGuid: 'gone' }, user())).rejects.toThrow(BadRequestException);
+
+    expect(downloads.create).not.toHaveBeenCalled();
+  });
+
+  /**
+   * The same refusal on a release the tracker itself flagged as VIP-only is about the VIP
+   * releases, not about the tracker: an automatic fallback that skipped the whole source over it
+   * would throw away every ordinary release the tracker holds.
+   */
+  it('marks a refused VIP-only release as a VIP restriction rather than a refused source', async () => {
+    const { service } = makeService({
+      releases: { find: vi.fn().mockReturnValue({ ...RELEASE, vipOnly: true }) },
+      indexerAdapter: {
+        fetchTorrentFile: vi.fn().mockRejectedValue(new IndexerSearchException('error', 'tracker answered 406: VIP torrent')),
+      },
+    });
+
+    await expect(service.grab(7, { indexerId: 9, releaseGuid: 'r-1' }, user())).rejects.toMatchObject({
+      status: 400,
+      response: { errorCode: 'GRAB_VIP_REQUIRED' },
+    });
+  });
+
+  /** A tracker that was merely slow says nothing about the release, so it is worth another go. */
+  it('reports an unreachable tracker as unavailable rather than as a refused release', async () => {
+    const { service } = makeService({
+      releases: { find: vi.fn().mockReturnValue(RELEASE) },
+      indexerAdapter: { fetchTorrentFile: vi.fn().mockRejectedValue(new IndexerSearchException('timeout', 'tracker did not answer in time')) },
+    });
+
+    await expect(service.grab(7, { indexerId: 9, releaseGuid: 'r-1' }, user())).rejects.toMatchObject({
+      status: 503,
+      response: { errorCode: 'GRAB_SOURCE_UNAVAILABLE' },
+    });
+  });
+
+  it('retries one unavailable source resolution for automation before spending another attempt', async () => {
+    vi.useFakeTimers();
+    try {
+      const fetchTorrentFile = vi
+        .fn()
+        .mockRejectedValueOnce(new IndexerSearchException('timeout', 'tracker did not answer in time'))
+        .mockResolvedValueOnce(torrentBytes());
+      const { service, downloads } = makeService({
+        releases: { find: vi.fn().mockReturnValue(RELEASE) },
+        indexerAdapter: { fetchTorrentFile },
+      });
+
+      const grabbed = service.grab(7, { indexerId: 9, releaseGuid: 'r-1' }, null);
+      await vi.advanceTimersByTimeAsync(500);
+      await grabbed;
+
+      expect(fetchTorrentFile).toHaveBeenCalledTimes(2);
+      expect(downloads.create).toHaveBeenCalledTimes(1);
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
+  it('says the release list has expired rather than grabbing something else', async () => {
+    const { service, downloads } = makeService({ releases: { find: vi.fn().mockReturnValue(undefined) } });
+
+    await expect(service.grab(7, { indexerId: 9, releaseGuid: 'gone' }, user())).rejects.toThrow(BadRequestException);
+    expect(downloads.create).not.toHaveBeenCalled();
+  });
+
+  it('refuses a picked release alongside a hand-pasted magnet', async () => {
+    const { service } = makeService({ releases: { find: vi.fn().mockReturnValue(RELEASE) } });
+
+    await expect(service.grab(7, { indexerId: 9, releaseGuid: 'r-1', magnet: MAGNET }, user())).rejects.toThrow(BadRequestException);
+  });
+});
+
+describe('RequestFulfillmentService.listReleases', () => {
+  it('does not spend a tracker hit on a request that was refused', async () => {
+    const { service, releases } = makeService({ requests: { findById: vi.fn().mockResolvedValue(joined({ status: 'rejected' })) } });
+
+    await expect(service.listReleases(7)).rejects.toThrow(BadRequestException);
+    expect(releases.search).not.toHaveBeenCalled();
+  });
+
+  it('404s an unknown request', async () => {
+    const { service } = makeService({ requests: { findById: vi.fn().mockResolvedValue(undefined) } });
+
+    await expect(service.listReleases(7)).rejects.toThrow(NotFoundException);
+  });
+
+  it('normalizes manual search fields and canonicalizes the selected ISBNs', async () => {
+    const { service, releases } = makeService();
+
+    await service.listReleases(7, {
+      refresh: true,
+      overrides: {
+        title: '  Dune Messiah  ',
+        authors: [' Frank Herbert ', 'Frank Herbert', ''],
+        isbn: '0593098234',
+        language: 'English',
+        preferredFormats: [' EPUB ', 'epub', 'AZW3'],
+      },
+    });
+
+    expect(releases.search).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({
+        refresh: true,
+        overrides: {
+          title: 'Dune Messiah',
+          authors: ['Frank Herbert'],
+          isbn: '9780593098233',
+          language: 'en',
+          preferredFormats: ['epub', 'azw3'],
+        },
+      }),
+    );
+  });
+
+  it('rejects an invalid manual ISBN instead of silently dropping it', async () => {
+    const { service, releases } = makeService();
+
+    await expect(service.listReleases(7, { overrides: { isbn: 'not-an-isbn' } })).rejects.toThrow(BadRequestException);
+    expect(releases.search).not.toHaveBeenCalled();
+  });
+});
+
+describe('RequestFulfillmentService.failDownload', () => {
+  it('fails the attempt, the request and tells the approvers, all in one place', async () => {
+    const { service, downloads, requests, notifier } = makeService();
+
+    await service.failDownload({ id: 11, requestId: 7 } as BookRequestDownloadRow, 'The download client no longer has this torrent');
+
+    expect(downloads.updateIf).toHaveBeenCalledWith(11, UNSETTLED_BOOK_REQUEST_DOWNLOAD_STATUSES, {
+      status: 'failed',
+      errorMessage: 'The download client no longer has this torrent',
+    });
+    expect(requests.updateIf).toHaveBeenCalledWith(7, WORKER_WRITABLE_BOOK_REQUEST_STATUSES, {
+      status: 'failed',
+      statusReason: 'The download client no longer has this torrent',
+    });
+    expect(notifier.notifyResponsible).toHaveBeenCalledWith(
+      { id: 7, selfServe: false },
+      NotificationType.BookRequestFailed,
+      expect.objectContaining({ meta: { requestId: 7, downloadId: 11 } }),
+    );
+  });
+
+  it('drops a direct source URL when its attempt fails', async () => {
+    const { service, downloads } = makeService();
+
+    await service.failDownload({ id: 11, requestId: 7, source: 'direct_url' } as BookRequestDownloadRow, 'stalled');
+
+    expect(downloads.updateIf).toHaveBeenCalledWith(
+      11,
+      UNSETTLED_BOOK_REQUEST_DOWNLOAD_STATUSES,
+      expect.objectContaining({ directUrl: null, directEtag: null, directLastModified: null }),
+    );
+  });
+
+  it('announces the failure only once the request is marked and the approvers are told', async () => {
+    const { service, requests, notifier, events } = makeService();
+
+    events.emit.mockImplementation(() => {
+      // Whatever listens here must see a settled failure, not a request still reading as active.
+      expect(requests.updateIf).toHaveBeenCalledWith(7, expect.anything(), expect.objectContaining({ status: 'failed' }));
+      expect(notifier.notifyResponsible).toHaveBeenCalled();
+      return true;
+    });
+
+    await service.failDownload({ id: 11, requestId: 7 } as BookRequestDownloadRow, 'stalled');
+
+    expect(events.emit).toHaveBeenCalledWith('book-request.download.failed', 11);
+  });
+
+  /**
+   * Both callers are sweeps over rows read some time ago: the poll loop and the watchdog. A
+   * request somebody cancelled or filed in the meantime must not be reopened as a failure, and
+   * nobody should be told about a failure they are no longer waiting on.
+   */
+  it('leaves a request somebody already settled alone, and tells nobody', async () => {
+    const { service, requests, notifier, events } = makeService();
+    requests.updateIf.mockResolvedValue(undefined);
+
+    await service.failDownload({ id: 11, requestId: 7 } as BookRequestDownloadRow, 'stalled');
+
+    expect(notifier.notifyResponsible).not.toHaveBeenCalled();
+    expect(events.emit).not.toHaveBeenCalled();
+  });
+
+  /** An attempt that already settled keeps the reason it settled for, which is the useful one. */
+  it('does not rewrite an attempt that settled between the read and the write', async () => {
+    const { service, downloads, requests } = makeService();
+    downloads.updateIf.mockResolvedValue(undefined);
+
+    await service.failDownload({ id: 11, requestId: 7 } as BookRequestDownloadRow, 'stalled');
+
+    expect(requests.updateIf).not.toHaveBeenCalled();
+  });
+});
diff --git a/server/src/modules/book-request/fulfillment/request-fulfillment.service.ts b/server/src/modules/book-request/fulfillment/request-fulfillment.service.ts
new file mode 100644
index 000000000..f02e0d090
--- /dev/null
+++ b/server/src/modules/book-request/fulfillment/request-fulfillment.service.ts
@@ -0,0 +1,1034 @@
+import { createHash } from 'node:crypto';
+import { extname } from 'node:path';
+import {
+  BadRequestException,
+  ConflictException,
+  HttpException,
+  HttpStatus,
+  Injectable,
+  Logger,
+  NotFoundException,
+  ServiceUnavailableException,
+} from '@nestjs/common';
+import {
+  BOOK_FORMATS,
+  canonicalizeBookRequestIsbn,
+  DELIVERY_BY_DOWNLOAD_SOURCE,
+  DOWNLOAD_CLIENT_DELIVERY,
+  DOWNLOAD_CLIENT_TYPES,
+  GRABBABLE_BOOK_REQUEST_STATUSES,
+  GRAB_FAILURE_CODES,
+  isGrabbableBookRequestStatus,
+  NotificationType,
+  normalizeBookRequestIsbn,
+  releaseInspectionBlocksGrab,
+  toRequestLanguage,
+  UNSETTLED_BOOK_REQUEST_DOWNLOAD_STATUSES,
+  WORKER_WRITABLE_BOOK_REQUEST_STATUSES,
+} from '@bookorbit/types';
+import type {
+  BookRequestDownloadItem,
+  BookRequestDownloadSource,
+  BookRequestFailureMeta,
+  BookRequestHandbackCode,
+  BookRequestItem,
+  BookRequestStatus,
+  GrabFailureCode,
+  IndexerSearchFailure,
+  ReleaseFileInspection,
+  ReleaseFileInspectionStatus,
+  ReleaseManifestFile,
+  ReleaseSearchOverrides,
+  ReleaseSearchResult,
+  ReleaseUnitChoice,
+  ReleaseUnitSummary,
+} from '@bookorbit/types';
+
+import { isUniqueViolation } from '../../../common/utils/db-error.utils';
+import { sanitizeLogValue } from '../../../common/utils/log-sanitize.utils';
+import type { RequestUser } from '../../../common/types/request-user';
+import type { BookRequestDownloadRow, BookRequestRow } from '../../../db/schema';
+import { BOOK_REQUEST_DOWNLOAD_FAILED, BookRequestEventsService } from '../book-request-events.service';
+import { BookRequestGateway } from '../book-request.gateway';
+import { BookRequestNotifier } from '../book-request-notifier.service';
+import { mapBookRequestDownload, mapBookRequestRow } from '../book-request.mapper';
+import { BookRequestRepository } from '../book-request.repository';
+import { DownloadClientConfigService } from '../download-clients/download-client-config.service';
+import { DownloadClientRegistry } from '../download-clients/download-client-registry';
+import { ADD_PATH_MAPPING_HINT } from '../download-clients/path-mapping.service';
+import {
+  IndexerSearchException,
+  type IndexerAdapter,
+  type ReleaseCandidate,
+  type ReleaseFile,
+  type ResolvedIndexerConfig,
+  type TorrentFetchResult,
+} from '../indexers/indexer-adapter';
+import { IndexerConfigService } from '../indexers/indexer-config.service';
+import { IndexerRegistry } from '../indexers/indexer-registry';
+import { IndexerSearchService } from '../indexers/indexer-search.service';
+import { interpretRelease, type ReleaseFileInput, type ReleasePlan } from '../../scanner/lib/release-plan';
+import { resolveFormat } from '../indexers/release-scoring';
+import { BookRequestDownloadRepository } from './book-request-download.repository';
+import { DirectDownloadService, stagedDirectFileName } from './direct-download.service';
+import { infoHashFromMagnet, magnetDisplayName, MAX_TORRENT_FILE_BYTES, torrentMetadataFromFile, type TorrentFileMetadata } from './torrent.utils';
+import type { InspectBookRequestReleaseDto } from '../dto/inspect-book-request-release.dto';
+import type { GrabBookRequestDto } from '../dto/grab-book-request.dto';
+import type { SearchBookRequestReleasesDto } from '../dto/search-book-request-releases.dto';
+
+/** One metadata lookup against the source, spent only on the release an approver actually picked. */
+const RESOLVE_FILE_TIMEOUT_MS = 20_000;
+const TRANSIENT_GRAB_RETRY_DELAY_MS = 500;
+const RESOLVED_RELEASE_TTL_MS = 60_000;
+const MAX_RESOLVED_RELEASES = 25;
+const MAX_DISPLAYED_MANIFEST_FILES = 200;
+/** A chooser is a list a human reads, and a release with more books than this is not one. */
+const MAX_DISPLAYED_UNITS = 25;
+const SUPPORTED_BOOK_FORMATS = new Set<string>(BOOK_FORMATS);
+
+/** Searching costs a hit on every configured tracker, so a refused request does not get one. */
+const UNSEARCHABLE: BookRequestStatus[] = ['rejected', 'cancelled'];
+
+/** Tracker conditions that pass on their own, so the same release is worth another attempt later. */
+const RETRYABLE_INDEXER_FAILURES: IndexerSearchFailure[] = ['timeout', 'unreachable', 'throttled'];
+
+function normalizeReleaseSearchOverrides(dto: SearchBookRequestReleasesDto): ReleaseSearchOverrides {
+  const overrides: ReleaseSearchOverrides = {};
+
+  if (dto.title !== undefined) {
+    const title = dto.title.trim();
+    if (!title) throw new BadRequestException('A search title cannot be blank');
+    overrides.title = title;
+  }
+
+  if (dto.authors !== undefined) {
+    overrides.authors = [...new Set(dto.authors.map((author) => author.trim()).filter(Boolean))];
+  }
+
+  if (dto.isbn !== undefined) {
+    if (dto.isbn === null) {
+      overrides.isbn = null;
+    } else {
+      const normalized = normalizeBookRequestIsbn(dto.isbn);
+      const canonical = normalized?.length === 10 ? canonicalizeBookRequestIsbn(normalized, null) : canonicalizeBookRequestIsbn(null, normalized);
+      if (!canonical) throw new BadRequestException(`"${dto.isbn}" is not a valid ISBN-10 or ISBN-13`);
+      overrides.isbn = canonical;
+    }
+  }
+
+  if (dto.language !== undefined) {
+    const language = dto.language?.trim() || null;
+    overrides.language = language === null ? null : toRequestLanguage(language);
+  }
+
+  if (dto.preferredFormats !== undefined) {
+    overrides.preferredFormats = [...new Set(dto.preferredFormats.map((format) => format.trim().toLowerCase()).filter(Boolean))];
+  }
+
+  return overrides;
+}
+
+@Injectable()
+export class RequestFulfillmentService {
+  private readonly logger = new Logger(RequestFulfillmentService.name);
+  private readonly resolvedReleases = new Map<string, CachedResolvedRelease>();
+
+  constructor(
+    private readonly requests: BookRequestRepository,
+    private readonly downloads: BookRequestDownloadRepository,
+    private readonly clients: DownloadClientConfigService,
+    private readonly registry: DownloadClientRegistry,
+    private readonly direct: DirectDownloadService,
+    private readonly indexers: IndexerConfigService,
+    private readonly indexerRegistry: IndexerRegistry,
+    private readonly releases: IndexerSearchService,
+    private readonly notifier: BookRequestNotifier,
+    private readonly gateway: BookRequestGateway,
+    private readonly events: BookRequestEventsService,
+  ) {}
+
+  /**
+   * The ranked, cross-indexer release list for one request. Read-only, cached briefly, and the
+   * only place a release is turned into something a grab can name.
+   */
+  async listReleases(requestId: number, options: { refresh?: boolean; overrides?: SearchBookRequestReleasesDto } = {}): Promise<ReleaseSearchResult> {
+    const joined = await this.requests.findById(requestId);
+    if (!joined) throw new NotFoundException('Book request not found');
+    if (UNSEARCHABLE.includes(joined.request.status as BookRequestStatus)) {
+      throw new BadRequestException(`A request that is ${joined.request.status} is not searched for releases`);
+    }
+
+    return this.releases.search(joined.request, {
+      refresh: options.refresh,
+      overrides: options.overrides ? normalizeReleaseSearchOverrides(options.overrides) : undefined,
+    });
+  }
+
+  /**
+   * Every attempt this request has made, newest first, including the ones a source refused before
+   * anything was downloaded. A request that ended up downloading from the second source looks
+   * unremarkable from its own row; the first source having been asked and having said no is only
+   * visible here.
+   */
+  async listAttempts(requestId: number): Promise<BookRequestDownloadItem[]> {
+    if (!(await this.requests.findById(requestId))) throw new NotFoundException('Book request not found');
+    return (await this.downloads.findForRequest(requestId)).map(mapBookRequestDownload);
+  }
+
+  async inspectRelease(requestId: number, dto: InspectBookRequestReleaseDto): Promise<ReleaseFileInspection> {
+    const joined = await this.requests.findById(requestId);
+    if (!joined) throw new NotFoundException('Book request not found');
+    if (UNSEARCHABLE.includes(joined.request.status as BookRequestStatus)) {
+      throw new BadRequestException(`A request that is ${joined.request.status} cannot inspect releases`);
+    }
+
+    return (await this.resolvePickedRelease(requestId, dto.indexerId, dto.releaseGuid.trim())).inspection;
+  }
+
+  /**
+   * Hands a picked release, a magnet or a .torrent to the download client and starts watching it.
+   * The row is written before the client is called: an add that succeeds against a row we failed
+   * to persist would leave a torrent nobody owns.
+   *
+   * A null `user` is the automation grabbing unattended, which is recorded on the attempt: it is
+   * what makes that attempt eligible to be retried with the next-best release.
+   */
+  async grab(requestId: number, dto: GrabBookRequestDto, user: RequestUser | null): Promise<BookRequestItem> {
+    const joined = await this.requests.findById(requestId);
+    if (!joined) throw new NotFoundException('Book request not found');
+    const request = joined.request;
+
+    if (!isGrabbableBookRequestStatus(request.status as BookRequestStatus)) {
+      throw new BadRequestException(`A request that is ${request.status} cannot be sent to a download client`);
+    }
+    // Finalize resolves a destination from the row, and a request with no library would stop at
+    // "missing_destination" after the whole download had already run.
+    if (request.targetLibraryId === null) {
+      throw new BadRequestException('Set a destination library on this request before grabbing a release');
+    }
+
+    // Claimed before anything external happens, and conditionally, so two callers cannot both read
+    // a grabbable status and go on to start two different releases for one request. The duplicate
+    // index catches the same release twice; nothing else catches two different ones.
+    const previousStatus = request.status as BookRequestStatus;
+    const claim = await this.requests.claimForGrab(requestId, GRABBABLE_BOOK_REQUEST_STATUSES);
+    if (claim !== 'claimed') {
+      throw new RequestAlreadyClaimedException(
+        claim === 'duplicate'
+          ? 'Somebody has already requested this book again, and that request now holds the claim on it. Work from that one instead.'
+          : 'Another release is already being sent for this request',
+      );
+    }
+
+    try {
+      return await this.startGrab(requestId, dto, user);
+    } catch (error) {
+      // The claim is only good while this attempt is live. Anything that stops it hands the request
+      // back in the state it was found in, so the picker still offers another release - but only if
+      // the claim is still ours, because a cancellation that landed mid-grab is not something to
+      // roll back over.
+      await this.requests.updateIf(requestId, ['grabbed'], { status: previousStatus });
+      throw error;
+    }
+  }
+
+  private async startGrab(requestId: number, dto: GrabBookRequestDto, user: RequestUser | null): Promise<BookRequestItem> {
+    // Asking the source is the part worth recording when it refuses, because a refusal nobody
+    // recorded is exactly the one that gets asked about later: "it downloaded from the second
+    // source, but was the first one even tried?"
+    let grab: ResolvedGrab;
+    try {
+      grab = await this.withTransientRetry(user === null, requestId, 'source', () => this.resolveGrab(requestId, dto));
+      assertReleaseCanImport(grab.inspection);
+    } catch (error) {
+      await this.recordRefusedAttempt(requestId, dto, user, error);
+      throw error;
+    }
+
+    // Deliberately outside it: this refuses on the routing alone, before anything is asked of a
+    // client, and an attempt nothing was ever asked to take is not an attempt.
+    const client = await this.resolveClient(dto.downloadClientId ?? null, grab.source);
+    const directUrl = client === null ? requireFileUrl(grab) : null;
+    const directFileName = client === null ? stagedDirectFileName(grab.fileName, grab.releaseFormat) : null;
+
+    let download: BookRequestDownloadRow;
+    try {
+      download = await this.downloads.create({
+        requestId,
+        downloadClientId: client?.id ?? null,
+        indexerId: grab.indexerId ?? null,
+        source: grab.source,
+        automated: user === null,
+        releaseTitle: grab.releaseTitle,
+        releaseGuid: grab.releaseGuid ?? null,
+        releaseSizeBytes: grab.releaseSizeBytes,
+        releaseSeeders: grab.releaseSeeders ?? null,
+        releaseFormat: grab.releaseFormat ?? null,
+        freeleech: grab.freeleech ?? false,
+        clientHash: grab.infoHash,
+        directUrl,
+        directFileName,
+        status: 'queued',
+        grabbedAt: new Date(),
+      });
+    } catch (error) {
+      if (isUniqueViolation(error)) {
+        throw grabConflict('GRAB_RELEASE_REFUSED', 'That release is already downloading, or waiting for a review, on another request');
+      }
+      throw error;
+    }
+
+    try {
+      if (client === null) {
+        await this.direct.add({
+          downloadId: download.id,
+          fileUrl: directUrl as string,
+          fileName: directFileName as string,
+          infoHash: grab.infoHash,
+        });
+      } else {
+        const config = await this.clients.resolveConfig(client.id);
+        const adapter = this.registry.require(config.adapterType);
+        await this.withTransientRetry(user === null, requestId, 'client', () =>
+          adapter.add(
+            {
+              magnet: grab.magnet,
+              torrentFile: grab.torrentFile,
+              torrentFileName: grab.torrentFileName ?? dto.torrentFileName,
+              infoHash: grab.infoHash,
+              // The indexer's goals, enforced by the client: BookOrbit never stops a seed itself.
+              ...(grab.seedRatioGoal !== null && grab.seedRatioGoal !== undefined ? { seedRatioGoal: grab.seedRatioGoal } : {}),
+              ...(grab.seedTimeMinutes !== null && grab.seedTimeMinutes !== undefined ? { seedTimeMinutes: grab.seedTimeMinutes } : {}),
+            },
+            config,
+          ),
+        );
+      }
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      await this.downloads.update(download.id, {
+        status: 'failed',
+        errorMessage: message,
+        ...(client === null ? { directUrl: null, directEtag: null, directLastModified: null } : {}),
+      });
+      this.logger.warn(
+        `[book_request.grab] [fail] requestId=${requestId} downloadId=${download.id} clientId=${client?.id ?? 'direct'} error="${sanitizeLogValue(message)}" - the download could not be started`,
+      );
+      // Which half refused decides what another attempt should do: a client that is down refuses
+      // every torrent alike, while a file BookOrbit fetches itself was refused by the source.
+      throw withGrabCode(
+        error,
+        client === null ? 'GRAB_SOURCE_REFUSED' : isServiceUnavailable(error) ? 'GRAB_CLIENT_UNAVAILABLE' : 'GRAB_CLIENT_REFUSED',
+      );
+    }
+
+    // Still conditional on the claim this grab took, so a cancellation that landed while the client
+    // was being asked is not overwritten by the answer.
+    await this.requests.updateIf(requestId, ['grabbed'], { status: 'grabbed', statusReason: null });
+    // A retry is the one way out of a settled status, and someone who hid the failure still wants
+    // the book when it lands. Leaving the dismissal on would hide the arrival too.
+    await this.requests.clearDismissals(requestId);
+    this.logger.log(
+      `[book_request.grab] [end] requestId=${requestId} downloadId=${download.id} clientId=${client?.id ?? 'direct'} indexerId=${grab.indexerId ?? 'none'} indexer="${sanitizeLogValue(grab.indexerName ?? 'pasted by hand')}" userId=${user?.id ?? 'automation'} source=${grab.source} hash=${grab.infoHash} - release grab started`,
+    );
+    this.gateway.emitChanged();
+
+    return this.toItem(requestId, user?.id ?? null);
+  }
+
+  private async withTransientRetry<T>(automated: boolean, requestId: number, phase: 'source' | 'client', run: () => Promise<T>): Promise<T> {
+    try {
+      return await run();
+    } catch (error) {
+      if (!automated || !isTransientGrabFailure(error)) throw error;
+
+      const code = grabFailureCode(error) ?? (phase === 'client' ? 'GRAB_CLIENT_UNAVAILABLE' : 'GRAB_SOURCE_UNAVAILABLE');
+      this.logger.warn(
+        `[book_request.grab_retry] [start] requestId=${requestId} phase=${phase} code=${code} backoffMs=${TRANSIENT_GRAB_RETRY_DELAY_MS} - retrying one transient grab refusal`,
+      );
+      await new Promise<void>((resolve) => setTimeout(resolve, TRANSIENT_GRAB_RETRY_DELAY_MS));
+      return run();
+    }
+  }
+
+  /**
+   * Keeps a source's refusal as an attempt in its own right, since nothing else records it: the
+   * request moves on to the next release and its own row ends up describing whichever one worked.
+   *
+   * Only for a release picked out of the list, and only for a refusal that was classified: a
+   * hand-pasted magnet has no source to attribute, and an unclassified error is a fault on our
+   * side rather than an answer about the release. A failure to write the record must never be
+   * what stops the refusal itself being reported, so it is logged and swallowed.
+   */
+  private async recordRefusedAttempt(requestId: number, dto: GrabBookRequestDto, user: RequestUser | null, error: unknown): Promise<void> {
+    const code = grabFailureCode(error);
+    const releaseGuid = dto.releaseGuid?.trim();
+    if (code === null || !releaseGuid || !dto.indexerId) return;
+
+    const release = this.releases.find(requestId, dto.indexerId, releaseGuid);
+    if (!release) return;
+
+    try {
+      await this.downloads.create({
+        requestId,
+        downloadClientId: null,
+        indexerId: dto.indexerId,
+        source: await this.attemptedSource(release),
+        automated: user === null,
+        releaseTitle: release.title.slice(0, 500),
+        releaseGuid,
+        releaseSizeBytes: release.sizeBytes,
+        releaseSeeders: release.seeders,
+        releaseFormat: resolveFormat(release)?.slice(0, 20) ?? null,
+        freeleech: release.freeleech ?? false,
+        clientHash: null,
+        status: 'failed',
+        errorMessage: error instanceof Error ? error.message : String(error),
+        grabbedAt: new Date(),
+      });
+    } catch (writeError: unknown) {
+      const message = writeError instanceof Error ? writeError.message : String(writeError);
+      this.logger.warn(
+        `[book_request.grab] [fail] requestId=${requestId} indexerId=${dto.indexerId} error="${sanitizeLogValue(message)}" - could not record the refused attempt`,
+      );
+    }
+  }
+
+  /**
+   * What the attempt would have become, read off the adapter the same way `resolveRelease` reads
+   * it. Recorded rather than left blank because "a torrent we never got" and "a file the source
+   * would not serve" are different stories about the same refusal.
+   */
+  private async attemptedSource(release: ReleaseCandidate): Promise<BookRequestDownloadSource> {
+    if (release.magnet) return 'magnet';
+    try {
+      const indexer = await this.indexers.resolveConfig(release.indexerId);
+      return this.indexerRegistry.require(indexer.adapterType).resolveFile ? 'direct_url' : 'torrent_file';
+    } catch {
+      return 'torrent_file';
+    }
+  }
+
+  /**
+   * The classified fields move with the prose rather than separately: a reason cleared without its
+   * code would leave a stale code translating a failure that is no longer there.
+   *
+   * `from` is what the caller believes the request is in and is worth narrowing. The default set
+   * includes `grabbed` and `downloading`, so a background pass writing a terminal status against
+   * it will happily stamp `failed` over a healthy download somebody started by hand in the
+   * meantime - and the UI then invites a retry that would grab the same book twice.
+   */
+  async setRequestStatus(
+    requestId: number,
+    status: BookRequestStatus,
+    statusReason?: string | null,
+    failure?: { code: BookRequestHandbackCode; meta?: BookRequestFailureMeta } | null,
+    from: readonly BookRequestStatus[] = WORKER_WRITABLE_BOOK_REQUEST_STATUSES,
+  ): Promise<boolean> {
+    const updated = await this.requests.updateIf(requestId, from, {
+      status,
+      ...(statusReason !== undefined ? { statusReason, failureCode: failure?.code ?? null, failureMeta: failure?.meta ?? null } : {}),
+    });
+    if (!updated) return false;
+    this.gateway.emitChanged();
+    return true;
+  }
+
+  /**
+   * The single way an attempt ends badly, so every caller produces the same request state, the
+   * same audit trail and the same approver notification.
+   */
+  async failDownload(download: BookRequestDownloadRow, reason: string): Promise<void> {
+    // Both writes are conditional, and both callers are sweeps over rows read some time ago: the
+    // poll loop and the watchdog. An attempt somebody already settled keeps the reason it settled
+    // for, and a request somebody already cancelled, rejected or filed stays that way rather than
+    // being reopened as a failure - which would also announce a failure nobody is waiting on.
+    if (
+      !(await this.downloads.updateIf(download.id, UNSETTLED_BOOK_REQUEST_DOWNLOAD_STATUSES, {
+        status: 'failed',
+        errorMessage: reason,
+        ...(download.source === 'direct_url' ? { directUrl: null, directEtag: null, directLastModified: null } : {}),
+      }))
+    ) {
+      return;
+    }
+    if (!(await this.requests.updateIf(download.requestId, WORKER_WRITABLE_BOOK_REQUEST_STATUSES, { status: 'failed', statusReason: reason }))) {
+      this.logger.log(
+        `[book_request.download] [end] requestId=${download.requestId} downloadId=${download.id} - the attempt failed after the request was settled, so the request was left alone`,
+      );
+      this.gateway.emitChanged();
+      return;
+    }
+
+    const joined = await this.requests.findById(download.requestId);
+    const title = joined?.request.title ?? `request #${download.requestId}`;
+
+    this.logger.warn(
+      `[book_request.download] [fail] requestId=${download.requestId} downloadId=${download.id} error="${sanitizeLogValue(reason)}" - download attempt failed`,
+    );
+
+    await this.notifier.notifyResponsible(
+      { id: download.requestId, selfServe: joined?.request.selfServe ?? false },
+      NotificationType.BookRequestFailed,
+      {
+        title: 'Book request download failed',
+        message: `"${title}": ${reason}`,
+        actionUrl: '/requests',
+        meta: { requestId: download.requestId, downloadId: download.id },
+      },
+    );
+    this.gateway.emitChanged();
+    // Last, so a retry policy listening here sees a request already marked failed and a
+    // notification already sent, whatever it decides to do next.
+    this.events.emit(BOOK_REQUEST_DOWNLOAD_FAILED, download.id);
+  }
+
+  /**
+   * The attempt stays in the dock for a human instead of failing. The difference from
+   * `failDownload` is what happens to the bytes: a failed attempt is over, while a held one is a
+   * finished download waiting on a question, and throwing it away would mean downloading it twice.
+   */
+  async holdForReview(
+    download: BookRequestDownloadRow,
+    request: Pick<BookRequestRow, 'id' | 'title' | 'selfServe'>,
+    reason: string,
+    extra: { releaseUnits?: ReleaseUnitChoice[] } = {},
+  ): Promise<void> {
+    const message = `Held for review: ${reason}`;
+    // Same conditional shape as `failDownload`: the download that reached this point started well
+    // before it, and a request settled in the meantime must not be reopened to ask a question
+    // nobody needs answered any more.
+    const held = await this.downloads.updateIf(download.id, UNSETTLED_BOOK_REQUEST_DOWNLOAD_STATUSES, {
+      status: 'needs_review',
+      errorMessage: message,
+      releaseUnits: extra.releaseUnits ?? null,
+    });
+    if (!held) return;
+    if (!(await this.requests.updateIf(request.id, WORKER_WRITABLE_BOOK_REQUEST_STATUSES, { status: 'needs_review', statusReason: message }))) {
+      this.gateway.emitChanged();
+      return;
+    }
+
+    await this.notifier.notifyResponsible(request, NotificationType.BookRequestNeedsReview, {
+      title: 'Book request needs review',
+      message: `"${request.title}": ${reason}`,
+      actionUrl: '/requests',
+      meta: { requestId: request.id, dockFileId: download.bookDockFileId },
+    });
+    this.gateway.emitChanged();
+  }
+
+  /** Reads back through the repository so the caller gets the row exactly as the lists serve it. */
+  private async toItem(requestId: number, viewerId: number | null): Promise<BookRequestItem> {
+    const joined = await this.requests.findById(requestId);
+    if (!joined) throw new NotFoundException('Book request not found');
+    const [subscribers, downloads, dismissed] = await Promise.all([
+      this.requests.findSubscribers([requestId]),
+      this.downloads.findLatestForRequests([requestId]),
+      viewerId === null ? Promise.resolve(new Set<number>()) : this.requests.findDismissedRequestIds(viewerId, [requestId]),
+    ]);
+    return mapBookRequestRow(joined, subscribers.get(requestId) ?? [], downloads.get(requestId) ?? null, dismissed.has(requestId));
+  }
+
+  /**
+   * Turns whichever of the three grab shapes the approver used into one payload. A picked release
+   * is resolved from this server's own search results rather than from anything the client sent,
+   * so the download URL, the tracker credential and the seed goals never round-trip through a
+   * browser.
+   */
+  private async resolveGrab(requestId: number, dto: GrabBookRequestDto): Promise<ResolvedGrab> {
+    const named = [Boolean(dto.releaseGuid?.trim() && dto.indexerId), Boolean(dto.magnet?.trim()), Boolean(dto.torrentFileBase64?.trim())];
+    if (named.filter(Boolean).length !== 1) {
+      throw new BadRequestException('Provide exactly one of a picked release, a magnet link or a .torrent file');
+    }
+
+    if (!named[0]) return parseGrabPayload(dto);
+
+    return this.resolvePickedRelease(requestId, dto.indexerId!, dto.releaseGuid!.trim());
+  }
+
+  private async resolvePickedRelease(requestId: number, indexerId: number, releaseGuid: string): Promise<ResolvedGrab> {
+    const release = this.releases.find(requestId, indexerId, releaseGuid);
+    if (!release) {
+      throw grabError('GRAB_RELEASE_REFUSED', 'That release is no longer in the search results. Search again and pick one.');
+    }
+
+    const key = `${requestId}:${indexerId}:${releaseGuid}`;
+    const cached = this.resolvedReleases.get(key);
+    if (cached && cached.candidate === release && cached.expiresAt > Date.now()) return cached.grab;
+
+    const grab = await this.resolveRelease(requestId, release);
+    this.rememberResolvedRelease(key, release, grab);
+    return grab;
+  }
+
+  private async resolveRelease(requestId: number, release: ReleaseCandidate): Promise<ResolvedGrab> {
+    const indexer = await this.indexers.resolveConfig(release.indexerId);
+    try {
+      return await this.resolveReleaseFor(indexer, release);
+    } catch (error) {
+      // The refusal travels to the caller as a 4xx, and the filter deliberately logs no client
+      // error, so without this line a source that searches fine and only fails on download leaves
+      // nothing behind but a route and a status. Searching already logs its own failures; this is
+      // the other half, and it is the half that names which source refused.
+      this.logger.warn(
+        `[book_request.release_resolve] [fail] requestId=${requestId} indexerId=${indexer.id} indexerName="${sanitizeLogValue(indexer.name)}" errorCode=${errorCodeOf(error)} error="${sanitizeLogValue(error instanceof Error ? error.message : String(error))}" - could not resolve the picked release`,
+      );
+      throw error;
+    }
+  }
+
+  private async resolveReleaseFor(indexer: ResolvedIndexerConfig, release: ReleaseCandidate): Promise<ResolvedGrab> {
+    const snapshot = {
+      indexerId: release.indexerId,
+      indexerName: indexer.name,
+      releaseGuid: release.guid,
+      releaseTitle: release.title.slice(0, 500),
+      releaseSizeBytes: release.sizeBytes,
+      releaseSeeders: release.seeders,
+      // The resolved format, not the raw field: most indexers state none and it is read off the
+      // release name, which is what the picker showed the approver.
+      releaseFormat: resolveFormat(release)?.slice(0, 20) ?? null,
+      freeleech: release.freeleech ?? false,
+      // Both come from the tracker itself, via torznab's `minimumratio` and `minimumseedtime`.
+      // There is no per-source override for either: the download client's own defaults are the
+      // fallback where a feed states nothing.
+      seedRatioGoal: release.seedRatioGoal ?? null,
+      seedTimeMinutes: release.seedTimeMinutes ?? null,
+    };
+
+    if (release.magnet) {
+      return {
+        ...snapshot,
+        source: 'magnet',
+        magnet: release.magnet,
+        infoHash: infoHashFromMagnet(release.magnet),
+        inspection: metadataUnavailableInspection('magnet'),
+      };
+    }
+
+    const adapter = this.indexerRegistry.require(indexer.adapterType);
+
+    // A source that serves the file itself. Resolved here rather than at search time because it
+    // costs a request per release, and only the one the approver picked is worth spending on.
+    if (adapter.resolveFile) {
+      const file = await resolveReleaseFile(adapter, release, indexer);
+      // The name this will be staged under, resolved once and used for both answers. Inspection
+      // has to speak about the name the importer will classify rather than the one the source
+      // happened to state, or it can call a release ready that the importer finds no book in.
+      const fileName = stagedDirectFileName(file.fileName, file.format);
+      return {
+        ...snapshot,
+        source: 'direct_url',
+        fileUrl: file.url,
+        fileName,
+        // A digest of the URL, because there is no infohash and the poll loop still needs a key.
+        infoHash: createHash('sha1').update(file.url).digest('hex'),
+        releaseFormat: file.format.slice(0, 20),
+        // The one figure the search could not state: an item's size is not the book's size.
+        releaseSizeBytes: file.sizeBytes ?? snapshot.releaseSizeBytes,
+        // Nothing is seeded back, so a seed goal would only mislead the client.
+        seedRatioGoal: null,
+        seedTimeMinutes: null,
+        inspection: directFileInspection(fileName, file.sizeBytes),
+      };
+    }
+
+    // A private tracker's download link is credentialed, so the .torrent is fetched here with the
+    // indexer's own session rather than handed to the download client as a URL it cannot open.
+    if (!adapter.fetchTorrentFile) {
+      throw grabError('GRAB_SOURCE_REFUSED', `${indexer.name} released no magnet link, and its adapter cannot fetch a .torrent file`);
+    }
+
+    const torrentFile = await fetchTorrentFile(adapter, release, indexer);
+    if (!Buffer.isBuffer(torrentFile)) {
+      return {
+        ...snapshot,
+        source: 'magnet',
+        magnet: torrentFile.magnet,
+        infoHash: infoHashFromMagnet(torrentFile.magnet),
+        inspection: metadataUnavailableInspection('magnet'),
+      };
+    }
+    const metadata = torrentMetadataFromFile(torrentFile);
+    return {
+      ...snapshot,
+      source: 'torrent_file',
+      torrentFile,
+      // Named after the hash rather than the guid, which on torznab is a URL and would put path
+      // separators into a multipart filename.
+      torrentFileName: `${metadata.infoHash}.torrent`,
+      infoHash: metadata.infoHash,
+      releaseSizeBytes: snapshot.releaseSizeBytes ?? metadata.totalLength,
+      inspection: torrentInspection(metadata),
+    };
+  }
+
+  private rememberResolvedRelease(key: string, candidate: ReleaseCandidate, grab: ResolvedGrab): void {
+    const now = Date.now();
+    for (const [cachedKey, cached] of this.resolvedReleases) {
+      if (cached.expiresAt <= now) this.resolvedReleases.delete(cachedKey);
+    }
+    if (this.resolvedReleases.size >= MAX_RESOLVED_RELEASES) {
+      const oldest = this.resolvedReleases.keys().next().value as string | undefined;
+      if (oldest) this.resolvedReleases.delete(oldest);
+    }
+    this.resolvedReleases.set(key, { candidate, grab, expiresAt: now + RESOLVED_RELEASE_TTL_MS });
+  }
+
+  /**
+   * Which downloader takes this release, where null is BookOrbit fetching the file itself. A
+   * direct file never has a client: there is nothing to configure and nothing to choose, so a
+   * fresh install grabs one without a download client existing at all.
+   *
+   * For a torrent it is capability first, priority second. A torrent client cannot fetch a URL,
+   * so taking the highest-priority enabled row regardless would hand a release to a client that
+   * has to reject it.
+   */
+  private async resolveClient(requestedId: number | null, source: BookRequestDownloadSource) {
+    if (requestedId === null) {
+      if (DELIVERY_BY_DOWNLOAD_SOURCE[source] === 'file') return null;
+
+      const types = DOWNLOAD_CLIENT_TYPES.filter((type) => DOWNLOAD_CLIENT_DELIVERY[type] === 'torrent');
+      const preferred = await this.clients.findPreferredEnabled(types);
+      if (!preferred) {
+        throw grabError('GRAB_CLIENT_REFUSED', 'No torrent download client is configured. Add one under Settings > System > Requests.');
+      }
+      const preferredClient = await this.clients.findOne(preferred.id);
+      this.assertClientCanImport(preferredClient);
+      return preferredClient;
+    }
+
+    const client = await this.clients.findOne(requestedId);
+    if (!client.enabled) throw grabError('GRAB_CLIENT_REFUSED', `Download client "${client.name}" is disabled`);
+    this.assertClientCanDeliver(client, source);
+    this.assertClientCanImport(client);
+    return client;
+  }
+
+  /**
+   * A client with no path mapping declares no directory the import is allowed to read out of, so
+   * the attempt would seed for hours and then be refused the moment it finished. Rows that predate
+   * mappings being mandatory are what reaches this; refusing now says so while somebody is looking.
+   */
+  private assertClientCanImport(client: { name: string; pathMappings: readonly unknown[] }): void {
+    if (client.pathMappings.length > 0) return;
+    throw grabError(
+      'GRAB_CLIENT_REFUSED',
+      `Download client "${client.name}" has no path mapping, so nothing it downloads could be imported. ${ADD_PATH_MAPPING_HINT}`,
+    );
+  }
+
+  private assertClientCanDeliver(client: { name: string; adapterType: keyof typeof DOWNLOAD_CLIENT_DELIVERY }, source: BookRequestDownloadSource) {
+    const expected = DELIVERY_BY_DOWNLOAD_SOURCE[source];
+    if (DOWNLOAD_CLIENT_DELIVERY[client.adapterType] === expected) return;
+
+    throw grabError(
+      'GRAB_CLIENT_REFUSED',
+      expected === 'file'
+        ? `Download client "${client.name}" cannot fetch a direct file`
+        : `Download client "${client.name}" cannot accept a magnet link or .torrent file`,
+    );
+  }
+}
+
+/**
+ * A tracker refusing one release ("VIP torrent and you are not VIP or higher") is an answer, and
+ * the reason is the tracker's own sentence. Letting the adapter's error through unmapped reports
+ * it as a 500 with a stack trace, which loses the sentence and reads as a fault on our side.
+ */
+async function fetchTorrentFile(adapter: IndexerAdapter, release: ReleaseCandidate, indexer: ResolvedIndexerConfig): Promise<TorrentFetchResult> {
+  try {
+    return await adapter.fetchTorrentFile!(release, indexer);
+  } catch (error) {
+    if (!(error instanceof IndexerSearchException)) throw error;
+    throw indexerRefusal(error, release);
+  }
+}
+
+/** The same mapping for a source that serves the file itself, which refuses in the same ways. */
+async function resolveReleaseFile(adapter: IndexerAdapter, release: ReleaseCandidate, indexer: ResolvedIndexerConfig): Promise<ReleaseFile> {
+  try {
+    return await adapter.resolveFile!(release, indexer, AbortSignal.timeout(RESOLVE_FILE_TIMEOUT_MS));
+  } catch (error) {
+    if (!(error instanceof IndexerSearchException)) throw error;
+    throw indexerRefusal(error, release);
+  }
+}
+
+/**
+ * How far a source's refusal reaches. A tracker that will not serve a VIP-only release to a
+ * non-VIP account still serves its ordinary ones, so that refusal is marked as being about the
+ * VIP releases rather than about the tracker: skipping the whole source would throw away every
+ * release it holds over a restriction that applies to a handful of them.
+ */
+function indexerRefusal(error: IndexerSearchException, release: ReleaseCandidate): HttpException {
+  if (RETRYABLE_INDEXER_FAILURES.includes(error.failure)) {
+    return grabUnavailable('GRAB_SOURCE_UNAVAILABLE', error.message);
+  }
+  return grabError(release.vipOnly === true ? 'GRAB_VIP_REQUIRED' : 'GRAB_SOURCE_REFUSED', error.message);
+}
+
+/**
+ * A refusal an automatic attempt can route around. The code travels to the picker as `errorCode`
+ * and to the failover as a scope, while the message stays the source's own sentence.
+ */
+/** The stable code off an HttpException body, so the log line says which refusal this was. */
+function errorCodeOf(error: unknown): string {
+  const response = error instanceof HttpException ? error.getResponse() : null;
+  const code = typeof response === 'object' && response !== null ? (response as { errorCode?: unknown }).errorCode : null;
+  return typeof code === 'string' ? code : 'UNKNOWN';
+}
+
+function grabError(errorCode: GrabFailureCode, message: string): BadRequestException {
+  return new BadRequestException({ message, errorCode, statusCode: HttpStatus.BAD_REQUEST });
+}
+
+function grabUnavailable(errorCode: GrabFailureCode, message: string): ServiceUnavailableException {
+  return new ServiceUnavailableException({ message, errorCode, statusCode: HttpStatus.SERVICE_UNAVAILABLE });
+}
+
+function grabConflict(errorCode: GrabFailureCode, message: string): ConflictException {
+  return new ConflictException({ message, errorCode, statusCode: HttpStatus.CONFLICT });
+}
+
+/**
+ * The refusal that means somebody else is driving this request: the grab claim was taken between
+ * reading a grabbable status and holding it.
+ *
+ * Its own class so the automation failover can stop on it rather than work down the rest of its
+ * ranked list, every entry of which would be refused for the same reason. The body is an ordinary
+ * `GRAB_RELEASE_REFUSED` conflict, so nothing over HTTP sees a new shape.
+ */
+export class RequestAlreadyClaimedException extends ConflictException {
+  constructor(message: string) {
+    super({ message, errorCode: 'GRAB_RELEASE_REFUSED' satisfies GrabFailureCode, statusCode: HttpStatus.CONFLICT });
+  }
+}
+
+/**
+ * Adds the code to a refusal another layer already shaped, keeping its status and its sentence.
+ * Anything that is not an HTTP failure is handed back untouched: an unexpected error is a fault
+ * on our side, and dressing it as a refusal would let the failover route around a real bug.
+ */
+function withGrabCode(error: unknown, errorCode: GrabFailureCode): unknown {
+  if (!(error instanceof HttpException)) return error;
+
+  const status = error.getStatus();
+  if (status === (HttpStatus.SERVICE_UNAVAILABLE as number)) return grabUnavailable(errorCode, error.message);
+  if (status === (HttpStatus.CONFLICT as number)) return grabConflict(errorCode, error.message);
+  if (status === (HttpStatus.BAD_REQUEST as number)) return grabError(errorCode, error.message);
+  return new HttpException({ message: error.message, errorCode, statusCode: status }, status);
+}
+
+function isServiceUnavailable(error: unknown): boolean {
+  return error instanceof HttpException && error.getStatus() === (HttpStatus.SERVICE_UNAVAILABLE as number);
+}
+
+function isTransientGrabFailure(error: unknown): boolean {
+  const code = grabFailureCode(error);
+  return code === 'GRAB_SOURCE_UNAVAILABLE' || code === 'GRAB_CLIENT_UNAVAILABLE' || isServiceUnavailable(error);
+}
+
+/** The code an attempt failed with, where it carried one. Null is "we do not know", never a guess. */
+export function grabFailureCode(error: unknown): GrabFailureCode | null {
+  if (!(error instanceof HttpException)) return null;
+  const body = error.getResponse();
+  const code = typeof body === 'object' && body !== null ? (body as { errorCode?: unknown }).errorCode : undefined;
+  return typeof code === 'string' && (GRAB_FAILURE_CODES as readonly string[]).includes(code) ? (code as GrabFailureCode) : null;
+}
+
+interface ParsedGrab {
+  source: BookRequestDownloadSource;
+  infoHash: string;
+  magnet?: string;
+  torrentFile?: Buffer;
+  torrentFileName?: string;
+  fileUrl?: string;
+  fileName?: string;
+  releaseTitle: string;
+  /** The size of what the release carries, which a magnet does not state. */
+  releaseSizeBytes: number | null;
+  inspection: ReleaseFileInspection;
+}
+
+/** A parsed grab plus what an indexer knows about it, which a hand-pasted link cannot supply. */
+interface ResolvedGrab extends ParsedGrab {
+  indexerId?: number;
+  indexerName?: string;
+  releaseGuid?: string;
+  releaseSeeders?: number | null;
+  releaseFormat?: string | null;
+  freeleech?: boolean;
+  seedRatioGoal?: number | null;
+  seedTimeMinutes?: number | null;
+}
+
+interface CachedResolvedRelease {
+  candidate: ReleaseCandidate;
+  grab: ResolvedGrab;
+  expiresAt: number;
+}
+
+function parseGrabPayload(dto: GrabBookRequestDto): ParsedGrab {
+  if (dto.magnet?.trim()) {
+    const magnet = dto.magnet!.trim();
+    const infoHash = infoHashFromMagnet(magnet);
+    return {
+      source: 'magnet',
+      infoHash,
+      magnet,
+      releaseTitle: magnetDisplayName(magnet, infoHash).slice(0, 500),
+      releaseSizeBytes: null,
+      inspection: metadataUnavailableInspection('magnet'),
+    };
+  }
+
+  const torrentFile = Buffer.from(dto.torrentFileBase64!, 'base64');
+  if (torrentFile.byteLength === 0) throw new BadRequestException('That .torrent file is empty');
+  if (torrentFile.byteLength > MAX_TORRENT_FILE_BYTES) throw new BadRequestException('That .torrent file is too large');
+
+  const metadata = torrentMetadataFromFile(torrentFile);
+  const releaseTitle = (metadata.name ?? dto.torrentFileName ?? metadata.infoHash).slice(0, 500);
+  return {
+    source: 'torrent_file',
+    infoHash: metadata.infoHash,
+    torrentFile,
+    releaseTitle,
+    releaseSizeBytes: metadata.totalLength,
+    inspection: torrentInspection(metadata),
+  };
+}
+
+function torrentInspection(metadata: TorrentFileMetadata): ReleaseFileInspection {
+  const allFiles: ReleaseManifestFile[] = metadata.files.map((file) => ({
+    path: file.path,
+    sizeBytes: file.length,
+    bookFile: isSupportedBookFile(file.path),
+  }));
+  const primaryFiles = allFiles.filter((file) => file.bookFile);
+  const displayedPrimaryFiles = primaryFiles.slice(0, MAX_DISPLAYED_MANIFEST_FILES);
+  const displayed = [
+    ...displayedPrimaryFiles,
+    ...allFiles.filter((file) => !file.bookFile).slice(0, MAX_DISPLAYED_MANIFEST_FILES - displayedPrimaryFiles.length),
+  ];
+
+  const plan = interpretRelease(releaseInputsFromManifest(metadata), { rootName: metadata.name });
+
+  return {
+    source: 'torrent_file',
+    status: inspectionStatus(plan),
+    files: displayed,
+    totalFiles: allFiles.length,
+    primaryFileCount: primaryFiles.length,
+    truncated: displayed.length < allFiles.length,
+    ...unitFields(plan),
+  };
+}
+
+/**
+ * A .torrent prefixes every entry with the torrent's own name, which is a delivery detail rather
+ * than part of the layout. Stripping it here is what makes the manifest and the finished directory
+ * the same shape, so the interpreter cannot answer differently before and after the download.
+ */
+function releaseInputsFromManifest(metadata: TorrentFileMetadata): ReleaseFileInput[] {
+  const root = metadata.name;
+  const prefix = root ? `${root}/` : null;
+  const stripRoot = prefix !== null && metadata.files.every((file) => file.path.startsWith(prefix));
+
+  return metadata.files.map((file) => ({
+    path: stripRoot ? file.path.slice(prefix!.length) : file.path,
+    sizeBytes: file.length,
+  }));
+}
+
+/**
+ * What one directly served file is, read from the name it will be staged under.
+ *
+ * The declared format is spent before this point, on `stagedDirectFileName`: a source states its
+ * format out of band and is the more reliable of the two, so the name is corrected to agree with
+ * it rather than the answer being corrected to ignore the name. Trusting the format here as well
+ * is what let a nameless file be reported ready and then fail at import, since import has only
+ * the extension to classify by.
+ */
+function directFileInspection(fileName: string, sizeBytes: number | null | undefined): ReleaseFileInspection {
+  const plan = interpretRelease([{ path: fileName, sizeBytes: sizeBytes ?? null }]);
+  const bookFile = plan.units.length === 1;
+
+  return {
+    source: 'direct_url',
+    status: inspectionStatus(plan),
+    files: [{ path: fileName, sizeBytes: sizeBytes ?? null, bookFile }],
+    totalFiles: 1,
+    primaryFileCount: bookFile ? 1 : 0,
+    truncated: false,
+    ...unitFields(plan),
+  };
+}
+
+function metadataUnavailableInspection(source: 'magnet'): ReleaseFileInspection {
+  return {
+    source,
+    status: 'metadata_unavailable',
+    files: [],
+    totalFiles: null,
+    primaryFileCount: null,
+    truncated: false,
+    units: [],
+    unitCount: 0,
+    ignoredFileCount: 0,
+    containerCount: 0,
+  };
+}
+
+/**
+ * What the release becomes, in the terms the picker shows. One unit is importable however many
+ * files it is made of; several units are importable too, but only after someone says which book
+ * they wanted, so the picker names the count rather than promising a clean import.
+ */
+function inspectionStatus(plan: ReleasePlan): ReleaseFileInspectionStatus {
+  if (plan.units.length === 0) return plan.containers.length > 0 ? 'contents_unknown' : 'no_supported_file';
+  return plan.units.length === 1 ? 'ready' : 'multiple_supported_files';
+}
+
+function unitFields(plan: ReleasePlan): Pick<ReleaseFileInspection, 'units' | 'unitCount' | 'ignoredFileCount' | 'containerCount'> {
+  return {
+    units: plan.units.slice(0, MAX_DISPLAYED_UNITS).map(toUnitSummary),
+    unitCount: plan.units.length,
+    ignoredFileCount: plan.ignored.length,
+    containerCount: plan.containers.length,
+  };
+}
+
+function toUnitSummary(unit: ReleasePlan['units'][number]): ReleaseUnitSummary {
+  return {
+    mediaKind: unit.mediaKind,
+    title: unit.title,
+    contentFileCount: unit.contentFileCount,
+    totalFileCount: unit.files.length,
+    sizeBytes: unit.sizeBytes,
+  };
+}
+
+function isSupportedBookFile(fileName: string): boolean {
+  return SUPPORTED_BOOK_FORMATS.has(extname(fileName).toLowerCase().slice(1));
+}
+
+/**
+ * The grab is refused only for a release the importer could never finish. Everything else is sent:
+ * a release holding several books is resolved by an approver once it has landed, which is far
+ * better than refusing on a guess and downloading it again later.
+ */
+function assertReleaseCanImport(inspection: ReleaseFileInspection): void {
+  if (!releaseInspectionBlocksGrab(inspection.status)) return;
+  throw grabError('GRAB_RELEASE_REFUSED', 'The release contains no directly supported book file');
+}
+
+/**
+ * A `direct_url` grab is resolved from a URL, so this only fires if a source reported that shape
+ * without one. Better a stated refusal on the attempt than a fetch of `undefined`.
+ */
+function requireFileUrl(grab: { fileUrl?: string }): string {
+  if (!grab.fileUrl) throw grabError('GRAB_RELEASE_REFUSED', 'That release did not resolve to a file to download');
+  return grab.fileUrl;
+}
diff --git a/server/src/modules/book-request/fulfillment/request-import-queue.test.ts b/server/src/modules/book-request/fulfillment/request-import-queue.test.ts
new file mode 100644
index 000000000..a8d41695f
--- /dev/null
+++ b/server/src/modules/book-request/fulfillment/request-import-queue.test.ts
@@ -0,0 +1,103 @@
+import { RequestImportQueue } from './request-import-queue';
+
+/** Long enough for a settled handler to run the queue's own continuations, and no longer. */
+function flush(): Promise<void> {
+  return new Promise((resolve) => setImmediate(resolve));
+}
+
+/** A handler that only finishes when the test says so, so concurrency is observable. */
+function blockingHandler() {
+  const started: number[] = [];
+  const finishers = new Map<number, () => void>();
+  const handler = (downloadId: number) =>
+    new Promise<void>((resolve) => {
+      started.push(downloadId);
+      finishers.set(downloadId, resolve);
+    });
+  return { started, handler, finish: (downloadId: number) => finishers.get(downloadId)?.() };
+}
+
+describe('RequestImportQueue', () => {
+  it('runs no more imports at once than it is allowed', async () => {
+    const { started, handler, finish } = blockingHandler();
+    const queue = new RequestImportQueue(1, handler, () => {});
+
+    queue.enqueue(11);
+    queue.enqueue(12);
+    expect(started).toEqual([11]);
+
+    finish(11);
+    await flush();
+    expect(started).toEqual([11, 12]);
+
+    finish(12);
+    await queue.waitForIdle();
+  });
+
+  /**
+   * The completion path and the resume sweep both offer the same download, and the row stays
+   * `completed` for the whole extraction, so the sweep keeps offering it. Two runs would place the
+   * same release's files twice.
+   */
+  it('refuses a download it is already importing', () => {
+    const { started, handler } = blockingHandler();
+    const queue = new RequestImportQueue(1, handler, () => {});
+
+    expect(queue.enqueue(11)).toBe(true);
+    expect(queue.enqueue(11)).toBe(false);
+    expect(started).toEqual([11]);
+  });
+
+  it('refuses a download already waiting its turn', () => {
+    const { handler } = blockingHandler();
+    const queue = new RequestImportQueue(1, handler, () => {});
+
+    queue.enqueue(11);
+    expect(queue.enqueue(12)).toBe(true);
+    expect(queue.enqueue(12)).toBe(false);
+  });
+
+  it('takes the same download again once its import is over', async () => {
+    const { started, handler, finish } = blockingHandler();
+    const queue = new RequestImportQueue(1, handler, () => {});
+
+    queue.enqueue(11);
+    finish(11);
+    await queue.waitForIdle();
+
+    expect(queue.enqueue(11)).toBe(true);
+    expect(started).toEqual([11, 11]);
+    finish(11);
+    await queue.waitForIdle();
+  });
+
+  it('keeps going after one import throws', async () => {
+    const failures: Array<[number, unknown]> = [];
+    const queue = new RequestImportQueue(
+      1,
+      (downloadId) => (downloadId === 11 ? Promise.reject(new Error('extraction failed')) : Promise.resolve()),
+      (downloadId, error) => failures.push([downloadId, error]),
+    );
+
+    queue.enqueue(11);
+    queue.enqueue(12);
+    await queue.waitForIdle();
+
+    expect(failures).toEqual([[11, expect.objectContaining({ message: 'extraction failed' })]]);
+  });
+
+  /** Anything dropped is still `completed` with no dock row, which is what the resume sweep reads. */
+  it('drops what has not started when it stops', async () => {
+    const { started, handler, finish } = blockingHandler();
+    const queue = new RequestImportQueue(1, handler, () => {});
+
+    queue.enqueue(11);
+    queue.enqueue(12);
+    queue.stop();
+    finish(11);
+    await flush();
+
+    expect(started).toEqual([11]);
+    expect(queue.enqueue(13)).toBe(false);
+  });
+});
diff --git a/server/src/modules/book-request/fulfillment/request-import-queue.ts b/server/src/modules/book-request/fulfillment/request-import-queue.ts
new file mode 100644
index 000000000..fdb2026e7
--- /dev/null
+++ b/server/src/modules/book-request/fulfillment/request-import-queue.ts
@@ -0,0 +1,94 @@
+type ImportHandler = (downloadId: number) => Promise<void>;
+type ImportErrorHandler = (downloadId: number, error: unknown) => void;
+
+/**
+ * Imports, run off whatever noticed the download had finished.
+ *
+ * Extracting and placing a release takes minutes, and the monitor's tick is a process-wide
+ * critical section: awaiting an import inside it stops progress polling and completion handling
+ * for every other download until it returns. Handing the id here lets the tick finish immediately.
+ *
+ * Bounded, and deduplicated by download id. Both the completion path and the fifteen-second resume
+ * sweep offer the same download - the row stays `completed` for the whole extraction, so the sweep
+ * keeps finding it - and running two imports of one download would place its files twice.
+ */
+export class RequestImportQueue {
+  private readonly pending: number[] = [];
+  private readonly queued = new Set<number>();
+  private readonly running = new Set<number>();
+  private readonly idleResolvers: Array<() => void> = [];
+  private stopped = false;
+
+  constructor(
+    private readonly concurrency: number,
+    private readonly handler: ImportHandler,
+    private readonly onError: ImportErrorHandler,
+  ) {}
+
+  /** False when the download is already waiting or already being imported, or the queue is done. */
+  enqueue(downloadId: number): boolean {
+    if (this.stopped || !Number.isInteger(downloadId) || downloadId < 1) return false;
+    if (this.queued.has(downloadId) || this.running.has(downloadId)) return false;
+
+    this.queued.add(downloadId);
+    this.pending.push(downloadId);
+    this.drain();
+    return true;
+  }
+
+  /**
+   * Drops what has not started. Anything already running is left to finish, and anything dropped
+   * is picked up by the resume sweep on the next boot: the row is still `completed` with no dock
+   * row against it, which is exactly what that sweep looks for.
+   */
+  stop(): void {
+    this.stopped = true;
+    this.pending.length = 0;
+    this.queued.clear();
+    this.resolveIdleIfNeeded();
+  }
+
+  /**
+   * Every download this queue is holding, waiting or running.
+   *
+   * Concurrency is one, so a download can wait here for as long as everything ahead of it takes,
+   * receiving no writes the whole time. The watchdog ages an import by `updatedAt`, so without a
+   * way to say "these are still mine" queue depth alone would fail a healthy import.
+   */
+  members(): number[] {
+    return [...this.pending, ...this.running];
+  }
+
+  /** For tests and shutdown, which are the only callers that need the imports to have happened. */
+  waitForIdle(): Promise<void> {
+    if (this.isIdle()) return Promise.resolve();
+    return new Promise((resolve) => this.idleResolvers.push(resolve));
+  }
+
+  private drain(): void {
+    while (!this.stopped && this.running.size < this.concurrency && this.pending.length > 0) {
+      const downloadId = this.pending.shift()!;
+      this.queued.delete(downloadId);
+      this.running.add(downloadId);
+
+      void this.handler(downloadId)
+        .catch((error: unknown) => this.onError(downloadId, error))
+        .finally(() => {
+          this.running.delete(downloadId);
+          this.drain();
+          this.resolveIdleIfNeeded();
+        });
+    }
+
+    this.resolveIdleIfNeeded();
+  }
+
+  private isIdle(): boolean {
+    return this.pending.length === 0 && this.running.size === 0;
+  }
+
+  private resolveIdleIfNeeded(): void {
+    if (!this.isIdle()) return;
+    for (const resolve of this.idleResolvers.splice(0)) resolve();
+  }
+}
diff --git a/server/src/modules/book-request/fulfillment/request-import.service.test.ts b/server/src/modules/book-request/fulfillment/request-import.service.test.ts
new file mode 100644
index 000000000..a26ae6fdf
--- /dev/null
+++ b/server/src/modules/book-request/fulfillment/request-import.service.test.ts
@@ -0,0 +1,840 @@
+import { link, mkdir, mkdtemp, readdir, readFile, realpath, stat, symlink, unlink, writeFile } from 'fs/promises';
+import { tmpdir } from 'os';
+import { basename, join } from 'path';
+
+import type { BookRequestDownloadRow, BookRequestRow } from '../../../db/schema';
+import { PathMappingService } from '../download-clients/path-mapping.service';
+import { RequestImportService } from './request-import.service';
+
+function request(overrides: Partial<BookRequestRow> = {}): BookRequestRow {
+  return {
+    id: 7,
+    userId: 3,
+    title: 'Dune',
+    targetLibraryId: 2,
+    targetFolderId: 5,
+    ...overrides,
+  } as BookRequestRow;
+}
+
+function download(contentPath: string, overrides: Partial<BookRequestDownloadRow> = {}): BookRequestDownloadRow {
+  return { id: 11, requestId: 7, downloadClientId: 1, contentPath, ...overrides } as BookRequestDownloadRow;
+}
+
+async function makeHarness(options: { useHardlinks?: boolean } = {}) {
+  const root = await realpath(await mkdtemp(join(tmpdir(), 'bookorbit-import-')));
+  const bookDockPath = join(root, 'dock');
+  const appDataPath = join(root, 'app-data');
+  /** What a mapped download client declares, and what the import may therefore read out of. */
+  const downloadsPath = join(root, 'downloads');
+  /** Where a direct fetch stages, which is that download's own containment root. */
+  const directDownloadsPath = join(appDataPath, 'request-downloads');
+  await mkdir(bookDockPath, { recursive: true });
+  await mkdir(downloadsPath, { recursive: true });
+  await mkdir(directDownloadsPath, { recursive: true });
+
+  let nextDockId = 100;
+  const dockRepo = {
+    create: vi.fn().mockImplementation((data: Record<string, unknown>) => Promise.resolve({ id: nextDockId++, ...data })),
+    createUnit: vi.fn().mockImplementation((data: Record<string, unknown>) => Promise.resolve({ id: nextDockId++, ...data })),
+    findUnitFiles: vi.fn().mockResolvedValue([]),
+    deleteById: vi.fn().mockResolvedValue(undefined),
+    findByAbsolutePath: vi.fn().mockResolvedValue(undefined),
+    findByUnitDirectory: vi.fn().mockResolvedValue(undefined),
+  };
+  const downloads = {
+    update: vi.fn().mockResolvedValue(undefined),
+    updateIf: vi.fn(),
+    findById: vi.fn().mockResolvedValue(undefined),
+  };
+  // Conditional like the repository it stands for, because the choice import claims the attempt
+  // with it: a mock that always answers would let two passes both believe they hold the same one.
+  downloads.updateIf.mockImplementation(async (id: number, expected: readonly string[], patch: Record<string, unknown>) => {
+    const row = (await downloads.findById(id)) as { status: string } | undefined;
+    return row && expected.includes(row.status) ? { ...row, ...patch } : undefined;
+  });
+  const requests = {
+    findById: vi.fn().mockResolvedValue({ request: request() }),
+    findRequestViewerIds: vi.fn().mockResolvedValue(new Map([[7, [3]]])),
+    update: vi.fn().mockResolvedValue(undefined),
+    updateIf: vi.fn().mockImplementation((id: number, _expected: unknown, patch: Record<string, unknown>) => Promise.resolve({ id, ...patch })),
+  };
+  const gateway = { emitProgress: vi.fn(), emitChanged: vi.fn() };
+  const fulfillment = { failDownload: vi.fn().mockResolvedValue(undefined), holdForReview: vi.fn().mockResolvedValue(undefined) };
+  const dockIngest = { ingestFromWatchedFolder: vi.fn().mockResolvedValue(null) };
+  const audit = { record: vi.fn().mockResolvedValue(undefined) };
+  const removal = { cleanupStagedDirectDownload: vi.fn().mockResolvedValue(undefined) };
+  // The real containment check over a stubbed mapping, so these tests exercise the boundary the
+  // importer actually applies rather than a mock that always agrees with it.
+  const pathMappings = new PathMappingService({
+    findPathMappings: vi.fn().mockResolvedValue([{ remotePath: downloadsPath, localPath: downloadsPath }]),
+  } as never);
+
+  const service = new RequestImportService(
+    { getOrThrow: (key: string) => (key === 'storage.appDataPath' ? appDataPath : bookDockPath) } as never,
+    downloads as never,
+    requests as never,
+    gateway as never,
+    { useHardlinks: vi.fn().mockResolvedValue(options.useHardlinks ?? true) } as never,
+    pathMappings as never,
+    dockRepo as never,
+    dockIngest as never,
+    { sanitizeFilename: (name: string) => name } as never,
+    fulfillment as never,
+    removal as never,
+    audit as never,
+  );
+  await service.onApplicationBootstrap();
+
+  return {
+    service,
+    dockRepo,
+    downloads,
+    requests,
+    gateway,
+    fulfillment,
+    dockIngest,
+    audit,
+    removal,
+    bookDockPath,
+    appDataPath,
+    downloadsPath,
+    directDownloadsPath,
+  };
+}
+
+/** A store-method zip, built inline so the fixture is bytes rather than a checked-in binary. */
+function zipOf(entries: Array<{ name: string; contents: string | Buffer }>): Buffer {
+  const locals: Buffer[] = [];
+  const centrals: Buffer[] = [];
+  let offset = 0;
+
+  for (const entry of entries) {
+    const name = Buffer.from(entry.name, 'utf8');
+    const data = Buffer.isBuffer(entry.contents) ? entry.contents : Buffer.from(entry.contents, 'utf8');
+
+    const local = Buffer.alloc(30);
+    local.writeUInt32LE(0x04034b50, 0);
+    local.writeUInt16LE(20, 4);
+    local.writeUInt32LE(data.length, 18);
+    local.writeUInt32LE(data.length, 22);
+    local.writeUInt16LE(name.length, 26);
+    locals.push(local, name, data);
+
+    const central = Buffer.alloc(46);
+    central.writeUInt32LE(0x02014b50, 0);
+    central.writeUInt16LE(20, 4);
+    central.writeUInt16LE(20, 6);
+    central.writeUInt32LE(data.length, 20);
+    central.writeUInt32LE(data.length, 24);
+    central.writeUInt16LE(name.length, 28);
+    central.writeUInt32LE(offset, 42);
+    centrals.push(central, name);
+
+    offset += local.length + name.length + data.length;
+  }
+
+  const centralBytes = Buffer.concat(centrals);
+  const end = Buffer.alloc(22);
+  end.writeUInt32LE(0x06054b50, 0);
+  end.writeUInt16LE(entries.length, 8);
+  end.writeUInt16LE(entries.length, 10);
+  end.writeUInt32LE(centralBytes.length, 12);
+  end.writeUInt32LE(offset, 16);
+
+  return Buffer.concat([...locals, centralBytes, end]);
+}
+
+async function makeFile(dir: string, name: string, contents = 'book'): Promise<string> {
+  await mkdir(dir, { recursive: true });
+  const path = join(dir, name);
+  await writeFile(path, contents);
+  return path;
+}
+
+describe('RequestImportService.importDownload', () => {
+  it('creates the dock row before linking, carrying the request destination and uploader', async () => {
+    const harness = await makeHarness();
+    const source = await makeFile(join(harness.bookDockPath, '..', 'downloads'), 'dune.epub');
+
+    await expect(harness.service.importDownload(download(source))).resolves.toBe(true);
+
+    expect(harness.dockRepo.createUnit).toHaveBeenCalledWith(
+      expect.objectContaining({
+        targetLibraryId: 2,
+        targetFolderId: 5,
+        uploadedBy: 3,
+        status: 'pending',
+        format: 'epub',
+        // Generic auto-finalize must skip this row: the request module verifies before filing.
+        autoFinalizeSuppressed: true,
+        // A lone book file is still the loose single file the dock has always handled.
+        unitDirectory: null,
+      }),
+      [],
+    );
+    expect(harness.fulfillment.failDownload).not.toHaveBeenCalled();
+  });
+
+  it('hardlinks rather than copying, so the torrent keeps seeding from the same bytes', async () => {
+    const harness = await makeHarness();
+    const source = await makeFile(join(harness.bookDockPath, '..', 'downloads'), 'dune.epub');
+
+    await harness.service.importDownload(download(source));
+
+    const dest = join(harness.bookDockPath, 'request-7-dune.epub');
+    const [sourceStat, destStat] = await Promise.all([stat(source), stat(dest)]);
+    expect(destStat.ino).toBe(sourceStat.ino);
+    expect(destStat.nlink).toBe(2);
+  });
+
+  it('copies instead when the client has hardlinks turned off', async () => {
+    const harness = await makeHarness({ useHardlinks: false });
+    const source = await makeFile(join(harness.bookDockPath, '..', 'downloads'), 'dune.epub');
+
+    await harness.service.importDownload(download(source));
+
+    const dest = join(harness.bookDockPath, 'request-7-dune.epub');
+    const [sourceStat, destStat] = await Promise.all([stat(source), stat(dest)]);
+    expect(destStat.ino).not.toBe(sourceStat.ino);
+    expect(await readFile(dest, 'utf8')).toBe('book');
+  });
+
+  it('cleans direct-download staging after the Book Dock copy is safely in place', async () => {
+    const harness = await makeHarness();
+    const source = await makeFile(join(harness.directDownloadsPath, 'abc123'), 'dune.epub');
+    const direct = download(source, { source: 'direct_url' });
+
+    await harness.service.importDownload(direct);
+
+    expect(harness.removal.cleanupStagedDirectDownload).toHaveBeenCalledWith(direct);
+    expect(await readFile(join(harness.bookDockPath, 'request-7-dune.epub'), 'utf8')).toBe('book');
+  });
+
+  /**
+   * The claim has to be written before the file is placed. It is what stops the monitor's resume
+   * sweep linking the same download a second time, and it has to survive a crash mid-link.
+   */
+  it('claims the dock row on the download before placing the file', async () => {
+    const harness = await makeHarness();
+    const source = await makeFile(join(harness.bookDockPath, '..', 'downloads'), 'dune.epub');
+    const order: string[] = [];
+    harness.downloads.update.mockImplementation(() => {
+      order.push('claim');
+      return Promise.resolve(undefined);
+    });
+    harness.dockRepo.createUnit.mockImplementation((data: Record<string, unknown>) => {
+      order.push('dock-row');
+      return Promise.resolve({ id: 100, ...data });
+    });
+
+    await harness.service.importDownload(download(source));
+
+    expect(order).toEqual(['dock-row', 'claim']);
+    expect(harness.downloads.update).toHaveBeenCalledWith(11, expect.objectContaining({ status: 'importing', bookDockFileId: 100 }));
+  });
+
+  /**
+   * Downloading and extracting a release takes minutes, and a cancellation or a manual fulfilment
+   * landing inside them is a decision a person made. The import is what would silently undo it,
+   * by filing a book against a request nobody wants and handing the dock a row with no owner.
+   */
+  describe('a request settled while the download was finishing', () => {
+    async function settledHarness() {
+      const harness = await makeHarness();
+      const source = await makeFile(join(harness.bookDockPath, '..', 'downloads'), 'dune.epub');
+      harness.requests.updateIf.mockResolvedValue(undefined);
+      return { harness, source };
+    }
+
+    it('leaves no dock row behind and places no file', async () => {
+      const { harness, source } = await settledHarness();
+
+      await harness.service.importDownload(download(source));
+
+      expect(harness.dockRepo.deleteById).toHaveBeenCalledWith(100);
+      expect(harness.dockIngest.ingestFromWatchedFolder).not.toHaveBeenCalled();
+      await expect(readFile(join(harness.bookDockPath, 'request-7-dune.epub'), 'utf8')).rejects.toThrow();
+    });
+
+    /** Otherwise the resume sweep picks the same download up again every fifteen seconds. */
+    it('settles the attempt so nothing resumes it', async () => {
+      const { harness, source } = await settledHarness();
+
+      await harness.service.importDownload(download(source));
+
+      expect(harness.downloads.updateIf).toHaveBeenCalledWith(11, expect.anything(), expect.objectContaining({ status: 'failed' }));
+      expect(harness.downloads.update).not.toHaveBeenCalledWith(11, expect.objectContaining({ status: 'importing' }));
+    });
+
+    /** Nothing went wrong with the download, so nobody is told one did. */
+    it('does not report it as a download failure', async () => {
+      const { harness, source } = await settledHarness();
+
+      await expect(harness.service.importDownload(download(source))).resolves.toBe(true);
+      expect(harness.fulfillment.failDownload).not.toHaveBeenCalled();
+    });
+  });
+
+  it('announces the importing transition after both persisted rows have moved', async () => {
+    const harness = await makeHarness();
+    const source = await makeFile(join(harness.bookDockPath, '..', 'downloads'), 'dune.epub');
+    const attempt = download(source, { progressPercent: 100, downloadedBytes: 4, totalBytes: 4 });
+    const order: string[] = [];
+    harness.downloads.update.mockImplementation(() => {
+      order.push('download');
+      return Promise.resolve(undefined);
+    });
+    harness.requests.updateIf.mockImplementation((id: number, _expected: unknown, patch: Record<string, unknown>) => {
+      order.push('request');
+      return Promise.resolve({ id, ...patch });
+    });
+    harness.gateway.emitProgress.mockImplementation(() => {
+      order.push('progress');
+    });
+    harness.gateway.emitChanged.mockImplementation(() => {
+      order.push('changed');
+    });
+
+    await harness.service.importDownload(attempt);
+
+    expect(harness.gateway.emitProgress).toHaveBeenCalledWith(
+      {
+        requestId: 7,
+        downloadId: 11,
+        status: 'importing',
+        progressPercent: 100,
+        downloadedBytes: 4,
+        totalBytes: 4,
+      },
+      [3],
+    );
+    expect(order.slice(0, 4)).toEqual(['request', 'download', 'progress', 'changed']);
+  });
+
+  /** Nobody clicked anything, so the actor is the instance rather than the requester. */
+  it('records the import in the audit trail as a system action', async () => {
+    const harness = await makeHarness();
+    const source = await makeFile(join(harness.bookDockPath, '..', 'downloads'), 'dune.epub');
+
+    await harness.service.importDownload(download(source));
+
+    expect(harness.audit.record).toHaveBeenCalledWith(
+      expect.objectContaining({ userId: null, actorUsername: 'system', resourceId: 7, action: 'book_request.import' }),
+    );
+  });
+
+  /** A book that landed has landed whether or not the audit write went through. */
+  it('does not fail the import when the audit write does', async () => {
+    const harness = await makeHarness();
+    harness.audit.record.mockRejectedValue(new Error('audit down'));
+    const source = await makeFile(join(harness.bookDockPath, '..', 'downloads'), 'dune.epub');
+
+    await expect(harness.service.importDownload(download(source))).resolves.toBe(true);
+  });
+
+  /** The artwork and the sidecar travel with the book now instead of being left behind. */
+  it('keeps a release folder together as one unit, anchored on its book file', async () => {
+    const harness = await makeHarness();
+    const folder = join(harness.bookDockPath, '..', 'downloads', 'Dune-release');
+    await makeFile(folder, 'dune.epub');
+    await makeFile(folder, 'cover.jpg');
+    await makeFile(folder, 'release.nfo');
+
+    await expect(harness.service.importDownload(download(folder))).resolves.toBe(true);
+
+    const unitDirectory = join(harness.bookDockPath, 'request-7-Dune-release');
+    expect(harness.dockRepo.createUnit).toHaveBeenCalledWith(
+      expect.objectContaining({ fileName: 'dune.epub', absolutePath: join(unitDirectory, 'dune.epub'), unitDirectory }),
+      expect.arrayContaining([
+        expect.objectContaining({ fileName: 'dune.epub', role: 'content', sortOrder: 0 }),
+        expect.objectContaining({ fileName: 'cover.jpg', role: 'cover', sortOrder: null }),
+        expect.objectContaining({ fileName: 'release.nfo', role: 'metadata', sortOrder: null }),
+      ]),
+    );
+    expect((await readdir(unitDirectory)).sort()).toEqual(['cover.jpg', 'dune.epub', 'release.nfo']);
+  });
+
+  it('imports a multipart audiobook as one ordered unit', async () => {
+    const harness = await makeHarness();
+    const folder = join(harness.bookDockPath, '..', 'downloads', 'audiobook');
+    await makeFile(folder, 'track-01.mp3');
+    await makeFile(folder, 'track-02.mp3');
+
+    await expect(harness.service.importDownload(download(folder))).resolves.toBe(true);
+
+    const unitDirectory = join(harness.bookDockPath, 'request-7-audiobook');
+    // The anchor row describes the primary file, so metadata extraction reads one track, not 31.
+    expect(harness.dockRepo.createUnit).toHaveBeenCalledWith(expect.objectContaining({ fileName: 'track-01.mp3', unitDirectory }), [
+      expect.objectContaining({ fileName: 'track-01.mp3', sortOrder: 0 }),
+      expect.objectContaining({ fileName: 'track-02.mp3', sortOrder: 1 }),
+    ]);
+    expect((await readdir(unitDirectory)).sort()).toEqual(['track-01.mp3', 'track-02.mp3']);
+  });
+
+  /**
+   * Every member flattened to its basename, so both discs wanted `track01.mp3` and the dock's
+   * unique `absolute_path` rejected the second before a single file had been placed.
+   */
+  it('imports a two-disc audiobook without collapsing the discs onto each other', async () => {
+    const harness = await makeHarness();
+    const folder = join(harness.bookDockPath, '..', 'downloads', 'Neuromancer');
+    await makeFile(join(folder, 'CD 1'), 'track01.mp3');
+    await makeFile(join(folder, 'CD 1'), 'track02.mp3');
+    await makeFile(join(folder, 'CD 2'), 'track01.mp3');
+    await makeFile(join(folder, 'CD 2'), 'track02.mp3');
+
+    await expect(harness.service.importDownload(download(folder))).resolves.toBe(true);
+
+    const unitDirectory = join(harness.bookDockPath, 'request-7-Neuromancer');
+    const [, children] = harness.dockRepo.createUnit.mock.calls[0] as [unknown, Array<{ absolutePath: string; sortOrder: number | null }>];
+    const paths = children.map((child) => child.absolutePath);
+    expect(new Set(paths).size).toBe(4);
+    expect(children.filter((child) => child.sortOrder !== null).map((child) => child.absolutePath)).toEqual([
+      join(unitDirectory, 'CD 1', 'track01.mp3'),
+      join(unitDirectory, 'CD 1', 'track02.mp3'),
+      join(unitDirectory, 'CD 2', 'track01.mp3'),
+      join(unitDirectory, 'CD 2', 'track02.mp3'),
+    ]);
+    expect((await readdir(join(unitDirectory, 'CD 1'))).sort()).toEqual(['track01.mp3', 'track02.mp3']);
+    expect((await readdir(join(unitDirectory, 'CD 2'))).sort()).toEqual(['track01.mp3', 'track02.mp3']);
+  });
+
+  /** A part-placed unit is worse than no unit: retry only after taking back what this pass linked. */
+  it('retries a part-placed unit without deleting the file that caused the collision', async () => {
+    const harness = await makeHarness();
+    const folder = join(harness.bookDockPath, '..', 'downloads', 'audiobook');
+    await makeFile(folder, 'track-01.mp3');
+    await makeFile(folder, 'track-02.mp3');
+    // The second link fails: the directory exists, and track one is already in it.
+    harness.dockRepo.createUnit.mockImplementationOnce(async (data: Record<string, unknown>) => {
+      await mkdir(join(harness.bookDockPath, 'request-7-audiobook'), { recursive: true });
+      await writeFile(join(harness.bookDockPath, 'request-7-audiobook', 'track-02.mp3'), 'in the way');
+      return { id: 100, ...data };
+    });
+
+    await expect(harness.service.importDownload(download(folder))).resolves.toBe(true);
+    expect(await readdir(join(harness.bookDockPath, 'request-7-audiobook'))).toEqual(['track-02.mp3']);
+    expect(await readFile(join(harness.bookDockPath, 'request-7-audiobook', 'track-02.mp3'), 'utf8')).toBe('in the way');
+    expect((await readdir(join(harness.bookDockPath, 'request-7-audiobook-2'))).sort()).toEqual(['track-01.mp3', 'track-02.mp3']);
+  });
+
+  /**
+   * The download is finished by now, so failing would throw away the bytes over a question. It
+   * waits with the list instead, and nothing is linked until someone answers.
+   */
+  it('holds a release carrying several distinct books for someone to choose between them', async () => {
+    const harness = await makeHarness();
+    const folder = join(harness.bookDockPath, '..', 'downloads', 'series-pack');
+    await makeFile(folder, 'Mort.epub');
+    await makeFile(folder, 'Small Gods.epub');
+
+    await expect(harness.service.importDownload(download(folder))).resolves.toBe(true);
+
+    expect(harness.fulfillment.failDownload).not.toHaveBeenCalled();
+    expect(harness.dockRepo.createUnit).not.toHaveBeenCalled();
+    expect(harness.fulfillment.holdForReview).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({ id: 7 }),
+      'this release contains 2 separate books, so one has to be chosen',
+      { releaseUnits: [expect.objectContaining({ index: 0, title: 'Mort' }), expect.objectContaining({ index: 1, title: 'Small Gods' })] },
+    );
+  });
+
+  /**
+   * The walk gave up silently, so a directory deeper than the ceiling looked exactly like a
+   * complete release with fewer files in it. The request would go available on half a book.
+   */
+  it('holds a release whose directory tree runs past the depth the walk reads', async () => {
+    const harness = await makeHarness();
+    const folder = join(harness.bookDockPath, '..', 'downloads', 'deep');
+    await makeFile(join(folder, 'a', 'b', 'c', 'd', 'e'), 'Dune.epub');
+
+    await expect(harness.service.importDownload(download(folder))).resolves.toBe(true);
+
+    expect(harness.dockRepo.createUnit).not.toHaveBeenCalled();
+    expect(harness.fulfillment.failDownload).not.toHaveBeenCalled();
+    expect(harness.fulfillment.holdForReview).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({ id: 7 }),
+      expect.stringContaining('deeper or larger than BookOrbit reads'),
+    );
+  });
+
+  it('holds a release carrying more entries than the walk reads', async () => {
+    const harness = await makeHarness();
+    const folder = join(harness.bookDockPath, '..', 'downloads', 'wide');
+    await makeFile(folder, 'Dune.epub');
+    await Promise.all(Array.from({ length: 2_001 }, (_, index) => makeFile(folder, `pad-${index}.txt`)));
+
+    await expect(harness.service.importDownload(download(folder))).resolves.toBe(true);
+
+    expect(harness.dockRepo.createUnit).not.toHaveBeenCalled();
+    expect(harness.fulfillment.holdForReview).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({ id: 7 }),
+      expect.stringContaining('deeper or larger than BookOrbit reads'),
+    );
+  });
+
+  /** An ordinary release inside both bounds is untouched by any of that. */
+  it('imports a release that fits inside the walk bounds exactly as before', async () => {
+    const harness = await makeHarness();
+    const folder = join(harness.bookDockPath, '..', 'downloads', 'ordinary');
+    await makeFile(join(folder, 'Book'), 'Dune.epub');
+
+    await expect(harness.service.importDownload(download(folder))).resolves.toBe(true);
+
+    expect(harness.fulfillment.holdForReview).not.toHaveBeenCalled();
+    expect(harness.dockRepo.createUnit).toHaveBeenCalled();
+  });
+
+  /** The request's own media kind answers the question without anyone being asked. */
+  it('picks the unit matching the request media kind without holding for a choice', async () => {
+    const harness = await makeHarness();
+    harness.requests.findById.mockResolvedValue({ request: request({ mediaKind: 'audiobook' }) });
+    const folder = join(harness.bookDockPath, '..', 'downloads', 'mixed');
+    await makeFile(folder, 'Dune.epub');
+    await makeFile(folder, 'Dune.m4b');
+
+    await expect(harness.service.importDownload(download(folder))).resolves.toBe(true);
+
+    expect(harness.fulfillment.holdForReview).not.toHaveBeenCalled();
+    expect(harness.dockRepo.createUnit).toHaveBeenCalledWith(expect.objectContaining({ format: 'm4b' }), []);
+  });
+
+  describe('importChosenUnit', () => {
+    async function heldHarness() {
+      const harness = await makeHarness();
+      const folder = join(harness.bookDockPath, '..', 'downloads', 'series-pack');
+      await makeFile(folder, 'Mort.epub');
+      await makeFile(folder, 'Small Gods.epub');
+      await harness.service.importDownload(download(folder));
+
+      const held = download(folder, {
+        status: 'needs_review',
+        releaseUnits: harness.fulfillment.holdForReview.mock.calls[0][3].releaseUnits,
+      });
+      harness.downloads.findById.mockResolvedValue(held);
+      return { harness, folder, held };
+    }
+
+    it('imports the book that was chosen and leaves the others behind', async () => {
+      const { harness } = await heldHarness();
+
+      await harness.service.importChosenUnit(7, 11, 1);
+
+      expect(harness.dockRepo.createUnit).toHaveBeenCalledWith(expect.objectContaining({ fileName: 'request-7-Small Gods.epub' }), []);
+    });
+
+    it('refuses an index that is not one of the books on offer', async () => {
+      const { harness } = await heldHarness();
+
+      await expect(harness.service.importChosenUnit(7, 11, 9)).rejects.toMatchObject({ status: 400 });
+      expect(harness.dockRepo.createUnit).not.toHaveBeenCalled();
+    });
+
+    it('refuses a download that is not waiting on a choice', async () => {
+      const harness = await makeHarness();
+      harness.downloads.findById.mockResolvedValue(download('/somewhere', { status: 'imported' }));
+
+      await expect(harness.service.importChosenUnit(7, 11, 0)).rejects.toMatchObject({ status: 400 });
+    });
+
+    /**
+     * Two clicks inside the extraction window. The read the guard does cannot separate them - both
+     * see `needs_review` - so the attempt is claimed instead, and the loser places nothing rather
+     * than filing the book a second time under a second dock row.
+     */
+    it('claims the attempt so a second submission cannot import it again', async () => {
+      const { harness, held } = await heldHarness();
+      harness.downloads.updateIf.mockResolvedValueOnce({ ...held, status: 'importing' }).mockResolvedValueOnce(undefined);
+
+      const [first, second] = await Promise.allSettled([harness.service.importChosenUnit(7, 11, 1), harness.service.importChosenUnit(7, 11, 1)]);
+
+      expect(harness.downloads.updateIf).toHaveBeenCalledWith(11, ['needs_review'], { status: 'importing' });
+      expect([first.status, second.status].sort()).toEqual(['fulfilled', 'rejected']);
+      expect(harness.dockRepo.createUnit).toHaveBeenCalledTimes(1);
+    });
+  });
+
+  /**
+   * Naming a free destination is check-then-act against a unique column, so the loser of a race
+   * for one name takes the next rather than failing an import a different file name satisfies.
+   */
+  it('takes the next free name when another import claimed the one it picked', async () => {
+    const harness = await makeHarness();
+    const source = await makeFile(join(harness.bookDockPath, '..', 'downloads'), 'dune.epub');
+    harness.dockRepo.createUnit.mockRejectedValueOnce(
+      new Error('Failed query', { cause: Object.assign(new Error('duplicate key value violates unique constraint'), { code: '23505' }) }),
+    );
+
+    await expect(harness.service.importDownload(download(source))).resolves.toBe(true);
+
+    expect(harness.dockRepo.createUnit).toHaveBeenCalledTimes(2);
+    expect(harness.dockRepo.createUnit).toHaveBeenLastCalledWith(expect.objectContaining({ fileName: 'request-7-dune-2.epub' }), []);
+  });
+
+  it('takes the next free name on EEXIST without deleting the file that won the race', async () => {
+    const harness = await makeHarness();
+    const source = await makeFile(join(harness.bookDockPath, '..', 'downloads'), 'dune.epub');
+    const collided = join(harness.bookDockPath, 'request-7-dune.epub');
+    harness.dockRepo.createUnit.mockImplementationOnce(async (data: Record<string, unknown>) => {
+      await writeFile(collided, 'other import');
+      return { id: 100, ...data };
+    });
+
+    await expect(harness.service.importDownload(download(source))).resolves.toBe(true);
+
+    expect(await readFile(collided, 'utf8')).toBe('other import');
+    expect(await readFile(join(harness.bookDockPath, 'request-7-dune-2.epub'), 'utf8')).toBe('book');
+    expect(harness.dockRepo.createUnit).toHaveBeenCalledTimes(2);
+  });
+
+  it('gives up on a database failure that is not a name collision', async () => {
+    const harness = await makeHarness();
+    const source = await makeFile(join(harness.bookDockPath, '..', 'downloads'), 'dune.epub');
+    harness.dockRepo.createUnit.mockRejectedValue(Object.assign(new Error('connection terminated'), { code: '57P01' }));
+
+    await expect(harness.service.importDownload(download(source))).resolves.toBe(false);
+    expect(harness.dockRepo.createUnit).toHaveBeenCalledTimes(1);
+    expect(harness.fulfillment.failDownload).toHaveBeenCalledWith(expect.anything(), expect.stringContaining('connection terminated'));
+  });
+
+  /** The sample is the whole reason this release was refused before, and it is not a second book. */
+  it('imports a book that travels with a sample directory', async () => {
+    const harness = await makeHarness();
+    const folder = join(harness.bookDockPath, '..', 'downloads', 'with-sample');
+    await makeFile(folder, 'dune.epub');
+    await makeFile(join(folder, 'Sample'), 'preview.pdf');
+
+    await expect(harness.service.importDownload(download(folder))).resolves.toBe(true);
+    expect(harness.dockRepo.createUnit).toHaveBeenCalledWith(expect.objectContaining({ fileName: 'request-7-dune.epub', unitDirectory: null }), []);
+  });
+
+  /** RAR packaging is normal on private trackers, so a broken one must say what is actually wrong. */
+  it('reports why an archive could not be opened rather than claiming it holds no book', async () => {
+    const harness = await makeHarness();
+    const folder = join(harness.bookDockPath, '..', 'downloads', 'packed');
+    await makeFile(folder, 'dune.rar', 'not really a rar');
+
+    await expect(harness.service.importDownload(download(folder))).resolves.toBe(false);
+    expect(harness.fulfillment.failDownload).toHaveBeenCalledWith(expect.anything(), expect.stringContaining('RAR file could not be read'));
+  });
+
+  it('extracts a zipped release and imports the book inside it', async () => {
+    const harness = await makeHarness();
+    const folder = join(harness.bookDockPath, '..', 'downloads', 'packed-zip');
+    await mkdir(folder, { recursive: true });
+    await writeFile(join(folder, 'Dune.zip'), zipOf([{ name: 'Dune.epub', contents: 'book bytes' }]));
+
+    await expect(harness.service.importDownload(download(folder))).resolves.toBe(true);
+
+    expect(harness.dockRepo.createUnit).toHaveBeenCalledWith(expect.objectContaining({ fileName: 'request-7-Dune.epub' }), []);
+    expect(await readFile(join(harness.bookDockPath, 'request-7-Dune.epub'), 'utf8')).toBe('book bytes');
+  });
+
+  /** Extraction is staging-only: writing into the download would corrupt what is still seeding. */
+  it('leaves the downloaded archive untouched and clears its staging afterwards', async () => {
+    const harness = await makeHarness();
+    const folder = join(harness.bookDockPath, '..', 'downloads', 'packed-seeding');
+    await mkdir(folder, { recursive: true });
+    await writeFile(join(folder, 'Dune.zip'), zipOf([{ name: 'Dune.epub', contents: 'book bytes' }]));
+
+    await expect(harness.service.importDownload(download(folder))).resolves.toBe(true);
+
+    expect(await readdir(folder)).toEqual(['Dune.zip']);
+    expect(await readdir(join(harness.appDataPath, 'tmp', 'release-extract'))).toEqual([]);
+  });
+
+  /**
+   * Scene ebook packaging: a zip holding a rar holding the book. One extraction pass stops on the
+   * rar, which used to surface as "contains no supported book file" - a release full of books.
+   */
+  it('unwraps a zip holding an archive to reach the book inside', async () => {
+    const harness = await makeHarness();
+    const folder = join(harness.bookDockPath, '..', 'downloads', 'scene');
+    await mkdir(folder, { recursive: true });
+    // A nested zip stands in for the rar: the nesting is what is under test, not the format.
+    const inner = zipOf([{ name: 'Dune.epub', contents: 'book bytes' }]);
+    await writeFile(join(folder, 'lc000oaa.zip'), zipOf([{ name: 'lc000oal.zip', contents: inner }]));
+    await writeFile(join(folder, 'libricide.nfo'), 'release notes');
+
+    await expect(harness.service.importDownload(download(folder))).resolves.toBe(true);
+
+    expect(harness.dockRepo.createUnit).toHaveBeenCalledWith(expect.objectContaining({ fileName: 'request-7-Dune.epub' }), []);
+    expect(await readFile(join(harness.bookDockPath, 'request-7-Dune.epub'), 'utf8')).toBe('book bytes');
+  });
+
+  /** Two levels is packaging. Deeper is a nested-archive bomb, and it says so. */
+  it('refuses an archive nested deeper than it will unwrap', async () => {
+    const harness = await makeHarness();
+    const folder = join(harness.bookDockPath, '..', 'downloads', 'matryoshka');
+    await mkdir(folder, { recursive: true });
+    const level3 = zipOf([{ name: 'Dune.epub', contents: 'book bytes' }]);
+    const level2 = zipOf([{ name: 'c.zip', contents: level3 }]);
+    await writeFile(join(folder, 'a.zip'), zipOf([{ name: 'b.zip', contents: level2 }]));
+
+    await expect(harness.service.importDownload(download(folder))).resolves.toBe(false);
+    expect(harness.fulfillment.failDownload).toHaveBeenCalledWith(
+      expect.anything(),
+      'The download is an archive nested deeper than BookOrbit will unwrap',
+    );
+  });
+
+  /** A .cbz is a zip, and treating it as packaging would unpack a comic into loose images. */
+  it('imports a comic archive as a book rather than extracting it', async () => {
+    const harness = await makeHarness();
+    const folder = join(harness.bookDockPath, '..', 'downloads', 'comic');
+    await mkdir(folder, { recursive: true });
+    await writeFile(join(folder, 'Saga 001.cbz'), zipOf([{ name: '01.jpg', contents: 'page' }]));
+
+    await expect(harness.service.importDownload(download(folder))).resolves.toBe(true);
+    expect(harness.dockRepo.createUnit).toHaveBeenCalledWith(expect.objectContaining({ fileName: 'request-7-Saga 001.cbz', format: 'cbz' }), []);
+  });
+
+  it('rejects a release with no supported book file', async () => {
+    const harness = await makeHarness();
+    const folder = join(harness.bookDockPath, '..', 'downloads', 'junk');
+    await makeFile(folder, 'readme.txt');
+
+    await expect(harness.service.importDownload(download(folder))).resolves.toBe(false);
+    expect(harness.fulfillment.failDownload).toHaveBeenCalledWith(expect.anything(), expect.stringContaining('no supported book file'));
+  });
+
+  it('gives a retry of the same request a fresh destination rather than colliding', async () => {
+    const harness = await makeHarness();
+    const first = await makeFile(join(harness.downloadsPath, 'first'), 'dune.epub');
+    const second = await makeFile(join(harness.downloadsPath, 'second'), 'dune.epub');
+
+    await harness.service.importDownload(download(first));
+    await harness.service.importDownload(download(second, { id: 12 }));
+
+    const names = (await readdir(harness.bookDockPath)).sort();
+    expect(names).toEqual(['request-7-dune-2.epub', 'request-7-dune.epub']);
+  });
+
+  it('avoids a destination another dock row already claims, even if the file is gone', async () => {
+    const harness = await makeHarness();
+    harness.dockRepo.findByAbsolutePath.mockImplementation((path: string) =>
+      Promise.resolve(basename(path) === 'request-7-dune.epub' ? { id: 1 } : undefined),
+    );
+    const source = await makeFile(join(harness.bookDockPath, '..', 'downloads'), 'dune.epub');
+
+    await harness.service.importDownload(download(source));
+    expect(await readdir(harness.bookDockPath)).toEqual(['request-7-dune-2.epub']);
+  });
+
+  it('removes the reserved dock row when the link fails, leaving no entry pointing at nothing', async () => {
+    const harness = await makeHarness();
+    const source = await makeFile(join(harness.bookDockPath, '..', 'downloads'), 'dune.epub');
+    // Occupy the destination behind the uniqueness check so `link` throws EEXIST.
+    harness.dockRepo.createUnit.mockImplementation(async (data: Record<string, unknown>) => {
+      await link(source, data.absolutePath as string);
+      return { id: 100, ...data };
+    });
+
+    await expect(harness.service.importDownload(download(source))).resolves.toBe(false);
+    expect(harness.dockRepo.deleteById).toHaveBeenCalledWith(100);
+    expect(harness.fulfillment.failDownload).toHaveBeenCalled();
+  });
+
+  it('queues the dock row itself, so a watcher that failed to start does not strand the import', async () => {
+    const harness = await makeHarness();
+    const source = await makeFile(join(harness.bookDockPath, '..', 'downloads'), 'dune.epub');
+
+    await harness.service.importDownload(download(source));
+
+    expect(harness.dockIngest.ingestFromWatchedFolder).toHaveBeenCalledWith(join(harness.bookDockPath, 'request-7-dune.epub'));
+    expect(harness.downloads.update).toHaveBeenCalledWith(11, expect.objectContaining({ status: 'importing', bookDockFileId: 100 }));
+    expect(harness.requests.updateIf).toHaveBeenCalledWith(
+      7,
+      expect.anything(),
+      expect.objectContaining({ status: 'importing', bookDockFileId: 100 }),
+    );
+  });
+
+  it('fails the attempt when the client reported no content path', async () => {
+    const harness = await makeHarness();
+    await expect(harness.service.importDownload(download('', { contentPath: null }))).resolves.toBe(false);
+    expect(harness.fulfillment.failDownload).toHaveBeenCalledWith(expect.anything(), expect.stringContaining('did not report'));
+  });
+});
+
+/**
+ * A download client is a network peer that reports a string. Nothing above this point re-reads
+ * that string against the directory the operator declared, so this is where the boundary is.
+ */
+describe('RequestImportService containment', () => {
+  it('refuses a path the client reported outside its declared root, before any file is read', async () => {
+    const harness = await makeHarness();
+    const outside = await makeFile(join(harness.appDataPath, '..', 'elsewhere'), 'secret.epub');
+
+    await expect(harness.service.importDownload(download(outside))).resolves.toBe(false);
+
+    expect(harness.dockRepo.createUnit).not.toHaveBeenCalled();
+    expect(await readdir(harness.bookDockPath)).toEqual([]);
+    expect(harness.fulfillment.failDownload).toHaveBeenCalledWith(expect.anything(), expect.stringContaining('No path mapping covers'));
+  });
+
+  /** The walk skips symlinks, so this is the one the client itself points the import at. */
+  it('refuses a symlink planted inside the download directory that points out of it', async () => {
+    const harness = await makeHarness();
+    const outside = await makeFile(join(harness.appDataPath, '..', 'elsewhere'), 'secret.epub');
+    const planted = join(harness.downloadsPath, 'dune.epub');
+    await symlink(outside, planted);
+
+    await expect(harness.service.importDownload(download(planted))).resolves.toBe(false);
+
+    expect(await readdir(harness.bookDockPath)).toEqual([]);
+    expect(harness.fulfillment.failDownload).toHaveBeenCalledWith(expect.anything(), expect.stringContaining('resolves outside'));
+  });
+
+  /**
+   * The torrent client is still writing into that directory while the plan is being built, so the
+   * check that matters is the one immediately before the link, not the one when the walk ran.
+   */
+  it('refuses a file swapped for a symlink between planning the placement and linking it', async () => {
+    const harness = await makeHarness();
+    const source = await makeFile(harness.downloadsPath, 'dune.epub');
+    const outside = await makeFile(join(harness.appDataPath, '..', 'elsewhere'), 'secret.epub');
+    // `createUnit` runs after the placement is planned and before any file is placed.
+    harness.dockRepo.createUnit.mockImplementation(async (data: Record<string, unknown>) => {
+      await unlink(source);
+      await symlink(outside, source);
+      return { id: 100, ...data };
+    });
+
+    await expect(harness.service.importDownload(download(source))).resolves.toBe(false);
+
+    expect(harness.dockRepo.deleteById).toHaveBeenCalledWith(100);
+    expect(await readdir(harness.bookDockPath)).toEqual([]);
+    expect(harness.fulfillment.failDownload).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.stringContaining('outside the directory it was downloaded into'),
+    );
+  });
+
+  /** A direct fetch has no client and no mapping, so its staging directory is its own root. */
+  it('refuses a direct download that reports a path outside the staging root', async () => {
+    const harness = await makeHarness();
+    const outside = await makeFile(join(harness.appDataPath, '..', 'elsewhere'), 'secret.epub');
+
+    await expect(harness.service.importDownload(download(outside, { source: 'direct_url' }))).resolves.toBe(false);
+
+    expect(await readdir(harness.bookDockPath)).toEqual([]);
+    expect(harness.fulfillment.failDownload).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.stringContaining('outside the directory it was downloaded into'),
+    );
+  });
+
+  /** The single-host install, where the mapping is an identity, still imports exactly as before. */
+  it('imports normally through an identity mapping', async () => {
+    const harness = await makeHarness();
+    const source = await makeFile(harness.downloadsPath, 'dune.epub');
+
+    await expect(harness.service.importDownload(download(source))).resolves.toBe(true);
+    expect(await readFile(join(harness.bookDockPath, 'request-7-dune.epub'), 'utf8')).toBe('book');
+  });
+});
diff --git a/server/src/modules/book-request/fulfillment/request-import.service.ts b/server/src/modules/book-request/fulfillment/request-import.service.ts
new file mode 100644
index 000000000..6e6eaf35f
--- /dev/null
+++ b/server/src/modules/book-request/fulfillment/request-import.service.ts
@@ -0,0 +1,721 @@
+import { BadRequestException, Injectable, Logger, NotFoundException, OnApplicationBootstrap } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { AuditAction, AuditResource, UNSETTLED_BOOK_REQUEST_DOWNLOAD_STATUSES, WORKER_WRITABLE_BOOK_REQUEST_STATUSES } from '@bookorbit/types';
+import type { ReleaseUnitChoice } from '@bookorbit/types';
+import { randomUUID } from 'crypto';
+import { constants } from 'fs';
+import { copyFile, link, mkdir, readdir, realpath, rmdir, stat, unlink } from 'fs/promises';
+import { basename, dirname, extname, join, relative, sep } from 'path';
+
+import { isUniqueViolation } from '../../../common/utils/db-error.utils';
+import { sanitizeLogValue } from '../../../common/utils/log-sanitize.utils';
+import type { BookRequestDownloadRow, BookRequestRow } from '../../../db/schema';
+import type { FileRole } from '../../scanner/lib/classify';
+import { AuditService } from '../../audit/audit.service';
+import { BookDockRepository } from '../../book-dock/book-dock.repository';
+import { BookDockIngestService } from '../../book-dock/book-dock-ingest.service';
+import {
+  createArchiveBudget,
+  extractReleaseArchive,
+  extractionDirectoryFor,
+  ReleaseArchiveError,
+  removeExtractionDirectory,
+  type ArchiveBudget,
+} from '../../../common/archive/release-archive';
+import {
+  interpretRelease,
+  selectReleaseUnit,
+  unitRelativePath,
+  type ReleaseFileInput,
+  type ReleasePlan,
+  type ReleaseUnit,
+} from '../../scanner/lib/release-plan';
+import { UploadValidatorService } from '../../upload/upload-validator.service';
+import { BookRequestRepository } from '../book-request.repository';
+import { BookRequestGateway } from '../book-request.gateway';
+import { DownloadClientConfigService } from '../download-clients/download-client-config.service';
+import { PathMappingService, type ResolvedDownloadPath } from '../download-clients/path-mapping.service';
+import { directDownloadRoot } from './direct-download.service';
+import { BookRequestDownloadRepository } from './book-request-download.repository';
+import { DownloadRemovalService } from './download-removal.service';
+import { RequestFulfillmentService } from './request-fulfillment.service';
+
+/** A release folder is books plus artwork, not a filesystem. Depth and count stay bounded. */
+const MAX_SCAN_DEPTH = 4;
+const MAX_SCAN_ENTRIES = 2_000;
+/** Enough attempts to get past a same-named retry without turning a collision into a loop. */
+const MAX_UNIQUE_SUFFIX_ATTEMPTS = 100;
+/**
+ * Scene ebook packaging is a zip holding a rar holding the book, so one pass never reaches it.
+ * Two does. Anything deeper is not packaging, it is a nested-archive bomb.
+ */
+const MAX_ARCHIVE_NESTING = 2;
+
+/** What a bounded walk found, and whether the bounds stopped it before it was done. */
+interface ReleaseWalk {
+  files: ReleaseFileInput[];
+  truncated: boolean;
+}
+
+interface PlacedFile {
+  sourcePath: string;
+  destPath: string;
+  sizeBytes: number;
+  format: string | null;
+  role: FileRole;
+  sortOrder: number | null;
+}
+
+/** Null `unitDirectory` is the loose single file the dock has always handled. */
+interface UnitPlacement {
+  unitDirectory: string | null;
+  primaryDestPath: string;
+  files: PlacedFile[];
+}
+
+@Injectable()
+export class RequestImportService implements OnApplicationBootstrap {
+  private readonly logger = new Logger(RequestImportService.name);
+  private bookDockPath: string;
+  /** Beside the dock rather than under it, so an extraction in flight is never a dock entry. */
+  private readonly stagingPath: string;
+
+  constructor(
+    private readonly config: ConfigService,
+    private readonly downloads: BookRequestDownloadRepository,
+    private readonly requests: BookRequestRepository,
+    private readonly gateway: BookRequestGateway,
+    private readonly clients: DownloadClientConfigService,
+    private readonly pathMappings: PathMappingService,
+    private readonly dockRepo: BookDockRepository,
+    private readonly dockIngest: BookDockIngestService,
+    private readonly validator: UploadValidatorService,
+    private readonly fulfillment: RequestFulfillmentService,
+    private readonly removal: DownloadRemovalService,
+    private readonly audit: AuditService,
+  ) {
+    this.bookDockPath = this.config.getOrThrow<string>('storage.bookDockPath');
+    this.stagingPath = join(this.config.getOrThrow<string>('storage.appDataPath'), 'tmp', 'release-extract');
+  }
+
+  async onApplicationBootstrap(): Promise<void> {
+    await mkdir(this.bookDockPath, { recursive: true });
+    await mkdir(this.stagingPath, { recursive: true });
+    // The watcher compares events against the realpath of the dock, so the destination has to be
+    // resolved the same way or a symlinked dock would produce two different spellings of one file.
+    this.bookDockPath = await realpath(this.bookDockPath);
+  }
+
+  /**
+   * Links a finished download into the Book Dock and hands the rest to the existing dock
+   * pipeline. Returns false when the attempt was failed; the caller does not need to do anything
+   * further, because `failDownload` has already recorded and announced it.
+   */
+  async importDownload(download: BookRequestDownloadRow): Promise<boolean> {
+    const joined = await this.requests.findById(download.requestId);
+    if (!joined) {
+      await this.fulfillment.failDownload(download, 'The request this download belongs to no longer exists');
+      return false;
+    }
+
+    try {
+      await this.runImport(download, joined.request);
+      return true;
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      await this.fulfillment.failDownload(download, message);
+      return false;
+    }
+  }
+
+  /**
+   * Imports the book an approver picked out of a release that held several. The download is still
+   * on disk and still where it was, so this is the same import as before with the ambiguity
+   * resolved rather than a fresh attempt.
+   */
+  async importChosenUnit(requestId: number, downloadId: number, unitIndex: number): Promise<void> {
+    const joined = await this.requests.findById(requestId);
+    if (!joined) throw new NotFoundException('Book request not found');
+
+    const found = await this.downloads.findById(downloadId);
+    if (!found || found.requestId !== requestId) throw new NotFoundException('That download attempt does not belong to this request');
+    if (found.status !== 'needs_review' || !found.releaseUnits?.length) {
+      throw new BadRequestException('This download is not waiting for a book to be chosen');
+    }
+
+    const choice = found.releaseUnits[unitIndex];
+    if (!choice) throw new BadRequestException('That is not one of the books this release contains');
+
+    // Claimed rather than merely checked. Extracting a release takes long enough for a second
+    // click to arrive inside it, and two passes over one attempt place the book twice under two
+    // dock rows - or the faster one's cleanup takes the staging the slower one is still reading.
+    const download = await this.downloads.updateIf(downloadId, ['needs_review'], { status: 'importing' });
+    if (!download) throw new BadRequestException('This download is not waiting for a book to be chosen');
+
+    try {
+      await this.runImport(download, joined.request, choice.primaryPath);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      await this.fulfillment.failDownload(download, message);
+      throw new BadRequestException(message);
+    }
+  }
+
+  private async runImport(download: BookRequestDownloadRow, request: BookRequestRow, chosenPrimaryPath?: string): Promise<void> {
+    const extractionDirectory = extractionDirectoryFor(this.stagingPath, download.id, randomUUID().slice(0, 8));
+    try {
+      await this.runImportFromDisk(download, request, extractionDirectory, chosenPrimaryPath);
+    } finally {
+      // The files are hardlinked into the dock by now, so dropping the staging copy costs nothing
+      // and leaves the dock's inodes alone. On failure it drops a half-extracted tree instead.
+      await removeExtractionDirectory(extractionDirectory);
+    }
+  }
+
+  /**
+   * A direct file was staged by BookOrbit itself, so what it reported is already a path we can
+   * open, bounded by the staging root it was written into. Anything a download client reported is
+   * in that client's own filesystem namespace and has to be translated through the mappings
+   * configured for it, which is also what declares the directory the import may read out of.
+   */
+  private async resolveLocalPath(download: BookRequestDownloadRow, contentPath: string): Promise<ResolvedDownloadPath> {
+    if (download.source === 'direct_url') {
+      const containmentRoot = directDownloadRoot(this.config.getOrThrow<string>('storage.appDataPath'));
+      await this.pathMappings.assertWithinRoot(containmentRoot, contentPath);
+      return { localPath: contentPath, containmentRoot };
+    }
+    if (download.downloadClientId === null) throw new Error('The download client for this attempt has been removed');
+
+    return this.pathMappings.toLocalPath(download.downloadClientId, contentPath);
+  }
+
+  private async runImportFromDisk(
+    download: BookRequestDownloadRow,
+    request: BookRequestRow,
+    extractionDirectory: string,
+    chosenPrimaryPath?: string,
+  ): Promise<void> {
+    const started = Date.now();
+    if (!download.contentPath) throw new Error('The download did not report where the finished files are');
+
+    const { localPath, containmentRoot } = await this.resolveLocalPath(download, download.contentPath);
+    const { root, plan, containmentRoot: contentContainmentRoot } = await this.resolveReleasePlan(localPath, containmentRoot, extractionDirectory);
+
+    // Part of the release was never read, so what looks like a whole book may be the half of one
+    // that fitted inside the bounds. Importing it would mark the request available on a book with
+    // tracks missing, which is worse than asking a human to look.
+    if (plan.truncated) {
+      await this.holdForTruncatedRelease(download, request);
+      return;
+    }
+
+    const selection = selectReleaseUnit(plan, { mediaKind: request.mediaKind, primaryPath: chosenPrimaryPath ?? null });
+
+    if (selection.kind === 'none') {
+      throw new Error(chosenPrimaryPath ? 'The chosen book is no longer in this download' : 'The download contains no supported book file');
+    }
+    if (selection.kind === 'ambiguous') {
+      await this.holdForChoice(download, request, selection.units);
+      return;
+    }
+
+    const unit = selection.unit;
+    if (selection.ignored.length > 0) {
+      this.logger.log(
+        `[book_request.select_unit] [end] requestId=${request.id} downloadId=${download.id} ignoredUnits=${selection.ignored.length} - the release held other books that did not match the request`,
+      );
+    }
+
+    const sourceFile = join(root, unit.primaryPath);
+    let { placement, dockRow, format, size, suffix } = await this.claimDestination(request, root, unit);
+
+    // Claimed before the file is placed, not after: the claim is what stops a later resume sweep
+    // from linking the same download a second time, and it has to outlive a crash mid-link.
+    //
+    // Conditional, and this is the last moment it can be. Downloading and extracting a release
+    // takes minutes, and a cancellation or a manual fulfilment landing inside them is a decision a
+    // person made; importing anyway would file a book against a request nobody wants and hand the
+    // dock a row with no owner. The dock row goes back with it, so nothing is left pointing at a
+    // file that was never placed, and the attempt is settled too - otherwise the resume sweep
+    // would pick this same download up again every fifteen seconds.
+    const claimed = await this.requests.updateIf(request.id, WORKER_WRITABLE_BOOK_REQUEST_STATUSES, {
+      status: 'importing',
+      bookDockFileId: dockRow.id,
+    });
+    if (!claimed) {
+      await this.dockRepo.deleteById(dockRow.id).catch(() => {});
+      await this.downloads.updateIf(download.id, UNSETTLED_BOOK_REQUEST_DOWNLOAD_STATUSES, {
+        status: 'failed',
+        errorMessage: 'The request was settled while this download was finishing, so nothing was imported',
+      });
+      this.logger.log(
+        `[book_request.import] [end] requestId=${request.id} downloadId=${download.id} durationMs=${Date.now() - started} - the request was settled while the download finished, so nothing was imported`,
+      );
+      this.gateway.emitChanged();
+      return;
+    }
+
+    await this.downloads.update(download.id, { status: 'importing', localPath: sourceFile, bookDockFileId: dockRow.id });
+    this.gateway.emitProgress(
+      {
+        requestId: request.id,
+        downloadId: download.id,
+        status: 'importing',
+        progressPercent: download.progressPercent,
+        downloadedBytes: download.downloadedBytes,
+        totalBytes: download.totalBytes,
+      },
+      (await this.requests.findRequestViewerIds([request.id])).get(request.id) ?? [],
+    );
+    this.gateway.emitChanged();
+
+    for (;;) {
+      try {
+        await this.placeUnit(placement, contentContainmentRoot, download);
+        break;
+      } catch (error) {
+        // The row only exists to reserve the destination; links that never happened must not leave
+        // a dock entry pointing at nothing. `placeUnit` already removed only the paths it created.
+        await this.dockRepo.deleteById(dockRow.id).catch(() => {});
+        if ((error as NodeJS.ErrnoException).code !== 'EEXIST' || suffix >= MAX_UNIQUE_SUFFIX_ATTEMPTS - 1) throw error;
+
+        ({ placement, dockRow, format, size, suffix } = await this.claimDestination(request, root, unit, suffix + 1));
+        // The request can be cancelled while a colliding name is being retried. The new dock row is
+        // not entitled to replace that decision merely because the first one held the claim.
+        if (!(await this.requests.updateIf(request.id, ['importing'], { bookDockFileId: dockRow.id }))) {
+          await this.dockRepo.deleteById(dockRow.id).catch(() => {});
+          await this.downloads.updateIf(download.id, UNSETTLED_BOOK_REQUEST_DOWNLOAD_STATUSES, {
+            status: 'failed',
+            errorMessage: 'The request was settled while this download was finishing, so nothing was imported',
+          });
+          this.gateway.emitChanged();
+          return;
+        }
+        await this.downloads.update(download.id, { bookDockFileId: dockRow.id });
+      }
+    }
+
+    // The watcher will also see the new file. `ingestFromWatchedFolder` short-circuits on the row
+    // we just created and simply requeues it, so calling both is idempotent - and it means a
+    // failed watcher startup does not silently strand every import at "importing".
+    await this.dockIngest.ingestFromWatchedFolder(placement.primaryDestPath).catch((err: unknown) => {
+      this.logger.warn(
+        `[book_request.import] [fail] requestId=${request.id} dockFileId=${dockRow.id} error="${sanitizeLogValue(err instanceof Error ? err.message : String(err))}" - could not queue the dock row, leaving it to the watcher`,
+      );
+    });
+
+    this.logger.log(
+      `[book_request.import] [end] requestId=${request.id} downloadId=${download.id} dockFileId=${dockRow.id} format=${format} fileCount=${placement.files.length} sizeBytes=${size} durationMs=${Date.now() - started} - linked into the Book Dock`,
+    );
+
+    // Nobody clicked anything here, so the actor is the instance. A file arriving from a torrent
+    // and being placed where the library can see it is worth a trail even though it is automatic.
+    await this.audit
+      .record({
+        userId: null,
+        actorUsername: 'system',
+        action: AuditAction.BookRequestImport,
+        resource: AuditResource.BookRequest,
+        resourceId: request.id,
+        description: `Imported a download for book request #${request.id}`,
+        meta: { downloadId: download.id, bookDockFileId: dockRow.id, format, sizeBytes: size },
+      })
+      .catch((err: unknown) => {
+        this.logger.warn(
+          `[book_request.import] [fail] requestId=${request.id} error="${sanitizeLogValue(err instanceof Error ? err.message : String(err))}" - audit write failed`,
+        );
+      });
+
+    await this.removal.cleanupStagedDirectDownload(download);
+  }
+
+  /**
+   * What the finished download actually is, read by the same interpreter that ran on the
+   * `.torrent` manifest before the grab, so a release accepted at grab time cannot be refused here
+   * for a different reason. A magnet reaches this point never having been inspected at all, and an
+   * archive's contents are unknowable until it is open, so this is where both are judged.
+   */
+  private async resolveReleasePlan(
+    localPath: string,
+    containmentRoot: string,
+    extractionDirectory: string,
+  ): Promise<{ root: string; plan: ReleasePlan; containmentRoot: string }> {
+    const info = await stat(localPath).catch(() => null);
+    if (!info) throw new Error(`The downloaded content is not readable at ${localPath}`);
+
+    const root = info.isDirectory() ? localPath : dirname(localPath);
+    const rootName = info.isDirectory() ? basename(localPath) : null;
+    // Shared across every extraction pass, so unwrapping twice cannot cost twice the ceiling.
+    const budget = createArchiveBudget();
+    const walked: ReleaseWalk = info.isDirectory()
+      ? await collectReleaseFiles(localPath)
+      : { files: [{ path: basename(localPath), sizeBytes: info.size }], truncated: false };
+    let plan = interpretRelease(walked.files, { rootName, truncated: walked.truncated });
+    let contentRoot = root;
+    // What every file the plan names must stay inside. Once a release has been unwrapped that is
+    // staging, which BookOrbit wrote itself, rather than the directory the client reported.
+    let contentContainmentRoot = containmentRoot;
+
+    /**
+     * A packaged release only becomes interpretable once it is open, so the archive is expanded
+     * into staging and read again. Never into the download's own directory: writing there would
+     * corrupt exactly the bytes the torrent is still seeding.
+     *
+     * Twice, because scene ebook packaging is a zip holding a rar holding the book, and one pass
+     * stops on the rar. Every bound is re-applied on each pass and the byte budget is shared
+     * across them, so the depth ceiling is the only thing that moves.
+     */
+    for (let pass = 0; plan.units.length === 0 && plan.containers.length > 0; pass++) {
+      if (pass >= MAX_ARCHIVE_NESTING) {
+        throw new Error('The download is an archive nested deeper than BookOrbit will unwrap');
+      }
+      const target = pass === 0 ? extractionDirectory : join(extractionDirectory, `pass-${pass + 1}`);
+      await this.extractContainers(contentRoot, contentContainmentRoot, plan.containers, target, budget);
+      contentRoot = target;
+      contentContainmentRoot = extractionDirectory;
+      const extracted = await collectReleaseFiles(target);
+      plan = interpretRelease(extracted.files, { rootName, truncated: extracted.truncated });
+    }
+
+    return { root: contentRoot, plan, containmentRoot: contentContainmentRoot };
+  }
+
+  /**
+   * The release turned out to hold several distinct books and nothing narrows it to one. The bytes
+   * are already downloaded, so failing here would throw away a finished torrent over a question an
+   * approver answers in seconds; the attempt waits in the dock with the list instead.
+   */
+  private async holdForChoice(download: BookRequestDownloadRow, request: BookRequestRow, units: ReleaseUnit[]): Promise<void> {
+    const choices: ReleaseUnitChoice[] = units.map((unit, index) => ({
+      index,
+      mediaKind: unit.mediaKind,
+      title: unit.title,
+      contentFileCount: unit.contentFileCount,
+      totalFileCount: unit.files.length,
+      sizeBytes: unit.sizeBytes,
+      primaryPath: unit.primaryPath,
+    }));
+
+    this.logger.log(
+      `[book_request.import] [end] requestId=${request.id} downloadId=${download.id} units=${choices.length} - the release holds several books, waiting for a choice`,
+    );
+
+    await this.fulfillment.holdForReview(download, request, `this release contains ${choices.length} separate books, so one has to be chosen`, {
+      releaseUnits: choices,
+    });
+  }
+
+  private async holdForTruncatedRelease(download: BookRequestDownloadRow, request: BookRequestRow): Promise<void> {
+    this.logger.warn(
+      `[book_request.import] [end] requestId=${request.id} downloadId=${download.id} maxDepth=${MAX_SCAN_DEPTH} maxEntries=${MAX_SCAN_ENTRIES} - the release is larger than BookOrbit reads, holding rather than importing part of it`,
+    );
+    await this.fulfillment.holdForReview(
+      download,
+      request,
+      `this release is deeper or larger than BookOrbit reads (${MAX_SCAN_DEPTH} levels, ${MAX_SCAN_ENTRIES} entries), so importing it could take only part of the book`,
+    );
+  }
+
+  /**
+   * Expands the release's archives. A multi-volume RAR is one archive with many parts, so only the
+   * first volume of each set is opened; the reader pulls in the rest itself.
+   */
+  private async extractContainers(
+    root: string,
+    containmentRoot: string,
+    containers: ReleasePlan['containers'],
+    extractionDirectory: string,
+    budget: ArchiveBudget,
+  ): Promise<void> {
+    const primary = containers.filter((container) => !isContinuationVolume(container.path));
+    if (primary.length === 0) throw new Error('The download is a split archive with no first volume to open');
+    if (primary.length > 1) {
+      throw new Error(`The download contains ${primary.length} separate archives, which is not supported`);
+    }
+
+    const container = primary[0]!;
+    const started = Date.now();
+    const archivePath = join(root, container.path);
+    await this.pathMappings.assertWithinRoot(containmentRoot, archivePath);
+    try {
+      await extractReleaseArchive(archivePath, container.kind, extractionDirectory, budget);
+    } catch (error) {
+      // Re-thrown as a plain Error because the message is what `failDownload` records and what
+      // the requester eventually reads; the original stays attached for the log.
+      if (error instanceof ReleaseArchiveError) throw new Error(error.message, { cause: error });
+      throw error;
+    }
+
+    this.logger.log(
+      `[book_request.extract] [end] kind=${container.kind} durationMs=${Date.now() - started} path="${sanitizeLogValue(container.path)}" - release archive extracted into staging`,
+    );
+  }
+
+  /**
+   * The destination, claimed rather than merely chosen.
+   *
+   * The dock row comes before the files, deliberately. If the file were linked first the watcher
+   * could win the race and create the row itself with no target library and no uploader, which
+   * lands the book in the default library and broadcasts "auto-finalized" to every user on the
+   * instance. For a unit that also means the directory is claimed before it exists on disk, so the
+   * watcher's claim check can never lose the race to chokidar.
+   *
+   * Naming a free path and then inserting it is check-then-act: two imports finishing together -
+   * an operator's manual import beside the queue's own, or two downloads of the same book - both
+   * read the same name as free and the loser's insert hits the dock's unique `absolute_path`. The
+   * insert is the only atomic claim there is, so a lost race retries from the next suffix instead
+   * of failing an import that a different file name would have satisfied.
+   */
+  private async claimDestination(
+    request: BookRequestRow,
+    root: string,
+    unit: ReleaseUnit,
+    from = 0,
+  ): Promise<{ placement: UnitPlacement; dockRow: { id: number }; format: string; size: number; suffix: number }> {
+    for (let suffix = from; ; suffix++) {
+      const placement = await this.planPlacement(request.id, root, unit, suffix);
+      const format = extname(placement.primaryDestPath).toLowerCase().slice(1);
+      const size = placement.files.find((file) => file.destPath === placement.primaryDestPath)?.sizeBytes ?? 0;
+
+      try {
+        const dockRow = await this.dockRepo.createUnit(
+          {
+            fileName: basename(placement.primaryDestPath),
+            absolutePath: placement.primaryDestPath,
+            fileSize: size,
+            format,
+            unitDirectory: placement.unitDirectory,
+            status: 'pending',
+            targetLibraryId: request.targetLibraryId,
+            targetFolderId: request.targetFolderId,
+            uploadedBy: request.userId,
+            autoFinalizeSuppressed: true,
+          },
+          placement.unitDirectory === null
+            ? []
+            : placement.files.map((file) => ({
+                absolutePath: file.destPath,
+                fileName: basename(file.destPath),
+                fileSize: file.sizeBytes,
+                format: file.format,
+                role: file.role,
+                sortOrder: file.sortOrder,
+              })),
+        );
+        return { placement, dockRow, format, size, suffix };
+      } catch (error: unknown) {
+        if (!isUniqueViolation(error) || suffix >= MAX_UNIQUE_SUFFIX_ATTEMPTS - 1) throw error;
+        this.logger.warn(
+          `[book_request.dock_claim] [fail] requestId=${request.id} attempt=${suffix + 1} path="${sanitizeLogValue(placement.primaryDestPath)}" - the Book Dock destination was claimed by another import, trying the next name`,
+        );
+      }
+    }
+  }
+
+  /**
+   * Where every file of the unit is going. A unit of one file keeps the flat
+   * `request-<id>-<name>.epub` shape it has always had, so nothing about the ordinary single-book
+   * import changes; anything larger gets a directory of its own and keeps the original file names
+   * inside it, because the scanner recovers track order from those names.
+   *
+   * `taken` is how many names the caller has already lost a race for, which is where the search
+   * for a free one resumes.
+   */
+  private async planPlacement(requestId: number, root: string, unit: ReleaseUnit, taken = 0): Promise<UnitPlacement> {
+    if (unit.files.length === 1) {
+      const file = unit.files[0]!;
+      const destPath = await this.resolveFreeName(requestId, basename(file.path), { directory: false }, taken);
+      return {
+        unitDirectory: null,
+        primaryDestPath: destPath,
+        files: [{ sourcePath: join(root, file.path), destPath, sizeBytes: file.sizeBytes ?? 0, format: file.format, role: file.role, sortOrder: 0 }],
+      };
+    }
+
+    const unitDirectory = await this.resolveFreeName(requestId, unit.title ?? basename(unit.primaryPath), { directory: true }, taken);
+    const files = unit.files.map((file) => ({
+      sourcePath: join(root, file.path),
+      destPath: join(unitDirectory, this.unitDestinationName(unit, file.path)),
+      sizeBytes: file.sizeBytes ?? 0,
+      format: file.format,
+      role: file.role,
+      sortOrder: file.sortOrder,
+    }));
+
+    return { unitDirectory, primaryDestPath: join(unitDirectory, this.unitDestinationName(unit, unit.primaryPath)), files };
+  }
+
+  /**
+   * The file's path *within* the unit, each segment sanitized on its own so the disc folder
+   * survives rather than the separator. Flattening to the file name collides the moment a release
+   * folds `CD 1` and `CD 2` into one book: both hold a `track01.mp3`, and the dock's unique
+   * `absolute_path` rejects the second before a single file has been placed.
+   */
+  private unitDestinationName(unit: ReleaseUnit, path: string): string {
+    const segments = unitRelativePath(unit, path)
+      .split('/')
+      .filter((segment) => segment.length > 0 && segment !== '.' && segment !== '..')
+      .map((segment) => this.validator.sanitizeFilename(segment));
+    return segments.length > 0 ? join(...segments) : this.validator.sanitizeFilename(basename(path));
+  }
+
+  /**
+   * Places a claimed unit, rolling back only paths this invocation actually created.
+   *
+   * That distinction matters on EEXIST: the path that caused the failure belongs to the winner of
+   * the race. Unlinking every planned destination during cleanup would delete that winner's file,
+   * turning a harmless name collision into data loss.
+   */
+  private async placeUnit(placement: UnitPlacement, containmentRoot: string, download: BookRequestDownloadRow): Promise<void> {
+    const placed: string[] = [];
+    const createdDirectories: string[] = [];
+
+    try {
+      if (placement.unitDirectory !== null) {
+        await mkdir(placement.unitDirectory);
+        createdDirectories.push(placement.unitDirectory);
+      }
+
+      for (const file of placement.files) {
+        // Checked here rather than when the plan was built: this is the last moment before the
+        // file is opened, so nothing swapped underneath it in between can be linked into the dock.
+        await this.pathMappings.assertWithinRoot(containmentRoot, file.sourcePath);
+        if (placement.unitDirectory !== null) {
+          await this.createDestinationDirectories(placement.unitDirectory, dirname(file.destPath), createdDirectories);
+        }
+        await this.placeFile(file.sourcePath, file.destPath, download);
+        placed.push(file.destPath);
+      }
+    } catch (error) {
+      for (const path of placed.reverse()) await unlink(path).catch(() => {});
+      for (const path of createdDirectories.reverse()) await rmdir(path).catch(() => {});
+      throw error;
+    }
+  }
+
+  /** Creates nested unit directories one at a time so cleanup knows which ones belong to it. */
+  private async createDestinationDirectories(root: string, target: string, created: string[]): Promise<void> {
+    const nested = relative(root, target);
+    if (!nested) return;
+
+    let current = root;
+    for (const segment of nested.split(sep).filter(Boolean)) {
+      current = join(current, segment);
+      try {
+        await mkdir(current);
+        created.push(current);
+      } catch (error) {
+        if ((error as NodeJS.ErrnoException).code !== 'EEXIST') throw error;
+        if (!(await stat(current)).isDirectory()) throw error;
+      }
+    }
+  }
+
+  /**
+   * `book_dock_files.absolutePath` and `unit_directory` are both unique and `fs.link()` throws
+   * EEXIST, so two releases both called `book.epub`, or a second attempt at the same request,
+   * would otherwise collide.
+   *
+   * A free name here is a snapshot, not a reservation: `claimDestination` is what holds one, and
+   * `from` is how it asks for the next candidate after losing a race for this one.
+   */
+  private async resolveFreeName(requestId: number, sourceName: string, options: { directory: boolean }, from = 0): Promise<string> {
+    const safeName = this.validator.sanitizeFilename(sourceName);
+    const ext = options.directory ? '' : extname(safeName);
+    const stem = ext ? safeName.slice(0, -ext.length) : safeName;
+    const base = `request-${requestId}-${stem}`;
+
+    for (let attempt = from; attempt < MAX_UNIQUE_SUFFIX_ATTEMPTS; attempt++) {
+      const candidate = join(this.bookDockPath, attempt === 0 ? `${base}${ext}` : `${base}-${attempt + 1}${ext}`);
+      const [onDisk, claimed] = await Promise.all([
+        exists(candidate),
+        options.directory ? this.dockRepo.findByUnitDirectory(candidate) : this.dockRepo.findByAbsolutePath(candidate),
+      ]);
+      if (!onDisk && !claimed) return candidate;
+    }
+
+    throw new Error('Could not find a free destination filename in the Book Dock');
+  }
+
+  /**
+   * Hardlink first so the torrent keeps seeding from the same bytes and the disk is not doubled.
+   * Radarr and Sonarr fall back to a copy silently; for book-sized files a copy is a perfectly
+   * workable steady state, so this says so rather than raising an alarm.
+   */
+  private async placeFile(sourceFile: string, destPath: string, download: BookRequestDownloadRow): Promise<void> {
+    const wantsHardlink =
+      download.source === 'direct_url' || (download.downloadClientId !== null && (await this.clients.useHardlinks(download.downloadClientId)));
+
+    if (wantsHardlink) {
+      try {
+        await link(sourceFile, destPath);
+        return;
+      } catch (error) {
+        const code = (error as NodeJS.ErrnoException).code;
+        if (code !== 'EXDEV' && code !== 'EPERM' && code !== 'ENOSYS') throw error;
+        this.logger.warn(
+          `[book_request.hardlink] [fail] requestId=${download.requestId} downloadId=${download.id} errorClass=${(error as Error)?.constructor?.name ?? 'Error'} error="${sanitizeLogValue(code ?? '')}" - hardlink unavailable, copying instead; the file now uses disk space twice`,
+        );
+      }
+    }
+
+    // Exclusive, like the hardlink above it: a plain copy overwrites, so a destination that was
+    // free when it was named and taken by the time it is written would be silently clobbered.
+    await copyFile(sourceFile, destPath, constants.COPYFILE_EXCL);
+  }
+}
+
+/**
+ * `.r00`, `.r01` and `.002` are parts of the archive their first volume opens, not archives in
+ * their own right. Feeding them in separately would extract the same release several times over.
+ */
+function isContinuationVolume(path: string): boolean {
+  return /\.(?:r\d{2,3}|\d{3})$/i.test(path) && !/\.(?:rar|7z|zip)$/i.test(path);
+}
+
+/**
+ * Every file, not only the ones with a book extension: the interpreter needs the artwork and the
+ * padding files too, because what a release *is* depends on what is beside the content as much as
+ * on the content itself.
+ */
+async function collectReleaseFiles(root: string): Promise<ReleaseWalk> {
+  const found: ReleaseFileInput[] = [];
+  let visited = 0;
+  let truncated = false;
+
+  const walk = async (dir: string, depth: number): Promise<void> => {
+    if (depth > MAX_SCAN_DEPTH || visited >= MAX_SCAN_ENTRIES) {
+      truncated = true;
+      return;
+    }
+    const entries = await readdir(dir, { withFileTypes: true }).catch(() => []);
+    for (const entry of entries) {
+      if (++visited > MAX_SCAN_ENTRIES) {
+        truncated = true;
+        return;
+      }
+      const full = join(dir, entry.name);
+      if (entry.isDirectory() && !entry.isSymbolicLink()) {
+        await walk(full, depth + 1);
+      } else if (entry.isFile() && !entry.isSymbolicLink()) {
+        const size = await stat(full).then(
+          (info) => info.size,
+          () => null,
+        );
+        found.push({ path: relative(root, full).split(sep).join('/'), sizeBytes: size });
+      }
+    }
+  };
+
+  await walk(root, 0);
+  return { files: found, truncated };
+}
+
+async function exists(path: string): Promise<boolean> {
+  try {
+    await stat(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
diff --git a/server/src/modules/book-request/fulfillment/request-seed.service.test.ts b/server/src/modules/book-request/fulfillment/request-seed.service.test.ts
new file mode 100644
index 000000000..67e8797ee
--- /dev/null
+++ b/server/src/modules/book-request/fulfillment/request-seed.service.test.ts
@@ -0,0 +1,191 @@
+import { BadRequestException, NotFoundException } from '@nestjs/common';
+
+import type { RequestUser } from '../../../common/types/request-user';
+import type { BookRequestDownloadRow } from '../../../db/schema';
+import { DownloadRemovalService } from './download-removal.service';
+import { RequestSeedService } from './request-seed.service';
+
+const INFO_HASH = 'c9e15763f722f23e98a29decdfae341b98d53056';
+
+function user(): RequestUser {
+  return { id: 1, username: 'ann', name: 'Ann', isSuperuser: true, permissions: [] } as unknown as RequestUser;
+}
+
+function download(overrides: Partial<BookRequestDownloadRow> = {}): BookRequestDownloadRow {
+  return {
+    id: 11,
+    requestId: 7,
+    downloadClientId: 4,
+    clientHash: INFO_HASH,
+    source: 'torrent_file',
+    status: 'imported',
+    ...overrides,
+  } as BookRequestDownloadRow;
+}
+
+function makeService(
+  options: {
+    latest?: BookRequestDownloadRow | null;
+    status?: Array<Record<string, unknown>>;
+  } = {},
+) {
+  const row = options.latest === undefined ? download() : options.latest;
+  const downloads = {
+    findLatestForRequests: vi.fn().mockResolvedValue(row ? new Map([[7, { download: row, downloadClientName: 'qbit' }]]) : new Map()),
+    findById: vi.fn().mockResolvedValue(row ?? undefined),
+    update: vi.fn().mockResolvedValue(undefined),
+    updateIf: vi
+      .fn()
+      .mockImplementation((id: number, expected: string[], patch: Record<string, unknown>) =>
+        Promise.resolve(expected.includes(row?.status ?? '') ? { ...row, id, ...patch } : undefined),
+      ),
+  };
+  const requests = {
+    findById: vi.fn().mockResolvedValue({ request: { id: 7 } }),
+    update: vi.fn().mockResolvedValue(undefined),
+    updateIf: vi.fn().mockResolvedValue({ id: 7 }),
+  };
+  const clients = { resolveConfig: vi.fn().mockResolvedValue({ id: 4, adapterType: 'qbittorrent' }) };
+  const adapter = {
+    status: vi.fn().mockResolvedValue(
+      options.status ?? [
+        {
+          infoHash: INFO_HASH,
+          seed: { seeding: true, ratio: 1.4, ratioGoal: 2, seedingTimeSeconds: 60, seedingTimeGoalMinutes: 4320, uploadedBytes: 900 },
+        },
+      ],
+    ),
+    remove: vi.fn().mockResolvedValue(undefined),
+  };
+  const registry = { require: vi.fn().mockReturnValue(adapter) };
+  const bookRequests = { getOne: vi.fn().mockResolvedValue({ id: 7 }) };
+  const gateway = { emitChanged: vi.fn() };
+
+  // The real removal service, not a double: these tests are about what reaches the download
+  // client, and a stubbed remover would assert only that the seed service called a mock.
+  const removal = new DownloadRemovalService(downloads as never, clients as never, registry as never);
+
+  const service = new RequestSeedService(
+    downloads as never,
+    requests as never,
+    clients as never,
+    registry as never,
+    bookRequests as never,
+    removal,
+    gateway as never,
+  );
+
+  return { service, downloads, requests, clients, adapter, registry, bookRequests, removal, gateway };
+}
+
+describe('RequestSeedService.getSeedStatus', () => {
+  it('reports what the client says about the torrent, goals included', async () => {
+    const { service } = makeService();
+
+    await expect(service.getSeedStatus(7)).resolves.toEqual({
+      downloadId: 11,
+      downloadClientId: 4,
+      downloadClientName: 'qbit',
+      clientHash: INFO_HASH,
+      seeding: true,
+      ratio: 1.4,
+      ratioGoal: 2,
+      seedingTimeSeconds: 60,
+      seedingTimeGoalMinutes: 4320,
+      uploadedBytes: 900,
+    });
+  });
+
+  it('reports nothing for a request that was never grabbed', async () => {
+    const { service, adapter } = makeService({ latest: null });
+
+    await expect(service.getSeedStatus(7)).resolves.toBeNull();
+    expect(adapter.status).not.toHaveBeenCalled();
+  });
+
+  it('404s a request that does not exist rather than reporting no seed', async () => {
+    const { service, requests } = makeService({ latest: null });
+    requests.findById.mockResolvedValue(undefined);
+
+    await expect(service.getSeedStatus(7)).rejects.toBeInstanceOf(NotFoundException);
+  });
+
+  it('reports nothing once the client has forgotten the torrent', async () => {
+    const { service } = makeService({ status: [] });
+    await expect(service.getSeedStatus(7)).resolves.toBeNull();
+  });
+
+  it('does not ask an HTTP downloader for seed state', async () => {
+    const { service, clients, adapter } = makeService({ latest: download({ source: 'direct_url' }) });
+
+    await expect(service.getSeedStatus(7)).resolves.toBeNull();
+    expect(clients.resolveConfig).not.toHaveBeenCalled();
+    expect(adapter.status).not.toHaveBeenCalled();
+  });
+
+  /** An adapter with nothing to say about seeding must not read as a torrent seeding at zero. */
+  it('reads a client that reports no seed detail as not seeding', async () => {
+    const { service } = makeService({ status: [{ infoHash: INFO_HASH }] });
+    await expect(service.getSeedStatus(7)).resolves.toMatchObject({ seeding: false, ratio: null });
+  });
+});
+
+describe('RequestSeedService.removeFromClient', () => {
+  it('leaves the files alone unless asked', async () => {
+    const { service, adapter } = makeService();
+
+    await service.removeFromClient(7, 11, false, user());
+
+    expect(adapter.remove).toHaveBeenCalledWith(INFO_HASH, expect.anything(), { deleteFiles: false });
+  });
+
+  it('deletes the files when the approver asked for that', async () => {
+    const { service, adapter } = makeService();
+
+    await service.removeFromClient(7, 11, true, user());
+
+    expect(adapter.remove).toHaveBeenCalledWith(INFO_HASH, expect.anything(), { deleteFiles: true });
+  });
+
+  it('leaves an already-imported request alone: the book is filed, the seed is not the request', async () => {
+    const { service, downloads, requests } = makeService();
+
+    await service.removeFromClient(7, 11, false, user());
+
+    // The conditional write is offered and refused, which is what leaves an imported row alone.
+    expect(downloads.updateIf).toHaveBeenCalledWith(11, expect.not.arrayContaining(['imported']), expect.anything());
+    expect(requests.updateIf).not.toHaveBeenCalled();
+  });
+
+  /**
+   * Nothing is going to finish a torrent that is no longer in the client, so this says so now
+   * rather than leaving the request at "downloading" until the watchdog notices in twelve hours.
+   */
+  it('fails a request whose download was still running', async () => {
+    const { service, downloads, requests, gateway } = makeService({ latest: download({ status: 'downloading' }) });
+
+    await service.removeFromClient(7, 11, false, user());
+
+    expect(downloads.updateIf).toHaveBeenCalledWith(11, expect.arrayContaining(['downloading']), {
+      status: 'failed',
+      errorMessage: expect.stringContaining('ann'),
+    });
+    expect(requests.updateIf).toHaveBeenCalledWith(7, expect.arrayContaining(['downloading']), {
+      status: 'failed',
+      statusReason: expect.stringContaining('ann'),
+    });
+    expect(gateway.emitChanged).toHaveBeenCalled();
+  });
+
+  it('refuses an attempt that belongs to another request', async () => {
+    const { service } = makeService({ latest: download({ requestId: 99 }) });
+
+    await expect(service.removeFromClient(7, 11, false, user())).rejects.toBeInstanceOf(NotFoundException);
+  });
+
+  it('refuses an attempt whose download client row is gone', async () => {
+    const { service } = makeService({ latest: download({ downloadClientId: null }) });
+
+    await expect(service.removeFromClient(7, 11, false, user())).rejects.toBeInstanceOf(BadRequestException);
+  });
+});
diff --git a/server/src/modules/book-request/fulfillment/request-seed.service.ts b/server/src/modules/book-request/fulfillment/request-seed.service.ts
new file mode 100644
index 000000000..0c606959e
--- /dev/null
+++ b/server/src/modules/book-request/fulfillment/request-seed.service.ts
@@ -0,0 +1,87 @@
+import { Injectable, NotFoundException } from '@nestjs/common';
+import { WORKER_WRITABLE_BOOK_REQUEST_STATUSES } from '@bookorbit/types';
+import type { BookRequestItem, BookRequestSeedStatus } from '@bookorbit/types';
+
+import type { RequestUser } from '../../../common/types/request-user';
+import { BookRequestGateway } from '../book-request.gateway';
+import { BookRequestRepository } from '../book-request.repository';
+import { BookRequestService } from '../book-request.service';
+import { DownloadClientConfigService } from '../download-clients/download-client-config.service';
+import { DownloadClientRegistry } from '../download-clients/download-client-registry';
+import { BookRequestDownloadRepository } from './book-request-download.repository';
+import { DownloadRemovalService } from './download-removal.service';
+
+/**
+ * What the download client is doing with a request's torrent after the bytes are down, and the
+ * operator-facing half of removing one.
+ *
+ * Seed state is read live rather than stored. A seed outlives its import by weeks, and keeping
+ * every finished download in the poll loop would mean an ever-growing number of client calls to
+ * maintain a number nobody is looking at.
+ */
+@Injectable()
+export class RequestSeedService {
+  constructor(
+    private readonly downloads: BookRequestDownloadRepository,
+    private readonly requests: BookRequestRepository,
+    private readonly clients: DownloadClientConfigService,
+    private readonly registry: DownloadClientRegistry,
+    private readonly bookRequests: BookRequestService,
+    private readonly removal: DownloadRemovalService,
+    private readonly gateway: BookRequestGateway,
+  ) {}
+
+  /** Null when there is no attempt to ask about, or when the client no longer holds the torrent. */
+  async getSeedStatus(requestId: number): Promise<BookRequestSeedStatus | null> {
+    const latest = (await this.downloads.findLatestForRequests([requestId])).get(requestId);
+    if (!latest) {
+      if (!(await this.requests.findById(requestId))) throw new NotFoundException('Book request not found');
+      return null;
+    }
+
+    const { download, downloadClientName } = latest;
+    if (download.source === 'direct_url' || download.downloadClientId === null) return null;
+    // A refused attempt never reached a client, so there is no torrent to report a seed for.
+    const clientHash = download.clientHash;
+    if (clientHash === null) return null;
+
+    const config = await this.clients.resolveConfig(download.downloadClientId);
+    const adapter = this.registry.require(config.adapterType);
+    const [status] = await adapter.status([clientHash], config);
+    if (!status) return null;
+
+    return {
+      downloadId: download.id,
+      downloadClientId: download.downloadClientId,
+      downloadClientName,
+      clientHash,
+      seeding: status.seed?.seeding ?? false,
+      ratio: status.seed?.ratio ?? null,
+      ratioGoal: status.seed?.ratioGoal ?? null,
+      seedingTimeSeconds: status.seed?.seedingTimeSeconds ?? null,
+      seedingTimeGoalMinutes: status.seed?.seedingTimeGoalMinutes ?? null,
+      uploadedBytes: status.seed?.uploadedBytes ?? null,
+    };
+  }
+
+  /**
+   * Removing a torrent that is still working takes the request with it, because nothing else is
+   * going to finish it. The row is failed directly rather than through the retry path, so the
+   * automation does not immediately undo a removal an approver asked for.
+   */
+  async removeFromClient(requestId: number, downloadId: number, deleteFiles: boolean, user: RequestUser): Promise<BookRequestItem> {
+    const wasInFlight = await this.removal.removeAttempt(requestId, downloadId, deleteFiles, user.username);
+
+    if (wasInFlight) {
+      // Conditional, so removing the transfer under a request somebody has already cancelled or
+      // filed does not reopen it as a failure.
+      await this.requests.updateIf(requestId, WORKER_WRITABLE_BOOK_REQUEST_STATUSES, {
+        status: 'failed',
+        statusReason: `Removed from the download client by ${user.username}`,
+      });
+      this.gateway.emitChanged();
+    }
+
+    return this.bookRequests.getOne(requestId, user);
+  }
+}
diff --git a/server/src/modules/book-request/fulfillment/request-user-cleanup.service.test.ts b/server/src/modules/book-request/fulfillment/request-user-cleanup.service.test.ts
new file mode 100644
index 000000000..512f3c00a
--- /dev/null
+++ b/server/src/modules/book-request/fulfillment/request-user-cleanup.service.test.ts
@@ -0,0 +1,67 @@
+import type { BookRequestDownloadRow } from '../../../db/schema';
+import { USER_DELETING, UserEventsService, type UserDeletingEvent } from '../../user/user-events.service';
+import { RequestUserCleanupService } from './request-user-cleanup.service';
+
+function attempt(overrides: Partial<BookRequestDownloadRow> = {}): BookRequestDownloadRow {
+  return { id: 11, requestId: 5, clientHash: 'a'.repeat(40), source: 'torrent_file', downloadClientId: 2, ...overrides } as BookRequestDownloadRow;
+}
+
+function makeService(rows: BookRequestDownloadRow[] = []) {
+  const users = new UserEventsService();
+  const downloads = { findInFlightForOwner: vi.fn().mockResolvedValue(rows) };
+  const removal = { detachAttempt: vi.fn().mockResolvedValue(null) };
+
+  const service = new RequestUserCleanupService(users, downloads as never, removal as never);
+  service.onModuleInit();
+  return { users, downloads, removal };
+}
+
+/** The emitter's own contract: a listener registers work, and the deletion waits for it. */
+async function announce(users: UserEventsService, userId: number): Promise<void> {
+  const pending: Promise<void>[] = [];
+  const event: UserDeletingEvent = { userId, waitFor: (work) => pending.push(work) };
+  users.emit(USER_DELETING, event);
+  await Promise.allSettled(pending);
+}
+
+/**
+ * Deleting an account cascades its requests and every attempt behind them away, so this is the
+ * last moment anything knows which torrents and staged files were theirs.
+ */
+describe('RequestUserCleanupService', () => {
+  it('detaches every live attempt behind the deleted account, before the cascade takes the rows', async () => {
+    const { users, downloads, removal } = makeService([attempt({ id: 11 }), attempt({ id: 12 })]);
+
+    await announce(users, 3);
+
+    expect(downloads.findInFlightForOwner).toHaveBeenCalledWith(3);
+    expect(removal.detachAttempt).toHaveBeenCalledTimes(2);
+  });
+
+  /** The same split cancelling makes: a seeding torrent is worth keeping, partial staging is not. */
+  it('keeps torrent data rather than deleting what the swarm and the import both rely on', async () => {
+    const { users, removal } = makeService([attempt()]);
+
+    await announce(users, 3);
+
+    expect(removal.detachAttempt).toHaveBeenCalledWith(expect.objectContaining({ id: 11 }), false);
+  });
+
+  /** A client that is down is a reason to report one leaked torrent, not to leave the rest running. */
+  it('carries on through a client that refuses one of them', async () => {
+    const { users, removal } = makeService([attempt({ id: 11 }), attempt({ id: 12 })]);
+    removal.detachAttempt.mockResolvedValueOnce('the client is unreachable');
+
+    await announce(users, 3);
+
+    expect(removal.detachAttempt).toHaveBeenCalledTimes(2);
+  });
+
+  it('asks the client nothing when the account had no live downloads', async () => {
+    const { users, removal } = makeService();
+
+    await announce(users, 3);
+
+    expect(removal.detachAttempt).not.toHaveBeenCalled();
+  });
+});
diff --git a/server/src/modules/book-request/fulfillment/request-user-cleanup.service.ts b/server/src/modules/book-request/fulfillment/request-user-cleanup.service.ts
new file mode 100644
index 000000000..e1ca64f50
--- /dev/null
+++ b/server/src/modules/book-request/fulfillment/request-user-cleanup.service.ts
@@ -0,0 +1,67 @@
+import { Injectable, Logger, OnModuleInit } from '@nestjs/common';
+
+import { sanitizeLogValue } from '../../../common/utils/log-sanitize.utils';
+import { USER_DELETING, UserEventsService, type UserDeletingEvent } from '../../user/user-events.service';
+import { BookRequestDownloadRepository, MAX_DETACH_ON_OWNER_DELETE } from './book-request-download.repository';
+import { DownloadRemovalService } from './download-removal.service';
+
+/**
+ * Stops the transfers behind a deleted account's requests, before the account takes their tracking
+ * rows with it.
+ *
+ * `book_requests.user_id` cascades, and every attempt hangs off the request, so deleting somebody
+ * removes the only record of which torrents and which staged files were theirs. The client goes on
+ * seeding a torrent nothing points at, and a direct download this process is still writing goes on
+ * writing. Detaching first is the only moment either is still findable.
+ *
+ * Its own service rather than a branch in `UserService`, because the user module must not learn
+ * what a book request is: the dependency runs one way, from here to the event the user module
+ * publishes.
+ */
+@Injectable()
+export class RequestUserCleanupService implements OnModuleInit {
+  private readonly logger = new Logger(RequestUserCleanupService.name);
+
+  constructor(
+    private readonly users: UserEventsService,
+    private readonly downloads: BookRequestDownloadRepository,
+    private readonly removal: DownloadRemovalService,
+  ) {}
+
+  onModuleInit(): void {
+    this.users.on(USER_DELETING, (event: UserDeletingEvent) => {
+      event.waitFor(this.detachOwnedWork(event.userId));
+    });
+  }
+
+  /**
+   * Torrent data is kept and staged files are dropped, which is the same split cancelling a
+   * request makes: a seeding torrent is worth something to the swarm and to whoever imported it,
+   * while partial staging is worth nothing to anybody.
+   *
+   * Every attempt is tried even when one refuses. A download client that is down is a reason to
+   * report one leaked torrent, not to leave the rest of them running too.
+   */
+  private async detachOwnedWork(userId: number): Promise<void> {
+    const rows = await this.downloads.findInFlightForOwner(userId);
+    if (rows.length === 0) return;
+
+    let detached = 0;
+    const refusals: string[] = [];
+    for (const row of rows) {
+      const error = await this.removal.detachAttempt(row, false);
+      if (error === null) detached++;
+      else refusals.push(error);
+    }
+
+    // A truncated pass must not read as a complete one: whatever is past the bound goes on running
+    // with its tracking rows already gone, and the log line is the only place that can say so.
+    const truncated = rows.length === MAX_DETACH_ON_OWNER_DELETE;
+    const level = refusals.length > 0 || truncated ? 'warn' : 'log';
+    this.logger[level](
+      `[book_request.owner_delete] [end] userId=${userId} attempts=${rows.length} detached=${detached} refused=${refusals.length} truncated=${truncated}` +
+        (refusals[0] ? ` error="${sanitizeLogValue(refusals[0])}"` : '') +
+        ' - stopped the downloads behind a deleted account',
+    );
+  }
+}
diff --git a/server/src/modules/book-request/fulfillment/request-verification.service.test.ts b/server/src/modules/book-request/fulfillment/request-verification.service.test.ts
new file mode 100644
index 000000000..397ac5522
--- /dev/null
+++ b/server/src/modules/book-request/fulfillment/request-verification.service.test.ts
@@ -0,0 +1,562 @@
+import { NotificationType, type BookDockMetadata } from '@bookorbit/types';
+
+import type { BookRequestDownloadRow } from '../../../db/schema';
+import { RequestVerificationService, verifyAgainstRequest } from './request-verification.service';
+
+type RequestSnapshot = Parameters<typeof verifyAgainstRequest>[0];
+
+function request(overrides: Partial<RequestSnapshot> = {}): RequestSnapshot {
+  return { title: 'Dune', subtitle: null, authors: ['Frank Herbert'], isbn13: null, ...overrides } as RequestSnapshot;
+}
+
+function metadata(overrides: Partial<BookDockMetadata> = {}): BookDockMetadata {
+  return { title: 'Dune', authors: ['Frank Herbert'], ...overrides } as BookDockMetadata;
+}
+
+describe('verifyAgainstRequest', () => {
+  it('passes on an exact ISBN13 match without looking at anything else', () => {
+    const outcome = verifyAgainstRequest(
+      request({ title: 'Dune', isbn13: '978-0-441-01359-3' }),
+      metadata({ title: 'Something Else Entirely', authors: ['Nobody'], isbn13: '9780441013593' }),
+      null,
+    );
+
+    expect(outcome).toMatchObject({ passed: true, score: 100 });
+  });
+
+  it('falls through to title and author when the ISBNs differ, because editions differ', () => {
+    const outcome = verifyAgainstRequest(request({ isbn13: '9780441013593' }), metadata({ isbn13: '9780340960196' }), null);
+    expect(outcome.passed).toBe(true);
+  });
+
+  /**
+   * The case the whole step exists for. The dock's own confidence score would be high here,
+   * because the file and the provider agree with each other about Dune Messiah.
+   */
+  it('holds a sequel that merely extends the requested title', () => {
+    const outcome = verifyAgainstRequest(request(), metadata({ title: 'Dune Messiah' }), null);
+
+    expect(outcome.passed).toBe(false);
+    expect(outcome.score).toBeLessThan(70);
+  });
+
+  it('passes an edition that adds a subtitle to the requested title', () => {
+    const outcome = verifyAgainstRequest(
+      request({ title: 'The Hobbit', authors: ['J. R. R. Tolkien'] }),
+      metadata({ title: 'The Hobbit: Or There and Back Again', authors: ['J. R. R. Tolkien'] }),
+      null,
+    );
+
+    expect(outcome.passed).toBe(true);
+  });
+
+  it('tolerates an author written surname-first', () => {
+    const outcome = verifyAgainstRequest(request(), metadata({ authors: ['Herbert, Frank'] }), null);
+    expect(outcome.passed).toBe(true);
+  });
+
+  it('holds a right-title wrong-author file however well the title scores', () => {
+    const outcome = verifyAgainstRequest(
+      request({ title: 'It', authors: ['Stephen King'] }),
+      metadata({ title: 'It', authors: ['Alexa Chung'] }),
+      null,
+    );
+
+    expect(outcome.passed).toBe(false);
+    expect(outcome.reason).toContain('Alexa Chung');
+  });
+
+  it('holds an unrelated book', () => {
+    const outcome = verifyAgainstRequest(request(), metadata({ title: 'Neuromancer', authors: ['William Gibson'] }), null);
+    expect(outcome).toMatchObject({ passed: false, score: 0 });
+  });
+
+  it('falls back to embedded metadata when the provider fetch produced nothing', () => {
+    const outcome = verifyAgainstRequest(request(), null, metadata());
+    expect(outcome.passed).toBe(true);
+  });
+
+  it('holds a file with no readable title rather than guessing', () => {
+    const outcome = verifyAgainstRequest(request(), metadata({ title: undefined }), null);
+    expect(outcome).toMatchObject({ passed: false, score: 0 });
+  });
+
+  it('scores on title alone when the imported file names no author', () => {
+    const outcome = verifyAgainstRequest(request(), metadata({ authors: [] }), null);
+    expect(outcome).toMatchObject({ passed: true, score: 100 });
+  });
+});
+
+/**
+ * The right number depends on an instance's own trackers and metadata providers, so the operator
+ * moves it. What must not move is the shape: one score, measured against whatever it was told.
+ */
+describe('verifyAgainstRequest with an operator-set threshold', () => {
+  const sequel = (threshold?: number) => verifyAgainstRequest(request(), metadata({ title: 'Dune Messiah' }), null, threshold);
+
+  it('files a file the default holds, once the operator lowers the bar to its score', () => {
+    const held = sequel();
+    expect(held.passed).toBe(false);
+
+    expect(sequel(held.score).passed).toBe(true);
+    expect(sequel(held.score + 1).passed).toBe(false);
+  });
+
+  it('holds a file the default files, once the operator raises the bar past it', () => {
+    // An imported edition that abbreviates the author. Right book, imperfect agreement: exactly
+    // the band an operator moves the threshold through.
+    const initialled = (threshold?: number) => verifyAgainstRequest(request(), metadata({ authors: ['F. Herbert'] }), null, threshold);
+
+    const filed = initialled();
+    expect(filed.passed).toBe(true);
+    expect(filed.score).toBeLessThan(100);
+
+    const strict = initialled(filed.score + 1);
+    expect(strict.passed).toBe(false);
+    expect(strict.reason).toContain(`below the ${filed.score + 1}`);
+  });
+});
+
+/**
+ * The threshold is only worth having if the gate actually reads it, so this drives the whole
+ * handler: one file, one score, two operator settings, two outcomes.
+ */
+describe('RequestVerificationService against the configured threshold', () => {
+  function makeService(threshold: number, verificationEnabled = true, overrides: { requestSettled?: boolean } = {}) {
+    const events = { on: vi.fn() };
+    const dockRepo = {
+      findById: vi.fn().mockResolvedValue({ id: 100, fetchedMetadata: metadata({ authors: ['F. Herbert'] }), embeddedMetadata: null }),
+    };
+    const dock = { discardFile: vi.fn().mockResolvedValue(undefined) };
+    const finalizeService = { finalizeManagedFile: vi.fn().mockResolvedValue({ success: true, bookId: 55 }) };
+    const downloads = {
+      findByBookDockFileId: vi.fn().mockResolvedValue({ id: 11, requestId: 7, status: 'importing', bookDockFileId: 100 } as BookRequestDownloadRow),
+      update: vi.fn().mockResolvedValue(undefined),
+      updateIf: vi.fn().mockImplementation((id: number, _expected: unknown, patch: Record<string, unknown>) => Promise.resolve({ id, ...patch })),
+    };
+    const requests = {
+      findById: vi.fn().mockResolvedValue({ request: { ...request(), id: 7, targetLibraryId: 2, targetFolderId: 3 } }),
+      update: vi.fn().mockResolvedValue(undefined),
+      updateIf: vi
+        .fn()
+        .mockImplementation((id: number, _expected: unknown, patch: Record<string, unknown>) =>
+          Promise.resolve(overrides.requestSettled ? undefined : { id, ...patch }),
+        ),
+      findFirstFolderId: vi.fn().mockResolvedValue(3),
+    };
+    const fulfillment = { failDownload: vi.fn().mockResolvedValue(undefined), holdForReview: vi.fn().mockResolvedValue(undefined) };
+    const notifier = {
+      notifyApprovers: vi.fn().mockResolvedValue(undefined),
+      notifyInterested: vi.fn().mockResolvedValue(undefined),
+      notifyResponsible: vi.fn().mockResolvedValue(undefined),
+      notifyBookAvailable: vi.fn().mockResolvedValue(undefined),
+    };
+    const gateway = { emitChanged: vi.fn() };
+    const settings = { get: vi.fn().mockResolvedValue({ verificationEnabled, verificationThreshold: threshold }) };
+
+    const service = new RequestVerificationService(
+      events as never,
+      dockRepo as never,
+      dock as never,
+      finalizeService as never,
+      downloads as never,
+      requests as never,
+      fulfillment as never,
+      notifier as never,
+      gateway as never,
+      settings as never,
+    );
+
+    service.onModuleInit();
+    const listener = events.on.mock.calls[0][1] as (fileId: number) => void;
+    const ingest = async () => {
+      listener(100);
+      await new Promise((resolve) => setImmediate(resolve));
+    };
+
+    return { ingest, finalizeService, downloads, requests, notifier, fulfillment };
+  }
+
+  it('files the book when its score clears the configured threshold', async () => {
+    const { ingest, finalizeService, requests } = makeService(70);
+
+    await ingest();
+
+    expect(finalizeService.finalizeManagedFile).toHaveBeenCalledWith(100, { libraryId: 2, folderId: 3 });
+    expect(requests.updateIf).toHaveBeenCalledWith(
+      7,
+      expect.arrayContaining(['importing']),
+      expect.objectContaining({ status: 'available', matchedBookId: 55 }),
+    );
+  });
+
+  /**
+   * Scoring an import and handing it to the Book Dock takes long enough for somebody to cancel the
+   * request underneath it. The two finalize writes used to be the only unconditional ones in the
+   * pipeline, so a cancellation landing there was silently undone and the requester was told their
+   * book had arrived.
+   */
+  it('leaves a request somebody settled while the import was being filed alone', async () => {
+    const { ingest, requests, downloads, notifier } = makeService(50, true, { requestSettled: true });
+
+    await ingest();
+
+    expect(requests.updateIf).toHaveBeenCalledWith(7, expect.arrayContaining(['importing']), expect.objectContaining({ status: 'available' }));
+    expect(requests.update).not.toHaveBeenCalled();
+    // The bytes did become a book, so the attempt is settled rather than left for the resume sweep.
+    expect(downloads.updateIf).toHaveBeenCalledWith(11, expect.anything(), expect.objectContaining({ status: 'imported' }));
+    expect(notifier.notifyBookAvailable).not.toHaveBeenCalled();
+  });
+
+  it('holds the same book in the dock once the operator raises the threshold past it', async () => {
+    const { ingest, finalizeService, fulfillment } = makeService(95);
+
+    await ingest();
+
+    expect(finalizeService.finalizeManagedFile).not.toHaveBeenCalled();
+    expect(fulfillment.holdForReview).toHaveBeenCalledWith(expect.anything(), expect.objectContaining({ id: 7 }), expect.stringContaining('scored'));
+  });
+
+  /**
+   * Turning the check off is the operator saying they would rather have the book than the guard.
+   * The threshold it would have failed stays stored and untouched, so switching back restores the
+   * number they tuned rather than a default.
+   */
+  it('files a book that would have been held when checking is switched off', async () => {
+    const { ingest, finalizeService, requests, fulfillment } = makeService(95, false);
+
+    await ingest();
+
+    expect(finalizeService.finalizeManagedFile).toHaveBeenCalledWith(100, { libraryId: 2, folderId: 3 });
+    expect(requests.updateIf).toHaveBeenCalledWith(
+      7,
+      expect.arrayContaining(['importing']),
+      expect.objectContaining({ status: 'available', matchedBookId: 55 }),
+    );
+    expect(fulfillment.holdForReview).not.toHaveBeenCalled();
+  });
+});
+
+/**
+ * The drawer renders these rows verbatim, so a shortfall has to be attributable: an approver
+ * deciding whether to file a 65 anyway needs to see which field lost the points.
+ */
+describe('verifyAgainstRequest comparison rows', () => {
+  const rowFor = (outcome: ReturnType<typeof verifyAgainstRequest>, field: string) => outcome.rows.find((row) => row.field === field)!;
+
+  it('blames the title and clears the author when only the title drifted', () => {
+    const outcome = verifyAgainstRequest(
+      request({ title: 'Fablehaven', authors: ['Brandon Mull'] }),
+      metadata({ title: 'Fablehaven, Book 1 (Unabridged)', authors: ['Brandon Mull'] }),
+      null,
+    );
+
+    expect(outcome.passed).toBe(false);
+    expect(outcome.code).toBe('below_threshold');
+    expect(rowFor(outcome, 'title')).toMatchObject({
+      requested: 'Fablehaven',
+      imported: 'Fablehaven, Book 1 (Unabridged)',
+      verdict: 'mismatch',
+    });
+    expect(rowFor(outcome, 'authors')).toMatchObject({ verdict: 'match' });
+  });
+
+  it('reports a field neither side carries as uncompared rather than as a mismatch', () => {
+    const outcome = verifyAgainstRequest(request(), metadata(), null);
+    expect(rowFor(outcome, 'isbn13')).toMatchObject({ requested: null, imported: null, verdict: 'unknown' });
+  });
+
+  it('reports an ISBN only one side carries as uncompared, because it cost nothing', () => {
+    const outcome = verifyAgainstRequest(request({ isbn13: '9780441013593' }), metadata(), null);
+    expect(rowFor(outcome, 'isbn13')).toMatchObject({ requested: '9780441013593', imported: null, verdict: 'unknown' });
+  });
+
+  it('carries the rows through the ISBN shortcut, which returns before anything is compared', () => {
+    const outcome = verifyAgainstRequest(request({ isbn13: '9780441013593' }), metadata({ isbn13: '9780441013593' }), null);
+
+    expect(outcome.code).toBe('isbn_match');
+    expect(outcome.rows.map((row) => row.field)).toEqual(['title', 'authors', 'isbn13']);
+    expect(rowFor(outcome, 'isbn13').verdict).toBe('match');
+  });
+
+  it('names the subtitle in the requested title, since that is what was scored against', () => {
+    const outcome = verifyAgainstRequest(request({ title: 'Dune', subtitle: 'Book One' }), metadata(), null);
+    expect(rowFor(outcome, 'title').requested).toBe('Dune: Book One');
+  });
+});
+
+describe('RequestVerificationService review surface', () => {
+  const heldRequest = { ...request(), id: 7, status: 'needs_review', bookDockFileId: 100, targetLibraryId: 2, targetFolderId: 3 };
+
+  function makeService(
+    overrides: {
+      dockRow?: Record<string, unknown>;
+      unitFiles?: Array<Record<string, unknown>>;
+      requestRow?: Record<string, unknown>;
+      downloadRow?: Record<string, unknown>;
+      firstFolderId?: number | null;
+      finalizeResult?: Record<string, unknown>;
+      threshold?: number;
+      verificationEnabled?: boolean;
+    } = {},
+  ) {
+    const dockRepo = {
+      findById: vi.fn().mockResolvedValue(
+        overrides.dockRow ?? {
+          id: 100,
+          fileName: 'dune.epub',
+          fileSize: 1024,
+          format: 'epub',
+          unitDirectory: null,
+          fetchedMetadata: metadata({ title: 'Dune Messiah' }),
+          embeddedMetadata: null,
+        },
+      ),
+      findUnitFiles: vi.fn().mockResolvedValue(overrides.unitFiles ?? []),
+    };
+    const dock = { discardFile: vi.fn().mockResolvedValue(undefined) };
+    const finalizeService = {
+      finalizeManagedFile: vi.fn().mockResolvedValue(overrides.finalizeResult ?? { success: true, bookId: 55 }),
+    };
+    const downloadRow = { id: 11, requestId: 7, status: 'needs_review', bookDockFileId: 100, ...overrides.downloadRow } as BookRequestDownloadRow;
+    const downloads = {
+      findByBookDockFileId: vi.fn().mockResolvedValue(downloadRow),
+      findLatestForRequests: vi.fn().mockResolvedValue(new Map([[7, { download: downloadRow, downloadClientName: null }]])),
+      update: vi.fn().mockResolvedValue(undefined),
+      updateIf: vi.fn().mockImplementation((id: number, _expected: unknown, patch: Record<string, unknown>) => Promise.resolve({ id, ...patch })),
+    };
+    const requests = {
+      findById: vi.fn().mockResolvedValue({ request: { ...heldRequest, ...overrides.requestRow } }),
+      update: vi.fn().mockResolvedValue(undefined),
+      updateIf: vi.fn().mockImplementation((id: number, _expected: unknown, patch: Record<string, unknown>) => Promise.resolve({ id, ...patch })),
+      findFirstFolderId: vi.fn().mockResolvedValue(overrides.firstFolderId === undefined ? 3 : overrides.firstFolderId),
+    };
+    const fulfillment = { failDownload: vi.fn().mockResolvedValue(undefined), holdForReview: vi.fn().mockResolvedValue(undefined) };
+    const notifier = {
+      notifyApprovers: vi.fn().mockResolvedValue(undefined),
+      notifyInterested: vi.fn().mockResolvedValue(undefined),
+      notifyResponsible: vi.fn().mockResolvedValue(undefined),
+      notifyBookAvailable: vi.fn().mockResolvedValue(undefined),
+    };
+    const gateway = { emitChanged: vi.fn() };
+    const settings = {
+      get: vi.fn().mockResolvedValue({
+        verificationEnabled: overrides.verificationEnabled ?? true,
+        verificationThreshold: overrides.threshold ?? 70,
+      }),
+    };
+
+    const service = new RequestVerificationService(
+      { on: vi.fn() } as never,
+      dockRepo as never,
+      dock as never,
+      finalizeService as never,
+      downloads as never,
+      requests as never,
+      fulfillment as never,
+      notifier as never,
+      gateway as never,
+      settings as never,
+    );
+
+    return { service, dock, dockRepo, finalizeService, downloads, requests, notifier, gateway, fulfillment };
+  }
+
+  it('describes a loose single file from the anchor row, which already describes it fully', async () => {
+    const { service } = makeService();
+
+    const review = await service.getReview(7);
+
+    expect(review.files).toEqual([{ fileName: 'dune.epub', fileSize: 1024, format: 'epub', role: 'content' }]);
+    expect(review.totalSizeBytes).toBe(1024);
+    expect(review.bookDockFileId).toBe(100);
+  });
+
+  it('lists every file of a multi-file unit and totals only the sizes it knows', async () => {
+    const { service } = makeService({
+      dockRow: {
+        id: 100,
+        fileName: 'part-01.m4b',
+        fileSize: 400,
+        format: 'm4b',
+        unitDirectory: '/dock/dune',
+        fetchedMetadata: metadata(),
+        embeddedMetadata: null,
+      },
+      unitFiles: [
+        { fileName: 'part-01.m4b', fileSize: 400, format: 'm4b', role: 'content' },
+        { fileName: 'part-02.m4b', fileSize: 600, format: 'm4b', role: 'content' },
+        { fileName: 'cover.jpg', fileSize: null, format: 'jpg', role: 'cover' },
+      ],
+    });
+
+    const review = await service.getReview(7);
+
+    expect(review.files).toHaveLength(3);
+    expect(review.files[2]).toMatchObject({ fileName: 'cover.jpg', role: 'cover' });
+    expect(review.totalSizeBytes).toBe(1000);
+  });
+
+  /** Never exposed: a dock path is a server path, and the review is the one new read of that row. */
+  it('reports file names without the absolute paths they came from', async () => {
+    const { service } = makeService({
+      dockRow: {
+        id: 100,
+        fileName: 'dune.epub',
+        fileSize: 1024,
+        format: 'epub',
+        absolutePath: '/srv/book-dock/dune.epub',
+        unitDirectory: '/srv/book-dock/dune',
+        fetchedMetadata: metadata(),
+        embeddedMetadata: null,
+      },
+      unitFiles: [{ fileName: 'dune.epub', fileSize: 1024, format: 'epub', role: 'content', absolutePath: '/srv/book-dock/dune/dune.epub' }],
+    });
+
+    const review = await service.getReview(7);
+
+    expect(JSON.stringify(review)).not.toContain('/srv/book-dock');
+  });
+
+  /**
+   * The whole reason the score is recomputed instead of replayed: an approver who corrects the
+   * metadata in the dock and comes back must see the corrected number, not the one that held it.
+   */
+  it('scores against the dock entry as it stands now, not as it stood when it was held', async () => {
+    const stale = await makeService().service.getReview(7);
+    expect(stale.verification).toMatchObject({ passed: false, reason: 'below_threshold' });
+
+    const corrected = await makeService({
+      dockRow: {
+        id: 100,
+        fileName: 'dune.epub',
+        fileSize: 1024,
+        format: 'epub',
+        unitDirectory: null,
+        fetchedMetadata: metadata(),
+        embeddedMetadata: null,
+      },
+    }).service.getReview(7);
+
+    expect(corrected.verification).toMatchObject({ passed: true, score: 100 });
+  });
+
+  it('reports the operator threshold alongside the score, so the drawer needs no second read', async () => {
+    const { service } = makeService({ threshold: 85 });
+    expect((await service.getReview(7)).verification?.threshold).toBe(85);
+  });
+
+  it('offers no verification when the operator has switched import checking off', async () => {
+    const { service } = makeService({ verificationEnabled: false });
+    expect((await service.getReview(7)).verification).toBeNull();
+  });
+
+  it('falls back to the library first folder when the request never named one', async () => {
+    const { service } = makeService({ requestRow: { targetFolderId: null } });
+    expect((await service.getReview(7)).canFile).toBe(true);
+  });
+
+  it('reports that it cannot be filed when there is no folder anywhere to file it into', async () => {
+    const { service } = makeService({ requestRow: { targetFolderId: null, targetLibraryId: null }, firstFolderId: null });
+    expect((await service.getReview(7)).canFile).toBe(false);
+  });
+
+  /**
+   * Both columns pointing at the entry are `on delete set null`, so filing or discarding it by
+   * hand empties them together and the hold outlives its file. Found in the dev database.
+   */
+  it('reports a dock entry that has been removed instead of refusing to answer', async () => {
+    const { service } = makeService({ requestRow: { bookDockFileId: null }, downloadRow: { bookDockFileId: null } });
+
+    const review = await service.getReview(7);
+
+    expect(review).toMatchObject({ bookDockFileId: null, verification: null, files: [], canFile: false });
+  });
+
+  it('finds the entry through the attempt when only the request lost its pointer', async () => {
+    const { service } = makeService({ requestRow: { bookDockFileId: null } });
+    expect((await service.getReview(7)).bookDockFileId).toBe(100);
+  });
+
+  it('refuses to file a request whose dock entry has been removed', async () => {
+    const { service, finalizeService } = makeService({ requestRow: { bookDockFileId: null }, downloadRow: { bookDockFileId: null } });
+
+    await expect(service.fileHeldImport(7, { id: 9 } as never)).rejects.toThrow(/nothing left to file/);
+    expect(finalizeService.finalizeManagedFile).not.toHaveBeenCalled();
+  });
+
+  it('refuses to review a request that is not waiting on a person', async () => {
+    const { service } = makeService({ requestRow: { status: 'available' } });
+    await expect(service.getReview(7)).rejects.toThrow(/not waiting for review/);
+  });
+
+  it('files a held import on an approver overruling the score', async () => {
+    const { service, finalizeService, requests, downloads, notifier } = makeService();
+
+    await service.fileHeldImport(7, { id: 9 } as never);
+
+    expect(finalizeService.finalizeManagedFile).toHaveBeenCalledWith(100, { libraryId: 2, folderId: 3 });
+    expect(downloads.updateIf).toHaveBeenCalledWith(11, expect.anything(), expect.objectContaining({ status: 'imported' }));
+    expect(requests.updateIf).toHaveBeenCalledWith(
+      7,
+      expect.arrayContaining(['needs_review']),
+      expect.objectContaining({ status: 'available', matchedBookId: 55, statusReason: null }),
+    );
+    expect(notifier.notifyBookAvailable).toHaveBeenCalled();
+  });
+
+  /** A failure here is the approver's to see, not another silent hold they have to come back to. */
+  it('throws the dock message back at the approver instead of holding the import again', async () => {
+    const { service, fulfillment } = makeService({ finalizeResult: { success: false, message: 'a book with that path already exists' } });
+
+    await expect(service.fileHeldImport(7, { id: 9 } as never)).rejects.toThrow(/already exists/);
+    expect(fulfillment.holdForReview).not.toHaveBeenCalled();
+  });
+
+  it('refuses to file a request that is not held', async () => {
+    const { service, finalizeService } = makeService({ requestRow: { status: 'downloading' } });
+
+    await expect(service.fileHeldImport(7, { id: 9 } as never)).rejects.toThrow(/not waiting for review/);
+    expect(finalizeService.finalizeManagedFile).not.toHaveBeenCalled();
+  });
+
+  it('discards a held import without requiring separate Book Dock permission', async () => {
+    const { service, dock, requests, downloads, notifier, gateway } = makeService();
+
+    await service.discardHeldImport(7, { id: 9, isSuperuser: false, permissions: [] } as never);
+
+    expect(requests.updateIf).toHaveBeenCalledWith(7, ['needs_review'], expect.objectContaining({ status: 'failed' }));
+    expect(downloads.updateIf).toHaveBeenCalledWith(11, ['needs_review'], expect.objectContaining({ status: 'failed' }));
+    expect(dock.discardFile).toHaveBeenCalledWith(100, 9, true);
+    expect(notifier.notifyResponsible).toHaveBeenCalledWith(
+      expect.objectContaining({ id: 7 }),
+      NotificationType.BookRequestFailed,
+      expect.objectContaining({ meta: { requestId: 7, downloadId: 11, dockFileId: 100 } }),
+    );
+    expect(gateway.emitChanged).toHaveBeenCalledOnce();
+  });
+
+  it('does not delete the dock entry when the download is no longer held', async () => {
+    const { service, dock, requests, downloads, gateway } = makeService();
+    downloads.updateIf.mockResolvedValueOnce(undefined);
+
+    await expect(service.discardHeldImport(7, { id: 9 } as never)).rejects.toThrow(/no longer waiting for review/);
+
+    expect(requests.updateIf).toHaveBeenLastCalledWith(7, ['failed'], expect.objectContaining({ status: 'needs_review' }));
+    expect(dock.discardFile).not.toHaveBeenCalled();
+    expect(gateway.emitChanged).not.toHaveBeenCalled();
+  });
+
+  it('restores the held state when deleting the dock files fails', async () => {
+    const { service, dock, requests, downloads, gateway } = makeService();
+    dock.discardFile.mockRejectedValueOnce(new Error('disk is read-only'));
+
+    await expect(service.discardHeldImport(7, { id: 9, isSuperuser: false, permissions: [] } as never)).rejects.toThrow(
+      /held import could not be discarded/i,
+    );
+
+    expect(requests.updateIf).toHaveBeenLastCalledWith(7, ['failed'], expect.objectContaining({ status: 'needs_review' }));
+    expect(downloads.updateIf).toHaveBeenLastCalledWith(11, ['failed'], expect.objectContaining({ status: 'needs_review' }));
+    expect(gateway.emitChanged).not.toHaveBeenCalled();
+  });
+});
diff --git a/server/src/modules/book-request/fulfillment/request-verification.service.ts b/server/src/modules/book-request/fulfillment/request-verification.service.ts
new file mode 100644
index 000000000..8d74503b4
--- /dev/null
+++ b/server/src/modules/book-request/fulfillment/request-verification.service.ts
@@ -0,0 +1,542 @@
+import {
+  BadRequestException,
+  HttpException,
+  Injectable,
+  InternalServerErrorException,
+  Logger,
+  NotFoundException,
+  OnModuleInit,
+} from '@nestjs/common';
+import { basename } from 'path';
+import { DEFAULT_BOOK_REQUEST_AUTOMATION_SETTINGS, NotificationType, UNSETTLED_BOOK_REQUEST_DOWNLOAD_STATUSES } from '@bookorbit/types';
+import type {
+  BookDockMetadata,
+  BookRequestStatus,
+  BookRequestReview,
+  BookRequestReviewFile,
+  BookRequestVerificationReason,
+  BookRequestVerificationRow,
+  BookRequestVerificationVerdict,
+} from '@bookorbit/types';
+
+import { normalizeMetadataIsbn } from '../../../common/text-match/isbn-normalize';
+import { mainTitlePart, symmetricTitleSimilarity } from '../../../common/text-match/title-match';
+import type { RequestUser } from '../../../common/types/request-user';
+import { sanitizeLogValue } from '../../../common/utils/log-sanitize.utils';
+import type { BookRequestDownloadRow, BookRequestRow } from '../../../db/schema';
+import { BookDockEventsService, BOOK_DOCK_FILE_INGESTED } from '../../book-dock/book-dock-events.service';
+import { BookDockFinalizeService } from '../../book-dock/book-dock-finalize.service';
+import { BookDockRepository } from '../../book-dock/book-dock.repository';
+import { BookDockService } from '../../book-dock/book-dock.service';
+import { BookRequestGateway } from '../book-request.gateway';
+import { BookRequestNotifier } from '../book-request-notifier.service';
+import { BookRequestRepository } from '../book-request.repository';
+import { BookRequestDownloadRepository } from './book-request-download.repository';
+import { RequestAutomationSettingsService } from './request-automation-settings.service';
+import { RequestFulfillmentService } from './request-fulfillment.service';
+
+/**
+ * Below this, the imported file is held in the dock for a human to look at rather than filed.
+ * Deliberately forgiving: subtitles, series suffixes and translated editions all cost points, and
+ * the cost of a false hold is one click while the cost of a false pass is a wrong book in a
+ * library.
+ *
+ * The operator can move it, because the right number depends on an instance's own trackers and
+ * metadata providers and cannot be guessed from here. This is the value they start from.
+ */
+const DEFAULT_VERIFICATION_THRESHOLD = DEFAULT_BOOK_REQUEST_AUTOMATION_SETTINGS.verificationThreshold;
+
+const TITLE_WEIGHT = 0.7;
+const AUTHOR_WEIGHT = 0.3;
+
+/**
+ * The two statuses a finished import may be filed from: the automatic path arrives at `importing`,
+ * and an approver force-filing a held one arrives at `needs_review`. Anything else has been settled
+ * by a person, and their decision outranks a score that finished after they made it.
+ */
+const FILEABLE_FROM: readonly BookRequestStatus[] = ['importing', 'needs_review'];
+
+export interface VerificationOutcome {
+  score: number;
+  passed: boolean;
+  /** Prose, for the stored failure reason and the logs. The client localizes from `code` instead. */
+  reason: string;
+  code: BookRequestVerificationReason;
+  rows: BookRequestVerificationRow[];
+}
+
+/**
+ * Scores the imported file against the **request snapshot**, which is not what
+ * `book_dock_files.confidence` measures.
+ *
+ * `computeConfidence(embedded, fetched)` compares the file's own metadata against what the
+ * providers returned for it: internal consistency. Request Dune, receive Dune Messiah, and both
+ * sides agree on Dune Messiah for a confidence of 95. That score is structurally incapable of
+ * catching a wrong-book grab, which is the one failure this step exists for.
+ */
+@Injectable()
+export class RequestVerificationService implements OnModuleInit {
+  private readonly logger = new Logger(RequestVerificationService.name);
+
+  constructor(
+    private readonly events: BookDockEventsService,
+    private readonly dockRepo: BookDockRepository,
+    private readonly dock: BookDockService,
+    private readonly finalizeService: BookDockFinalizeService,
+    private readonly downloads: BookRequestDownloadRepository,
+    private readonly requests: BookRequestRepository,
+    private readonly fulfillment: RequestFulfillmentService,
+    private readonly notifier: BookRequestNotifier,
+    private readonly gateway: BookRequestGateway,
+    private readonly settings: RequestAutomationSettingsService,
+  ) {}
+
+  onModuleInit(): void {
+    this.events.on(BOOK_DOCK_FILE_INGESTED, (fileId: number) => {
+      void this.handleIngested(fileId).catch((err: unknown) => {
+        const message = sanitizeLogValue(err instanceof Error ? err.message : String(err));
+        this.logger.error(`[book_request.verify] [fail] dockFileId=${fileId} error="${message}" - verification handler failed`);
+      });
+    });
+  }
+
+  private async handleIngested(fileId: number): Promise<void> {
+    // Every dock ingest fires this. Rows nobody requested are not ours and ride the generic path.
+    const download = await this.downloads.findByBookDockFileId(fileId);
+    if (!download || download.status !== 'importing') return;
+
+    const joined = await this.requests.findById(download.requestId);
+    if (!joined) {
+      await this.fulfillment.failDownload(download, 'The request this download belongs to no longer exists');
+      return;
+    }
+
+    const row = await this.dockRepo.findById(fileId);
+    if (!row) {
+      await this.fulfillment.failDownload(download, 'The Book Dock entry for this download disappeared');
+      return;
+    }
+
+    const { verificationEnabled, verificationThreshold } = await this.settings.get();
+    // Off means the operator has chosen to trust the grab: the import goes straight into the
+    // target library without waiting on a score, and nothing is ever held for a human to look at.
+    if (!verificationEnabled) {
+      this.logger.log(
+        `[book_request.verify] [end] requestId=${joined.request.id} dockFileId=${fileId} enabled=false - verification is off, filing the import as grabbed`,
+      );
+      await this.finalize(download, joined.request, fileId);
+      return;
+    }
+
+    const outcome = verifyAgainstRequest(joined.request, row.fetchedMetadata, row.embeddedMetadata, verificationThreshold, unitTitleFallback(row));
+    this.logger.log(
+      `[book_request.verify] [end] requestId=${joined.request.id} dockFileId=${fileId} score=${outcome.score} passed=${outcome.passed} - ${outcome.reason}`,
+    );
+
+    if (!outcome.passed) {
+      await this.holdForReview(download, joined.request, outcome);
+      return;
+    }
+
+    await this.finalize(download, joined.request, fileId);
+  }
+
+  private async finalize(download: BookRequestDownloadRow, request: BookRequestRow, fileId: number): Promise<void> {
+    const filed = await this.fileIntoLibrary(download, request, fileId);
+    if (!filed.ok) await this.fulfillment.holdForReview(download, request, filed.reason);
+  }
+
+  /**
+   * The filing step with no opinion on what a failure means. The automatic path turns a failure
+   * into another hold; an approver who force-filed one wants the message thrown back at them
+   * instead, and neither should have to reimplement the half that works.
+   */
+  private async fileIntoLibrary(
+    download: BookRequestDownloadRow,
+    request: BookRequestRow,
+    fileId: number,
+  ): Promise<{ ok: true; bookId: number | null } | { ok: false; reason: string }> {
+    // A request with no folder still has a library; take its first folder rather than falling
+    // through to the Book Dock's global default, which is usually unset and never the point here.
+    const folderId = request.targetFolderId ?? (await this.resolveFolder(request.targetLibraryId));
+    if (folderId === null) return { ok: false, reason: 'the destination library has no folder to file the book into' };
+
+    const result = await this.finalizeService.finalizeManagedFile(fileId, {
+      libraryId: request.targetLibraryId ?? undefined,
+      folderId,
+    });
+    if (!result.success) return { ok: false, reason: result.message ?? 'the Book Dock could not file this book' };
+
+    // Conditional, like every other write in the pipeline. Scoring an import and handing it to the
+    // Book Dock takes long enough for somebody to cancel the request underneath it, and an
+    // unconditional `available` here would undo their decision and tell the requester their book
+    // had arrived. The file is already placed by this point, which is why the refusal is logged
+    // rather than swallowed: the library has a book the request no longer claims.
+    const filed = await this.requests.updateIf(request.id, FILEABLE_FROM, {
+      status: 'available',
+      matchedBookId: result.bookId ?? null,
+      bookDockFileId: null,
+      statusReason: null,
+    });
+    if (!filed) {
+      // The bytes did become a book, so the attempt is settled either way rather than left for the
+      // resume sweep to offer up again every fifteen seconds.
+      await this.downloads.updateIf(download.id, UNSETTLED_BOOK_REQUEST_DOWNLOAD_STATUSES, { status: 'imported', importedAt: new Date() });
+      this.logger.warn(
+        `[book_request.verify] [fail] requestId=${request.id} downloadId=${download.id} dockFileId=${fileId} bookId=${result.bookId ?? 'none'} - the request was settled while this import was being filed, so the book was filed but the request was left alone`,
+      );
+      this.gateway.emitChanged();
+      return { ok: false, reason: 'the request was settled while this import was being filed' };
+    }
+
+    if (!(await this.downloads.updateIf(download.id, UNSETTLED_BOOK_REQUEST_DOWNLOAD_STATUSES, { status: 'imported', importedAt: new Date() }))) {
+      this.logger.warn(
+        `[book_request.verify] [fail] requestId=${request.id} downloadId=${download.id} - the attempt was settled while its import was being filed, so it keeps the outcome it reached`,
+      );
+    }
+
+    await this.notifier.notifyBookAvailable(request.id, result.bookId ?? null, {
+      title: 'Your requested book is available',
+      message: `"${request.title}" is ready`,
+      meta: { requestId: request.id, bookId: result.bookId ?? null },
+    });
+    this.gateway.emitChanged();
+
+    return { ok: true, bookId: result.bookId ?? null };
+  }
+
+  /**
+   * What the drawer shows an approver about a held import: the files that actually landed, and
+   * the field-by-field comparison behind the score.
+   *
+   * The score is recomputed rather than replayed from the hold, so an approver who corrects the
+   * metadata in the Book Dock and comes back sees the corrected number instead of the stale one
+   * that sent them there.
+   */
+  async getReview(requestId: number): Promise<BookRequestReview> {
+    const { request, fileId } = await this.loadHeld(requestId);
+
+    const row = fileId === null ? undefined : await this.dockRepo.findById(fileId);
+    const canFile = (request.targetFolderId ?? (await this.resolveFolder(request.targetLibraryId))) !== null;
+
+    // Filing or discarding the entry by hand empties both pointers to it, which leaves the request
+    // held over a file that is not there any more. Saying so is the only useful thing left.
+    if (!row) {
+      return { requestId, bookDockFileId: null, verification: null, files: [], totalSizeBytes: null, canFile: false };
+    }
+
+    const [unitFiles, settings] = await Promise.all([
+      row.unitDirectory ? this.dockRepo.findUnitFiles(row.id) : Promise.resolve([]),
+      this.settings.get(),
+    ]);
+
+    // A loose single file has no unit rows, and the anchor already describes it completely.
+    const files: BookRequestReviewFile[] = unitFiles.length
+      ? unitFiles.map((file) => ({
+          fileName: file.fileName,
+          fileSize: file.fileSize === null ? null : Number(file.fileSize),
+          format: file.format,
+          role: file.role as BookRequestReviewFile['role'],
+        }))
+      : [{ fileName: row.fileName, fileSize: row.fileSize === null ? null : Number(row.fileSize), format: row.format, role: 'content' }];
+
+    const sized = files.filter((file) => file.fileSize !== null);
+    const outcome = settings.verificationEnabled
+      ? verifyAgainstRequest(request, row.fetchedMetadata, row.embeddedMetadata, settings.verificationThreshold, unitTitleFallback(row))
+      : null;
+
+    return {
+      requestId,
+      bookDockFileId: row.id,
+      verification: outcome
+        ? {
+            score: outcome.score,
+            threshold: settings.verificationThreshold,
+            passed: outcome.passed,
+            reason: outcome.code,
+            rows: outcome.rows,
+          }
+        : null,
+      files,
+      totalSizeBytes: sized.length ? sized.reduce((total, file) => total + (file.fileSize ?? 0), 0) : null,
+      canFile,
+    };
+  }
+
+  /**
+   * An approver has looked at a held import and decided it is the right book anyway. Runs exactly
+   * the filing a passing score would have run. The score is not rewritten on the way through: it
+   * was right about what it measured, and this is a human overruling it rather than correcting it.
+   */
+  async fileHeldImport(requestId: number, user: RequestUser): Promise<void> {
+    const { request, download, fileId } = await this.loadHeld(requestId);
+    if (fileId === null || download === null) {
+      throw new BadRequestException('The Book Dock entry this request was held over is gone, so there is nothing left to file');
+    }
+
+    const filed = await this.fileIntoLibrary(download, request, fileId);
+    if (!filed.ok) {
+      this.logger.warn(
+        `[book_request.force_file] [fail] requestId=${requestId} dockFileId=${fileId} userId=${user.id} error="${sanitizeLogValue(filed.reason)}" - approver could not file the held import`,
+      );
+      throw new BadRequestException(`This import could not be filed: ${filed.reason}`);
+    }
+
+    this.logger.log(
+      `[book_request.force_file] [end] requestId=${requestId} dockFileId=${fileId} bookId=${filed.bookId ?? 'none'} userId=${user.id} - approver filed a held import`,
+    );
+  }
+
+  /**
+   * The other answer to a held import: this is the wrong book, so throw it away.
+   *
+   * Filing needs a destination and Book Dock permissions the fulfiller may not hold, and until now
+   * the only alternative was cancelling the request, which left the dock entry behind as an orphan
+   * nobody would ever connect back to a request. Discarding removes the entry through the dock's
+   * own primitive, so the staged files are cleaned up exactly as a hand discard cleans them up,
+   * and fails the request so it stops claiming a person's attention.
+   *
+   * The torrent is deliberately untouched. Removing a seed is its own explicit action with its own
+   * confirmation, and a discard is a statement about the import rather than about the transfer.
+   */
+  async discardHeldImport(requestId: number, user: RequestUser): Promise<void> {
+    const { request, download, fileId } = await this.loadHeld(requestId);
+    const reason = 'The imported file was discarded during review';
+    const startedAt = Date.now();
+
+    const claimed = await this.requests.updateIf(requestId, ['needs_review'], {
+      status: 'failed',
+      statusReason: reason,
+      failureCode: null,
+      failureMeta: null,
+    });
+    if (!claimed) {
+      throw new BadRequestException('This request is no longer waiting for review');
+    }
+
+    const claimedDownload = download
+      ? await this.downloads.updateIf(download.id, ['needs_review'], { status: 'failed', errorMessage: reason })
+      : undefined;
+    if (download && !claimedDownload) {
+      await this.requests.updateIf(requestId, ['failed'], {
+        status: 'needs_review',
+        statusReason: request.statusReason,
+        failureCode: request.failureCode,
+        failureMeta: request.failureMeta,
+      });
+      throw new BadRequestException('This import is no longer waiting for review');
+    }
+
+    try {
+      if (fileId !== null) {
+        // The request route already authorized this destructive action. Passing the dock's
+        // all-files scope is what lets a moderator or self-fulfiller clean up an import uploaded
+        // by the pipeline even when they do not separately hold ManageBookDock.
+        await this.dock.discardFile(fileId, user.id, true);
+      }
+    } catch (error) {
+      if (error instanceof NotFoundException) {
+        // A person may have discarded the dock row directly after this request was loaded. The
+        // desired filesystem outcome already holds, and the foreign keys have cleared themselves.
+      } else {
+        await Promise.allSettled([
+          this.requests.updateIf(requestId, ['failed'], {
+            status: 'needs_review',
+            statusReason: request.statusReason,
+            failureCode: request.failureCode,
+            failureMeta: request.failureMeta,
+          }),
+          download && claimedDownload
+            ? this.downloads.updateIf(download.id, ['failed'], { status: 'needs_review', errorMessage: download.errorMessage })
+            : Promise.resolve(),
+        ]);
+        const message = error instanceof Error ? error.message : String(error);
+        this.logger.error(
+          `[book_request.discard_import] [fail] requestId=${requestId} dockFileId=${fileId ?? 'none'} downloadId=${download?.id ?? 'none'} userId=${user.id} durationMs=${Date.now() - startedAt} errorClass=${error instanceof Error ? error.constructor.name : typeof error} error="${sanitizeLogValue(message)}" - a held import could not be discarded`,
+        );
+        if (error instanceof HttpException) throw error;
+        throw new InternalServerErrorException('The held import could not be discarded');
+      }
+    }
+
+    this.logger.log(
+      `[book_request.discard_import] [end] requestId=${requestId} dockFileId=${fileId ?? 'none'} downloadId=${download?.id ?? 'none'} userId=${user.id} durationMs=${Date.now() - startedAt} title="${sanitizeLogValue(request.title)}" - a held import was discarded`,
+    );
+    await this.notifier.notifyResponsible(request, NotificationType.BookRequestFailed, {
+      title: 'Book request import discarded',
+      message: `"${request.title}": ${reason}`,
+      actionUrl: '/requests',
+      meta: { requestId, downloadId: download?.id ?? null, dockFileId: fileId },
+    });
+    this.gateway.emitChanged();
+  }
+
+  /**
+   * The one place that decides a request is genuinely sitting in the dock waiting on a person.
+   *
+   * The dock file is looked up through the request first and the attempt second, and may still
+   * come back null: both columns reference `book_dock_files` with `on delete set null`, so filing
+   * or discarding the entry by hand empties them together and the hold outlives its file.
+   */
+  private async loadHeld(requestId: number): Promise<{ request: BookRequestRow; download: BookRequestDownloadRow | null; fileId: number | null }> {
+    const joined = await this.requests.findById(requestId);
+    if (!joined) throw new NotFoundException('Book request not found');
+    if (joined.request.status !== 'needs_review') throw new BadRequestException('This request is not waiting for review');
+
+    const latest = await this.downloads.findLatestForRequests([requestId]);
+    const download = latest.get(requestId)?.download ?? null;
+
+    return { request: joined.request, download, fileId: joined.request.bookDockFileId ?? download?.bookDockFileId ?? null };
+  }
+
+  /** The file stays in the dock, so an approver can look at it and file it by hand. */
+  private async holdForReview(download: BookRequestDownloadRow, request: BookRequestRow, outcome: VerificationOutcome): Promise<void> {
+    await this.fulfillment.holdForReview(download, request, outcome.reason);
+  }
+
+  private async resolveFolder(libraryId: number | null): Promise<number | null> {
+    if (libraryId === null) return null;
+    return this.requests.findFirstFolderId(libraryId);
+  }
+}
+
+/**
+ * ISBN13 agreement is decisive when both sides carry one. A mismatch is not, because a different
+ * edition of the same work has a different ISBN and is still the right book, so it falls through
+ * to the title and author comparison rather than failing outright.
+ *
+ * Every path returns the field-by-field comparison as well as the number, because a bare score is
+ * unactionable: an approver deciding whether to file this anyway needs to see that the title
+ * gained a "Book 1 (Unabridged)" suffix, not that something somewhere came to 65.
+ */
+export function verifyAgainstRequest(
+  request: Pick<BookRequestRow, 'title' | 'subtitle' | 'authors' | 'isbn13'>,
+  fetched: BookDockMetadata | null,
+  embedded: BookDockMetadata | null,
+  threshold: number = DEFAULT_VERIFICATION_THRESHOLD,
+  titleFallback: string | null = null,
+): VerificationOutcome {
+  const extractedTitle = fetched?.title?.trim() || embedded?.title?.trim() || '';
+  // A track title is not a book title. The audio extractor already prefers the `album` tag, so
+  // this catches only the release that carries no album at all, where `title` is "Chapter 3" and
+  // would score near zero against the request no matter how right the book is.
+  const importedTitle = titleFallback !== null && (!extractedTitle || isChapterLikeTitle(extractedTitle)) ? titleFallback : extractedTitle;
+  const importedAuthors = (fetched?.authors?.length ? fetched.authors : (embedded?.authors ?? [])).filter(Boolean);
+  const importedIsbn = normalizeMetadataIsbn(fetched?.isbn13 ?? embedded?.isbn13 ?? null);
+  const requestedIsbn = normalizeMetadataIsbn(request.isbn13);
+  const requestedAuthors = (request.authors ?? []).filter(Boolean);
+
+  const titleScore = importedTitle ? bestTitleSimilarity(request.title, request.subtitle, importedTitle) : 0;
+  const authorScore = requestedAuthors.length && importedAuthors.length ? bestPairSimilarity(requestedAuthors, importedAuthors) : null;
+
+  const rows = (isbnVerdict: BookRequestVerificationVerdict): BookRequestVerificationRow[] => [
+    {
+      field: 'title',
+      requested: joinTitle(request.title, request.subtitle),
+      imported: importedTitle || null,
+      verdict: importedTitle ? verdictFor(titleScore) : 'unknown',
+    },
+    {
+      field: 'authors',
+      requested: requestedAuthors.length ? requestedAuthors.join(', ') : null,
+      imported: importedAuthors.length ? importedAuthors.join(', ') : null,
+      verdict: authorScore === null ? 'unknown' : verdictFor(authorScore),
+    },
+    // The normalizer answers '' rather than null for a missing ISBN, and an empty row would
+    // read as a blank value rather than as a field neither side filled in.
+    { field: 'isbn13', requested: requestedIsbn || null, imported: importedIsbn || null, verdict: isbnVerdict },
+  ];
+
+  if (requestedIsbn && importedIsbn && requestedIsbn === importedIsbn) {
+    return { score: 100, passed: true, reason: 'ISBN13 matches the requested edition exactly', code: 'isbn_match', rows: rows('match') };
+  }
+
+  const isbnVerdict: BookRequestVerificationVerdict = requestedIsbn && importedIsbn ? 'mismatch' : 'unknown';
+
+  if (!importedTitle) {
+    return { score: 0, passed: false, reason: 'the imported file has no readable title to compare', code: 'no_title', rows: rows(isbnVerdict) };
+  }
+
+  // Both sides named an author and they have nothing in common. A right-title wrong-author file
+  // is the "three different books called It" case, and no title score should carry it through.
+  if (authorScore === 0) {
+    return {
+      score: Math.round(titleScore * TITLE_WEIGHT * 100),
+      passed: false,
+      reason: `imported "${importedTitle}" is by ${importedAuthors.join(', ')}, not ${requestedAuthors.join(', ')}`,
+      code: 'author_mismatch',
+      rows: rows(isbnVerdict),
+    };
+  }
+
+  const combined = authorScore === null ? titleScore : titleScore * TITLE_WEIGHT + authorScore * AUTHOR_WEIGHT;
+  const score = Math.round(combined * 100);
+  const passed = score >= threshold;
+
+  return {
+    score,
+    passed,
+    reason: passed
+      ? `imported "${importedTitle}" scored ${score} against the request`
+      : `imported "${importedTitle}" scored ${score}, below the ${threshold} needed to file it automatically`,
+    code: passed ? 'above_threshold' : 'below_threshold',
+    rows: rows(isbnVerdict),
+  };
+}
+
+/**
+ * The bar a single field has to clear to read as agreement. Deliberately looser than exact: a
+ * subtitle the request omitted, or "Herbert, Frank" against "Frank Herbert", is the same book by
+ * the same person and marking either one red would send approvers looking for a problem.
+ */
+const FIELD_MATCH_SIMILARITY = 0.9;
+
+function verdictFor(similarity: number): BookRequestVerificationVerdict {
+  return similarity >= FIELD_MATCH_SIMILARITY ? 'match' : 'mismatch';
+}
+
+function joinTitle(title: string, subtitle: string | null): string {
+  return subtitle?.trim() ? `${title}: ${subtitle.trim()}` : title;
+}
+
+/**
+ * The unit's own directory name, which is what a release names after the book. Only offered for a
+ * multi-file unit: a loose single file has no directory that means anything.
+ */
+function unitTitleFallback(row: { unitDirectory: string | null }): string | null {
+  if (!row.unitDirectory) return null;
+  const name = basename(row.unitDirectory)
+    .replace(/^request-\d+-/, '')
+    .replace(/[\s._-]+/g, ' ')
+    .trim();
+  return name || null;
+}
+
+const CHAPTER_LIKE_TITLE = /^(?:chapter|track|part|disc|cd|section|episode)[\s._-]*\d*$/i;
+
+function isChapterLikeTitle(title: string): boolean {
+  return CHAPTER_LIKE_TITLE.test(title.trim());
+}
+
+/**
+ * Compares both full titles and both main titles, so an imported edition that carries a subtitle
+ * the request did not still matches, while a sequel that merely extends the title does not.
+ */
+function bestTitleSimilarity(requestTitle: string, requestSubtitle: string | null, importedTitle: string): number {
+  const requested = [requestTitle, requestSubtitle ? `${requestTitle} ${requestSubtitle}` : null, mainTitlePart(requestTitle)].filter(
+    (value): value is string => Boolean(value),
+  );
+  const imported = [importedTitle, mainTitlePart(importedTitle)];
+  return bestPairSimilarity(requested, imported);
+}
+
+function bestPairSimilarity(left: string[], right: string[]): number {
+  let best = 0;
+  for (const a of left) {
+    for (const b of right) {
+      best = Math.max(best, symmetricTitleSimilarity(a, b));
+      if (best === 1) return best;
+    }
+  }
+  return best;
+}
diff --git a/server/src/modules/book-request/fulfillment/request-watchdog.service.test.ts b/server/src/modules/book-request/fulfillment/request-watchdog.service.test.ts
new file mode 100644
index 000000000..0f26b944f
--- /dev/null
+++ b/server/src/modules/book-request/fulfillment/request-watchdog.service.test.ts
@@ -0,0 +1,238 @@
+import type { BookRequestDownloadRow } from '../../../db/schema';
+import { RequestWatchdogService } from './request-watchdog.service';
+
+function makeService(
+  byStatus: Record<string, BookRequestDownloadRow[]> = {},
+  abandoned: Array<{ id: number; userId: number }> = [],
+  stranded: Array<{ id: number }> = [],
+) {
+  const downloads = {
+    findByStatusOlderThan: vi.fn().mockImplementation((statuses: string[]) => Promise.resolve(byStatus[statuses.join(',')] ?? [])),
+    findLiveDirectHashes: vi.fn().mockResolvedValue([]),
+    findActiveDirect: vi.fn().mockResolvedValue([]),
+  };
+  const fulfillment = { failDownload: vi.fn().mockResolvedValue(undefined) };
+  const requests = {
+    findAbandonedSelfServe: vi.fn().mockResolvedValue(abandoned),
+    cancelAbandoned: vi.fn().mockResolvedValue(true),
+    dismiss: vi.fn().mockResolvedValue(undefined),
+    // One batch, then nothing: the sweep loops until a short batch comes back.
+    findStrandedSearching: vi.fn().mockResolvedValueOnce(stranded).mockResolvedValue([]),
+    updateIf: vi.fn().mockResolvedValue({ id: 1 }),
+  };
+  const gateway = { emitChanged: vi.fn() };
+  const auditEvents = { emit: vi.fn() };
+  const direct = { reapStaging: vi.fn().mockResolvedValue(0), resume: vi.fn().mockResolvedValue(true) };
+
+  return {
+    service: new RequestWatchdogService(
+      downloads as never,
+      fulfillment as never,
+      requests as never,
+      gateway as never,
+      auditEvents as never,
+      direct as never,
+    ),
+    downloads,
+    fulfillment,
+    requests,
+    gateway,
+    auditEvents,
+    direct,
+  };
+}
+
+describe('RequestWatchdogService.sweep', () => {
+  it('measures a stalled download from the last time bytes moved', async () => {
+    const { service, downloads } = makeService();
+    await service.sweep();
+
+    expect(downloads.findByStatusOlderThan).toHaveBeenCalledWith(['queued', 'downloading'], expect.any(Date), 'progress');
+  });
+
+  /**
+   * An import's `lastProgressAt` belongs to the download that already finished, so measuring the
+   * import from it would make every import look ancient the moment it started.
+   */
+  it('measures a stuck import from its last state change instead', async () => {
+    const { service, downloads } = makeService();
+    await service.sweep();
+
+    expect(downloads.findByStatusOlderThan).toHaveBeenCalledWith(['completed', 'importing'], expect.any(Date), 'state-change');
+  });
+
+  it('never sweeps a row held for human review', async () => {
+    const { service, downloads } = makeService();
+    await service.sweep();
+
+    for (const call of downloads.findByStatusOlderThan.mock.calls) {
+      expect(call[0]).not.toContain('needs_review');
+    }
+  });
+
+  it('fails every row it finds, with a reason that says what happened', async () => {
+    const { service, fulfillment } = makeService({
+      'queued,downloading': [{ id: 11 } as BookRequestDownloadRow, { id: 12 } as BookRequestDownloadRow],
+      'completed,importing': [{ id: 13 } as BookRequestDownloadRow],
+    });
+
+    await service.sweep();
+
+    expect(fulfillment.failDownload).toHaveBeenCalledTimes(3);
+    expect(fulfillment.failDownload).toHaveBeenCalledWith({ id: 11 }, 'The download made no progress for 12 hours');
+    expect(fulfillment.failDownload).toHaveBeenCalledWith({ id: 13 }, 'The import did not finish within an hour');
+  });
+
+  it('swallows a sweep failure rather than crashing the scheduler', async () => {
+    const { service } = makeService();
+    const downloads = { findByStatusOlderThan: vi.fn().mockRejectedValue(new Error('db down')) };
+    const broken = new RequestWatchdogService(downloads as never, { failDownload: vi.fn() } as never);
+
+    await expect(broken.sweep()).resolves.toBeUndefined();
+    await expect(service.sweep()).resolves.toBeUndefined();
+  });
+});
+
+/**
+ * `searching` is claimed by a fire-and-forget task that lives only in this process, so nothing
+ * outside that task ever clears it: a restart or a throw its handler cannot reach leaves the
+ * status without the work, holding the dedupe claim on that book forever.
+ */
+describe('RequestWatchdogService stranded searches', () => {
+  it('returns a request nothing is searching for to approved, so an approver can pick a release', async () => {
+    const { service, requests, gateway } = makeService({}, [], [{ id: 7 }]);
+
+    await service.sweep();
+
+    expect(requests.updateIf).toHaveBeenCalledWith(7, ['searching'], { status: 'approved' });
+    expect(gateway.emitChanged).toHaveBeenCalled();
+  });
+
+  /** Minutes at its very worst, so half an hour is an accident rather than a slow tracker. */
+  it('gives a running search half an hour before treating it as stranded', async () => {
+    const { service, requests } = makeService();
+    const before = Date.now();
+
+    await service.sweep();
+
+    const [cutoff] = requests.findStrandedSearching.mock.calls[0] as [Date, number];
+    expect(cutoff.getTime()).toBeLessThanOrEqual(before - 30 * 60 * 1000);
+    expect(cutoff.getTime()).toBeGreaterThan(before - 31 * 60 * 1000);
+  });
+
+  /** No in-memory task survives a restart, so every one of these is stranded, however recent. */
+  it('reconciles every searching request at boot rather than waiting out the timeout', async () => {
+    const { service, requests } = makeService({}, [], [{ id: 7 }]);
+    const before = Date.now();
+
+    await service.onApplicationBootstrap();
+
+    const [cutoff] = requests.findStrandedSearching.mock.calls[0] as [Date, number];
+    expect(cutoff.getTime()).toBeGreaterThanOrEqual(before);
+    expect(requests.updateIf).toHaveBeenCalledWith(7, ['searching'], { status: 'approved' });
+  });
+
+  /** An automation pass that is genuinely still running keeps whatever it decides. */
+  it('leaves a row alone when the conditional write finds it already moved on', async () => {
+    const { service, requests, gateway } = makeService({}, [], [{ id: 7 }]);
+    requests.updateIf.mockResolvedValue(undefined);
+
+    await service.sweep();
+
+    expect(gateway.emitChanged).not.toHaveBeenCalled();
+  });
+});
+
+describe('RequestWatchdogService direct-download startup reconciliation', () => {
+  it('resumes every active direct attempt before reaping staging', async () => {
+    const row = { id: 11, source: 'direct_url', clientHash: 'aaa' } as BookRequestDownloadRow;
+    const { service, downloads, direct, fulfillment } = makeService();
+    downloads.findActiveDirect.mockResolvedValue([row]);
+
+    await service.onApplicationBootstrap();
+
+    expect(direct.resume).toHaveBeenCalledWith(row);
+    expect(direct.resume.mock.invocationCallOrder[0]).toBeLessThan(direct.reapStaging.mock.invocationCallOrder[0]);
+    expect(fulfillment.failDownload).not.toHaveBeenCalled();
+  });
+
+  it('fails an interrupted attempt immediately when it cannot be resumed safely', async () => {
+    const row = { id: 11, source: 'direct_url', clientHash: 'aaa' } as BookRequestDownloadRow;
+    const { service, downloads, direct, fulfillment } = makeService();
+    downloads.findActiveDirect.mockResolvedValue([row]);
+    direct.resume.mockResolvedValue(false);
+
+    await service.onApplicationBootstrap();
+
+    expect(fulfillment.failDownload).toHaveBeenCalledWith(row, 'The interrupted direct download could not be resumed safely');
+  });
+
+  it('reaps staging against the attempts that could still read it', async () => {
+    const { service, downloads, direct } = makeService();
+    downloads.findLiveDirectHashes.mockResolvedValue(['aaa', 'bbb']);
+
+    await service.onApplicationBootstrap();
+
+    expect(direct.reapStaging).toHaveBeenCalledWith(new Set(['aaa', 'bbb']));
+  });
+
+  /** Neither reconciliation is worth refusing to start over. */
+  it('starts anyway when a startup reconciliation fails', async () => {
+    const { service, downloads, requests } = makeService();
+    // Reset first: the harness queues a one-shot batch that would be consumed before the rejection.
+    requests.findStrandedSearching.mockReset().mockRejectedValue(new Error('db down'));
+    downloads.findLiveDirectHashes.mockRejectedValue(new Error('db down'));
+
+    await expect(service.onApplicationBootstrap()).resolves.toBeUndefined();
+  });
+});
+
+describe('RequestWatchdogService abandoned self-serve sweep', () => {
+  /**
+   * The failure mode creating the row up front introduces: a live request holds the dedupe claim
+   * on its work, so an abandoned one silently subscribes the next asker to a request nobody drives.
+   */
+  it('cancels a self-serve request nobody picked a release for, and hides it from its owner', async () => {
+    const { service, requests, gateway } = makeService({}, [{ id: 7, userId: 3 }]);
+
+    await service.sweep();
+
+    expect(requests.findAbandonedSelfServe).toHaveBeenCalledWith(expect.any(Date), 50);
+    expect(requests.cancelAbandoned).toHaveBeenCalledWith(7, expect.stringContaining('No release was picked'), 'ABANDONED');
+    expect(requests.dismiss).toHaveBeenCalledWith(7, 3);
+    expect(gateway.emitChanged).toHaveBeenCalled();
+  });
+
+  /** A cron never reaches the audit interceptor, so the record has to be emitted by hand. */
+  it('records the cancellation in the audit log', async () => {
+    const { service, auditEvents } = makeService({}, [{ id: 7, userId: 3 }]);
+
+    await service.sweep();
+
+    expect(auditEvents.emit).toHaveBeenCalledWith(
+      'audit.log',
+      expect.objectContaining({ resourceId: 7, actorUsername: 'system', meta: { requestId: 7, ownerId: 3 } }),
+    );
+  });
+
+  /** Somebody grabbing between the read and the write wins; the sweep is not allowed to overrule it. */
+  it('leaves a row alone when the conditional cancel finds it already moved on', async () => {
+    const { service, requests, gateway, auditEvents } = makeService({}, [{ id: 7, userId: 3 }]);
+    requests.cancelAbandoned.mockResolvedValue(false);
+
+    await service.sweep();
+
+    expect(requests.dismiss).not.toHaveBeenCalled();
+    expect(auditEvents.emit).not.toHaveBeenCalled();
+    expect(gateway.emitChanged).not.toHaveBeenCalled();
+  });
+
+  it('does not touch the gateway when there is nothing to sweep', async () => {
+    const { service, requests, gateway } = makeService();
+
+    await service.sweep();
+
+    expect(requests.cancelAbandoned).not.toHaveBeenCalled();
+    expect(gateway.emitChanged).not.toHaveBeenCalled();
+  });
+});
diff --git a/server/src/modules/book-request/fulfillment/request-watchdog.service.ts b/server/src/modules/book-request/fulfillment/request-watchdog.service.ts
new file mode 100644
index 000000000..492bc56dc
--- /dev/null
+++ b/server/src/modules/book-request/fulfillment/request-watchdog.service.ts
@@ -0,0 +1,246 @@
+import { Injectable, Logger, OnApplicationBootstrap } from '@nestjs/common';
+import { Cron, CronExpression } from '@nestjs/schedule';
+import { AuditAction, AuditResource } from '@bookorbit/types';
+import type { BookRequestDownloadStatus, BookRequestStatus } from '@bookorbit/types';
+
+import { sanitizeLogValue } from '../../../common/utils/log-sanitize.utils';
+import { AUDIT_EVENT, AuditEventsService } from '../../audit/audit-events.service';
+import { BookRequestGateway } from '../book-request.gateway';
+import { BookRequestRepository } from '../book-request.repository';
+import { BookRequestDownloadRepository } from './book-request-download.repository';
+import { DirectDownloadService } from './direct-download.service';
+import { RequestFulfillmentService } from './request-fulfillment.service';
+
+/**
+ * A torrent with no seeders can sit at zero for a long time and still be worth waiting for, so
+ * these are generous. They exist to stop a request sitting at "downloading" forever with nobody
+ * told, not to enforce a service level.
+ */
+const STALL_TIMEOUT_MS = 12 * 60 * 60 * 1000;
+/** Import is local filesystem work plus a metadata fetch. An hour is already pathological. */
+const IMPORT_TIMEOUT_MS = 60 * 60 * 1000;
+
+/**
+ * How long a self-serve request may sit with no release picked before it is swept.
+ *
+ * Long on purpose. Nothing marks a row as "the picker is open on it", so a short window would
+ * cancel a request somebody is still reading through, and the cost of waiting is only that one
+ * work stays claimed for the afternoon. Short enough that an abandoned search is gone the same day.
+ */
+const ABANDONED_SELF_SERVE_MS = 6 * 60 * 60 * 1000;
+
+/** One sweep's worth. A backlog is worked off over several runs rather than in one long one. */
+const ABANDONED_SWEEP_LIMIT = 50;
+
+/**
+ * How long a request may sit at `searching` before nothing is plausibly still searching for it.
+ *
+ * An automation pass is four search variants with a second or two between them, plus whatever
+ * every enabled indexer takes to answer or time out, so it is minutes at its very worst. Half an
+ * hour is far enough past that to be an accident rather than a slow tracker.
+ */
+const SEARCH_TIMEOUT_MS = 30 * 60 * 1000;
+
+const STRANDED_SEARCH_SWEEP_LIMIT = 50;
+/** A backstop, not a budget: rows a conditional write keeps refusing must not loop forever. */
+const STRANDED_SEARCH_SWEEP_ROUNDS = 20;
+
+const STALLABLE: BookRequestDownloadStatus[] = ['queued', 'downloading'];
+const IMPORT_STUCK: BookRequestDownloadStatus[] = ['completed', 'importing'];
+const SEARCHING_ONLY: readonly BookRequestStatus[] = ['searching'];
+
+@Injectable()
+export class RequestWatchdogService implements OnApplicationBootstrap {
+  private readonly logger = new Logger(RequestWatchdogService.name);
+
+  constructor(
+    private readonly downloads: BookRequestDownloadRepository,
+    private readonly fulfillment: RequestFulfillmentService,
+    private readonly requests: BookRequestRepository,
+    private readonly gateway: BookRequestGateway,
+    private readonly auditEvents: AuditEventsService,
+    private readonly direct: DirectDownloadService,
+  ) {}
+
+  /**
+   * What the last process left behind. Both of these are in-memory state that a restart destroys
+   * while its record on disk or in the database survives, so nothing else will ever look at them
+   * again: no cutoff applies, because there is no version of "still working on it" here.
+   *
+   * Swallowed rather than thrown. Neither is worth refusing to start over.
+   */
+  async onApplicationBootstrap(): Promise<void> {
+    try {
+      await this.releaseStrandedSearches(new Date(), 'restart');
+    } catch (error) {
+      this.logFailure('stranded_search', error);
+    }
+
+    try {
+      await this.resumeInterruptedDirectDownloads();
+    } catch (error) {
+      this.logFailure('direct_resume', error);
+    }
+
+    try {
+      await this.reapStagedDownloads();
+    } catch (error) {
+      this.logFailure('staging_reap', error);
+    }
+  }
+
+  private async resumeInterruptedDirectDownloads(): Promise<void> {
+    const rows = await this.downloads.findActiveDirect();
+    for (const row of rows) {
+      try {
+        if (await this.direct.resume(row)) continue;
+        await this.fulfillment.failDownload(row, 'The interrupted direct download could not be resumed safely');
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        await this.fulfillment.failDownload(row, `The interrupted direct download could not be resumed: ${message}`);
+      }
+    }
+  }
+
+  /**
+   * Every sweep here reads a batch of rows and then acts on each one in turn, so the last row is
+   * acted on against a read that is several round trips old. That is safe because each write is
+   * conditional at the repository: `failDownload` refuses an attempt or a request that settled in
+   * the meantime, and `cancelAbandoned` refuses a row somebody picked a release for.
+   */
+  @Cron(CronExpression.EVERY_10_MINUTES)
+  async sweep(): Promise<void> {
+    try {
+      await this.failStalled();
+      await this.failStuckImports();
+      await this.cancelAbandonedSelfServe();
+      await this.releaseStrandedSearches(new Date(Date.now() - SEARCH_TIMEOUT_MS), 'timeout');
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      this.logger.warn(`[book_request.watchdog] [fail] error="${sanitizeLogValue(message)}" - watchdog sweep failed`);
+    }
+  }
+
+  /**
+   * Returns requests nothing is searching for to `approved`, which is where an approver picks a
+   * release by hand.
+   *
+   * `searching` is claimed by a fire-and-forget automation task that lives only in this process.
+   * Nothing clears it from outside that task, so a restart or a throw its own handler cannot reach
+   * leaves the status behind without the work: the request holds the dedupe claim on its book
+   * forever, and everybody who asks for that book afterwards is quietly subscribed to it.
+   *
+   * The write is conditional on the row still being at `searching`, so an automation pass that is
+   * genuinely still running keeps whatever it decides; the worst the sweep can do to one is hand
+   * back a request the pass then grabs a release for anyway.
+   */
+  private async releaseStrandedSearches(cutoff: Date, cause: 'restart' | 'timeout'): Promise<void> {
+    let swept = 0;
+    let released = 0;
+
+    for (let round = 0; round < STRANDED_SEARCH_SWEEP_ROUNDS; round++) {
+      const rows = await this.requests.findStrandedSearching(cutoff, STRANDED_SEARCH_SWEEP_LIMIT);
+      if (rows.length === 0) break;
+      swept += rows.length;
+
+      for (const row of rows) {
+        if (await this.requests.updateIf(row.id, SEARCHING_ONLY, { status: 'approved' })) released++;
+      }
+      if (rows.length < STRANDED_SEARCH_SWEEP_LIMIT) break;
+    }
+
+    if (released === 0) return;
+    this.gateway.emitChanged();
+    this.logger.warn(
+      `[book_request.stranded_search] [end] cause=${cause} swept=${swept} released=${released} - returned requests nothing was searching for to approved`,
+    );
+  }
+
+  /**
+   * Staging directories with no attempt behind them any more.
+   *
+   * Direct-download progress lives in memory, so a transfer a restart interrupted leaves bytes
+   * nothing will poll, import or remove - and each failed URL stages under its own hash, so this
+   * accumulates rather than overwrites.
+   */
+  private async reapStagedDownloads(): Promise<void> {
+    const live = new Set(await this.downloads.findLiveDirectHashes());
+    const reaped = await this.direct.reapStaging(live);
+    if (reaped === 0) return;
+
+    this.logger.log(`[book_request.staging_reap] [end] live=${live.size} reaped=${reaped} - removed staging nothing was downloading any more`);
+  }
+
+  private logFailure(event: string, error: unknown): void {
+    const message = error instanceof Error ? error.message : String(error);
+    this.logger.warn(
+      `[book_request.${event}] [fail] errorClass=${(error as Error)?.constructor?.name ?? 'Error'} error="${sanitizeLogValue(message)}" - startup reconciliation failed`,
+    );
+  }
+
+  private async failStalled(): Promise<void> {
+    const rows = await this.downloads.findByStatusOlderThan(STALLABLE, new Date(Date.now() - STALL_TIMEOUT_MS), 'progress');
+    for (const row of rows) {
+      await this.fulfillment.failDownload(row, 'The download made no progress for 12 hours');
+    }
+  }
+
+  /**
+   * A self-serve request is created so the release search has a row to score against, and the
+   * person who created it may never pick anything. Left alone it holds the dedupe claim on that
+   * work, so the next person to ask for the same book is subscribed to a request nobody is
+   * driving - which is the one failure mode creating the row up front introduces.
+   *
+   * Cancelled rather than deleted: `cancelled` falls outside the partial unique index, so the
+   * claim is released, and the row stays as a record of what was searched for. Dismissed for its
+   * owner at the same time, because a cancelled search they abandoned is not news to them.
+   *
+   * Audited through the event bus rather than the usual decorator: this is a cron, and the audit
+   * interceptor only ever sees HTTP requests.
+   */
+  private async cancelAbandonedSelfServe(): Promise<void> {
+    const rows = await this.requests.findAbandonedSelfServe(new Date(Date.now() - ABANDONED_SELF_SERVE_MS), ABANDONED_SWEEP_LIMIT);
+    if (rows.length === 0) return;
+
+    let cancelled = 0;
+    for (const row of rows) {
+      // Conditional, so a release picked between the read and the write wins over the sweep.
+      if (!(await this.requests.cancelAbandoned(row.id, 'No release was picked, so this download was never started', 'ABANDONED'))) {
+        continue;
+      }
+      cancelled++;
+      await this.requests.dismiss(row.id, row.userId);
+
+      this.auditEvents.emit(AUDIT_EVENT, {
+        userId: null,
+        actorUsername: 'system',
+        action: AuditAction.BookRequestCancel,
+        resource: AuditResource.BookRequest,
+        resourceId: row.id,
+        description: 'Cancelled a self-serve book request nobody picked a release for',
+        meta: { requestId: row.id, ownerId: row.userId },
+      });
+    }
+
+    if (cancelled === 0) return;
+    this.gateway.emitChanged();
+    this.logger.log(
+      `[book_request.watchdog] [end] swept=${rows.length} cancelled=${cancelled} limit=${ABANDONED_SWEEP_LIMIT} - released the dedupe claim on abandoned self-serve requests`,
+    );
+  }
+
+  /**
+   * `needs_review` is deliberately not in this list: that download did complete and import, and a
+   * human is expected to take as long as they like over it.
+   *
+   * An import this process is still queueing or running is kept out by the monitor's heartbeat,
+   * which touches `updatedAt` for every member of the import queue once a minute. Without it, an
+   * import concurrency of one means queue depth alone ages a healthy row past the hour.
+   */
+  private async failStuckImports(): Promise<void> {
+    const rows = await this.downloads.findByStatusOlderThan(IMPORT_STUCK, new Date(Date.now() - IMPORT_TIMEOUT_MS), 'state-change');
+    for (const row of rows) {
+      await this.fulfillment.failDownload(row, 'The import did not finish within an hour');
+    }
+  }
+}
diff --git a/server/src/modules/book-request/fulfillment/torrent.utils.test.ts b/server/src/modules/book-request/fulfillment/torrent.utils.test.ts
new file mode 100644
index 000000000..840d52bac
--- /dev/null
+++ b/server/src/modules/book-request/fulfillment/torrent.utils.test.ts
@@ -0,0 +1,184 @@
+import { BadRequestException } from '@nestjs/common';
+import { createHash } from 'crypto';
+
+import { infoHashFromMagnet, magnetDisplayName, torrentMetadataFromFile } from './torrent.utils';
+
+const HEX_HASH = 'c9e15763f722f23e98a29decdfae341b98d53056';
+
+function bencodeString(value: string): Buffer {
+  return Buffer.from(`${Buffer.byteLength(value)}:${value}`, 'utf8');
+}
+
+/** A minimal single-file torrent: enough structure to exercise the span scanner. */
+function torrentFile(name = 'dune.epub'): { buffer: Buffer; expectedHash: string } {
+  const info = Buffer.concat([
+    Buffer.from('d', 'utf8'),
+    bencodeString('length'),
+    Buffer.from('i1234e', 'utf8'),
+    bencodeString('name'),
+    bencodeString(name),
+    bencodeString('piece length'),
+    Buffer.from('i16384e', 'utf8'),
+    bencodeString('pieces'),
+    Buffer.from('20:', 'utf8'),
+    Buffer.alloc(20, 7),
+    Buffer.from('e', 'utf8'),
+  ]);
+
+  const buffer = Buffer.concat([
+    Buffer.from('d', 'utf8'),
+    bencodeString('announce'),
+    bencodeString('https://tracker.example/announce'),
+    bencodeString('info'),
+    info,
+    Buffer.from('e', 'utf8'),
+  ]);
+
+  return { buffer, expectedHash: createHash('sha1').update(info).digest('hex') };
+}
+
+function bencodeFileEntry(length: number, name: string): Buffer {
+  return Buffer.concat([
+    Buffer.from('d', 'utf8'),
+    bencodeString('length'),
+    Buffer.from(`i${length}e`, 'utf8'),
+    bencodeString('path'),
+    Buffer.concat([Buffer.from('l', 'utf8'), ...name.split('/').map(bencodeString), Buffer.from('e', 'utf8')]),
+    Buffer.from('e', 'utf8'),
+  ]);
+}
+
+function wrapInfo(info: Buffer): Buffer {
+  return Buffer.concat([Buffer.from('d', 'utf8'), bencodeString('info'), info, Buffer.from('e', 'utf8')]);
+}
+
+function multiFileTorrent(): Buffer {
+  return wrapInfo(
+    Buffer.concat([
+      Buffer.from('d', 'utf8'),
+      bencodeString('files'),
+      Buffer.concat([Buffer.from('l', 'utf8'), bencodeFileEntry(500, 'one.epub'), bencodeFileEntry(400, 'two.epub'), Buffer.from('e', 'utf8')]),
+      bencodeString('name'),
+      bencodeString('release'),
+      Buffer.from('e', 'utf8'),
+    ]),
+  );
+}
+
+function sizelessTorrent(): Buffer {
+  return wrapInfo(Buffer.concat([Buffer.from('d', 'utf8'), bencodeString('name'), bencodeString('release'), Buffer.from('e', 'utf8')]));
+}
+
+describe('infoHashFromMagnet', () => {
+  it('reads a hex infohash and lowercases it', () => {
+    expect(infoHashFromMagnet(`magnet:?xt=urn:btih:${HEX_HASH.toUpperCase()}&dn=Dune`)).toBe(HEX_HASH);
+  });
+
+  it('converts a base32 infohash to hex', () => {
+    const base32 = 'ZHQVOY7XELZD5GFCTXWN7LRUDOMNKMCW';
+    expect(infoHashFromMagnet(`magnet:?xt=urn:btih:${base32}`)).toBe(HEX_HASH);
+  });
+
+  it('skips a non-btih xt and keeps looking', () => {
+    expect(infoHashFromMagnet(`magnet:?xt=urn:sha1:whatever&xt=urn:btih:${HEX_HASH}`)).toBe(HEX_HASH);
+  });
+
+  it('rejects a magnet with only a BitTorrent v2 hash, which qBittorrent would key differently', () => {
+    expect(() => infoHashFromMagnet('magnet:?xt=urn:btmh:1220caf1e1c30e81cb361b9ee167c4aa64228a7fa4fa9f6105232b28ad099f3a302e')).toThrow(
+      BadRequestException,
+    );
+  });
+
+  it('rejects something that is not a magnet at all', () => {
+    expect(() => infoHashFromMagnet('https://example.com/file.torrent')).toThrow(BadRequestException);
+  });
+});
+
+describe('magnetDisplayName', () => {
+  it('uses the display name when the magnet carries one', () => {
+    expect(magnetDisplayName(`magnet:?xt=urn:btih:${HEX_HASH}&dn=Dune+%28retail%29`, 'fallback')).toBe('Dune (retail)');
+  });
+
+  it('falls back when there is no display name', () => {
+    expect(magnetDisplayName(`magnet:?xt=urn:btih:${HEX_HASH}`, 'fallback')).toBe('fallback');
+  });
+});
+
+describe('torrentMetadataFromFile', () => {
+  it('hashes the raw info span rather than a re-encoded structure', () => {
+    const { buffer, expectedHash } = torrentFile();
+    expect(torrentMetadataFromFile(buffer)).toMatchObject({ infoHash: expectedHash, name: 'dune.epub', totalLength: 1234 });
+  });
+
+  /**
+   * The size of what the release carries, not the size of the .torrent describing it. A multi-file
+   * torrent states it only as a per-file list, so it has to be summed.
+   */
+  it('sums the file lengths of a multi-file torrent', () => {
+    expect(torrentMetadataFromFile(multiFileTorrent()).totalLength).toBe(900);
+  });
+
+  it('returns the bounded file manifest with the torrent root', () => {
+    expect(torrentMetadataFromFile(multiFileTorrent()).files).toEqual([
+      { path: 'release/one.epub', length: 500 },
+      { path: 'release/two.epub', length: 400 },
+    ]);
+  });
+
+  it('returns a single-file torrent as a one-entry manifest', () => {
+    expect(torrentMetadataFromFile(torrentFile().buffer).files).toEqual([{ path: 'dune.epub', length: 1234 }]);
+  });
+
+  it('rejects traversal in a manifest path', () => {
+    const torrent = wrapInfo(
+      Buffer.concat([
+        Buffer.from('d', 'utf8'),
+        bencodeString('files'),
+        Buffer.concat([Buffer.from('l', 'utf8'), bencodeFileEntry(500, '../dune.epub'), Buffer.from('e', 'utf8')]),
+        bencodeString('name'),
+        bencodeString('release'),
+        Buffer.from('e', 'utf8'),
+      ]),
+    );
+
+    expect(() => torrentMetadataFromFile(torrent)).toThrow(BadRequestException);
+  });
+
+  it('rejects control characters in a manifest path', () => {
+    const torrent = wrapInfo(
+      Buffer.concat([
+        Buffer.from('d', 'utf8'),
+        bencodeString('files'),
+        Buffer.concat([Buffer.from('l', 'utf8'), bencodeFileEntry(500, 'bad\nname.epub'), Buffer.from('e', 'utf8')]),
+        bencodeString('name'),
+        bencodeString('release'),
+        Buffer.from('e', 'utf8'),
+      ]),
+    );
+
+    expect(() => torrentMetadataFromFile(torrent)).toThrow(BadRequestException);
+  });
+
+  it('reports no size when the info dictionary states none', () => {
+    expect(torrentMetadataFromFile(sizelessTorrent()).totalLength).toBeNull();
+  });
+
+  it('is unaffected by binary piece data that contains dictionary markers', () => {
+    const { buffer, expectedHash } = torrentFile('e:de.epub');
+    expect(torrentMetadataFromFile(buffer).infoHash).toBe(expectedHash);
+  });
+
+  it('rejects a file that is not a bencoded dictionary', () => {
+    expect(() => torrentMetadataFromFile(Buffer.from('not a torrent'))).toThrow(BadRequestException);
+  });
+
+  it('rejects a dictionary with no info key', () => {
+    const buffer = Buffer.concat([Buffer.from('d'), bencodeString('announce'), bencodeString('https://x/a'), Buffer.from('e')]);
+    expect(() => torrentMetadataFromFile(buffer)).toThrow(BadRequestException);
+  });
+
+  it('rejects a truncated file rather than reading past the end', () => {
+    const { buffer } = torrentFile();
+    expect(() => torrentMetadataFromFile(buffer.subarray(0, buffer.length - 10))).toThrow(BadRequestException);
+  });
+});
diff --git a/server/src/modules/book-request/fulfillment/torrent.utils.ts b/server/src/modules/book-request/fulfillment/torrent.utils.ts
new file mode 100644
index 000000000..ccd75e910
--- /dev/null
+++ b/server/src/modules/book-request/fulfillment/torrent.utils.ts
@@ -0,0 +1,261 @@
+import { BadRequestException } from '@nestjs/common';
+import { MAX_TORRENT_FILE_BYTES } from '@bookorbit/types';
+import { createHash } from 'crypto';
+
+export { MAX_TORRENT_FILE_BYTES };
+
+const BASE32_ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
+const HEX_INFO_HASH = /^[0-9a-f]{40}$/i;
+const BASE32_INFO_HASH = /^[A-Z2-7]{32}$/i;
+const MAX_TORRENT_FILES = 2_000;
+const MAX_PATH_PARTS = 32;
+const MAX_PATH_PART_BYTES = 255;
+const MAX_BENCODE_DEPTH = 32;
+const MAX_BENCODE_VALUES = 20_000;
+
+export interface TorrentManifestEntry {
+  path: string;
+  length: number | null;
+}
+
+export interface TorrentFileMetadata {
+  infoHash: string;
+  name: string | null;
+  totalLength: number | null;
+  files: TorrentManifestEntry[];
+}
+
+/**
+ * qBittorrent's add endpoint answers "Ok." and nothing else, so the infohash has to come from the
+ * payload rather than from the client. Everything downstream keys on it: the poll loop, the
+ * partial unique index, and the eventual remove.
+ */
+export function infoHashFromMagnet(magnet: string): string {
+  const trimmed = magnet.trim();
+  if (!trimmed.toLowerCase().startsWith('magnet:?')) {
+    throw new BadRequestException('That is not a magnet link');
+  }
+
+  let params: URLSearchParams;
+  try {
+    params = new URL(trimmed).searchParams;
+  } catch {
+    throw new BadRequestException('That magnet link could not be parsed');
+  }
+
+  for (const xt of params.getAll('xt')) {
+    const value = xt.replace(/^urn:btih:/i, '');
+    if (value === xt) continue;
+    if (HEX_INFO_HASH.test(value)) return value.toLowerCase();
+    if (BASE32_INFO_HASH.test(value)) return base32ToHex(value.toUpperCase());
+  }
+
+  throw new BadRequestException('That magnet link has no BitTorrent v1 infohash');
+}
+
+export function magnetDisplayName(magnet: string, fallback: string): string {
+  try {
+    const name = new URL(magnet.trim()).searchParams.get('dn');
+    return name?.trim() || fallback;
+  } catch {
+    return fallback;
+  }
+}
+
+/**
+ * SHA-1 of the bencoded `info` value, taken as raw bytes out of the original buffer rather than
+ * re-encoded from a parsed structure: a round trip through JavaScript objects loses key order and
+ * would produce a hash no tracker recognises.
+ */
+export function torrentMetadataFromFile(buffer: Buffer): TorrentFileMetadata {
+  const reader = new BencodeReader(buffer);
+  const root = reader.readDictionaryEntries();
+
+  const info = root.get('info');
+  if (!info) throw new BadRequestException('That .torrent file has no info dictionary');
+
+  const infoHash = createHash('sha1').update(buffer.subarray(info.start, info.end)).digest('hex');
+
+  const infoEntries = new BencodeReader(buffer, info.start).readDictionaryEntries();
+  const nameEntry = infoEntries.get('name.utf-8') ?? infoEntries.get('name');
+  const name = nameEntry ? decodeBencodedString(buffer, nameEntry) : null;
+  const files = torrentManifestFiles(buffer, infoEntries, name);
+
+  return { infoHash, name, totalLength: totalContentLength(buffer, infoEntries, files), files };
+}
+
+/**
+ * The size of what the torrent carries, which is not the size of the torrent file. Single-file
+ * torrents carry `length`; multi-file ones carry a `files` list whose lengths sum to the same
+ * thing. Null when neither is readable, so a bad parse records nothing rather than a wrong number.
+ */
+function totalContentLength(buffer: Buffer, infoEntries: Map<string, ValueSpan>, files: TorrentManifestEntry[]): number | null {
+  const single = infoEntries.get('length');
+  if (single) return decodeBencodedInteger(buffer, single);
+
+  let total = 0;
+  let seen = false;
+  for (const file of files) {
+    if (file.length === null) continue;
+    total += file.length;
+    seen = true;
+  }
+  return seen ? total : null;
+}
+
+function torrentManifestFiles(buffer: Buffer, infoEntries: Map<string, ValueSpan>, rootName: string | null): TorrentManifestEntry[] {
+  const listEntry = infoEntries.get('files');
+  if (!listEntry) {
+    const lengthEntry = infoEntries.get('length');
+    if (!rootName) return [];
+    return [{ path: validatePathPart(rootName), length: lengthEntry ? decodeBencodedInteger(buffer, lengthEntry) : null }];
+  }
+
+  const entries = new BencodeReader(buffer, listEntry.start).readListEntries(MAX_TORRENT_FILES + 1);
+  if (entries.length > MAX_TORRENT_FILES) throw new BadRequestException(`That .torrent file lists more than ${MAX_TORRENT_FILES} files`);
+
+  const root = rootName ? validatePathPart(rootName) : null;
+  return entries.map((entry) => {
+    const fields = new BencodeReader(buffer, entry.start).readDictionaryEntries();
+    const pathEntry = fields.get('path.utf-8') ?? fields.get('path');
+    if (!pathEntry) throw new BadRequestException('That .torrent file has a file with no path');
+
+    const parts = new BencodeReader(buffer, pathEntry.start).readListEntries(MAX_PATH_PARTS + 1);
+    if (parts.length === 0) throw new BadRequestException('That .torrent file has an empty file path');
+    if (parts.length > MAX_PATH_PARTS) throw new BadRequestException('That .torrent file has a path nested too deeply');
+
+    const path = [...(root ? [root] : []), ...parts.map((part) => validatePathPart(decodeBencodedString(buffer, part)))].join('/');
+    const lengthEntry = fields.get('length');
+    return { path, length: lengthEntry ? decodeBencodedInteger(buffer, lengthEntry) : null };
+  });
+}
+
+function validatePathPart(value: string | null): string {
+  if (!value || value === '.' || value === '..' || value.includes('/') || value.includes('\\') || hasControlCharacter(value)) {
+    throw new BadRequestException('That .torrent file contains an unsafe file path');
+  }
+  if (Buffer.byteLength(value) > MAX_PATH_PART_BYTES) throw new BadRequestException('That .torrent file contains a file name that is too long');
+  return value;
+}
+
+function hasControlCharacter(value: string): boolean {
+  return [...value].some((character) => {
+    const code = character.codePointAt(0)!;
+    return code <= 0x1f || code === 0x7f;
+  });
+}
+
+function decodeBencodedInteger(buffer: Buffer, span: ValueSpan): number | null {
+  if (buffer[span.start] !== 0x69) return null;
+  const value = Number(buffer.subarray(span.start + 1, span.end - 1).toString('ascii'));
+  return Number.isSafeInteger(value) && value >= 0 ? value : null;
+}
+
+interface ValueSpan {
+  start: number;
+  end: number;
+}
+
+function decodeBencodedString(buffer: Buffer, span: ValueSpan): string | null {
+  const colon = buffer.indexOf(0x3a, span.start);
+  if (colon === -1 || colon >= span.end) return null;
+  return buffer.subarray(colon + 1, span.end).toString('utf8');
+}
+
+/**
+ * A deliberately small bencode scanner: it walks values to find their byte spans and never
+ * materialises the tree. That is all the infohash needs, and it keeps a hostile .torrent from
+ * turning into an unbounded allocation.
+ */
+class BencodeReader {
+  private position: number;
+  private valuesRead = 0;
+
+  constructor(
+    private readonly buffer: Buffer,
+    start = 0,
+  ) {
+    this.position = start;
+  }
+
+  readDictionaryEntries(): Map<string, ValueSpan> {
+    const entries = new Map<string, ValueSpan>();
+    if (this.buffer[this.position] !== 0x64) throw new BadRequestException('That .torrent file is not a bencoded dictionary');
+    this.position++;
+
+    while (this.position < this.buffer.length && this.buffer[this.position] !== 0x65) {
+      const keySpan = this.skipValue();
+      const key = decodeBencodedString(this.buffer, keySpan);
+      const valueSpan = this.skipValue();
+      if (key !== null && !entries.has(key)) entries.set(key, valueSpan);
+    }
+
+    if (this.buffer[this.position] !== 0x65) throw new BadRequestException('That .torrent file is truncated');
+
+    return entries;
+  }
+
+  readListEntries(limit = Number.POSITIVE_INFINITY): ValueSpan[] {
+    const entries: ValueSpan[] = [];
+    if (this.buffer[this.position] !== 0x6c) return entries;
+    this.position++;
+
+    while (this.position < this.buffer.length && this.buffer[this.position] !== 0x65) {
+      entries.push(this.skipValue());
+      if (entries.length >= limit) break;
+    }
+    return entries;
+  }
+
+  private skipValue(depth = 0): ValueSpan {
+    if (depth > MAX_BENCODE_DEPTH) throw new BadRequestException('That .torrent file is nested too deeply');
+    if (++this.valuesRead > MAX_BENCODE_VALUES) throw new BadRequestException('That .torrent file contains too many metadata values');
+    const start = this.position;
+    const marker = this.buffer[this.position];
+    if (marker === undefined) throw new BadRequestException('That .torrent file is truncated');
+
+    if (marker === 0x69) {
+      this.skipUntil(0x65);
+      this.position++;
+    } else if (marker === 0x6c || marker === 0x64) {
+      this.position++;
+      while (this.position < this.buffer.length && this.buffer[this.position] !== 0x65) this.skipValue(depth + 1);
+      if (this.buffer[this.position] !== 0x65) throw new BadRequestException('That .torrent file is truncated');
+      this.position++;
+    } else if (marker >= 0x30 && marker <= 0x39) {
+      const colon = this.buffer.indexOf(0x3a, this.position);
+      if (colon === -1) throw new BadRequestException('That .torrent file is truncated');
+      const length = Number(this.buffer.subarray(this.position, colon).toString('ascii'));
+      if (!Number.isSafeInteger(length) || length < 0) throw new BadRequestException('That .torrent file is malformed');
+      this.position = colon + 1 + length;
+      if (this.position > this.buffer.length) throw new BadRequestException('That .torrent file is truncated');
+    } else {
+      throw new BadRequestException('That .torrent file is malformed');
+    }
+
+    return { start, end: this.position };
+  }
+
+  private skipUntil(byte: number): void {
+    const index = this.buffer.indexOf(byte, this.position);
+    if (index === -1) throw new BadRequestException('That .torrent file is truncated');
+    this.position = index;
+  }
+}
+
+function base32ToHex(value: string): string {
+  let bits = '';
+  for (const char of value) {
+    const index = BASE32_ALPHABET.indexOf(char);
+    if (index === -1) throw new BadRequestException('That magnet link has a malformed infohash');
+    bits += index.toString(2).padStart(5, '0');
+  }
+
+  let hex = '';
+  for (let i = 0; i + 8 <= bits.length; i += 8) {
+    hex += parseInt(bits.slice(i, i + 8), 2)
+      .toString(16)
+      .padStart(2, '0');
+  }
+  return hex;
+}
diff --git a/server/src/modules/book-request/indexers/adapters/torznab.adapter.test.ts b/server/src/modules/book-request/indexers/adapters/torznab.adapter.test.ts
new file mode 100644
index 000000000..ade7f331f
--- /dev/null
+++ b/server/src/modules/book-request/indexers/adapters/torznab.adapter.test.ts
@@ -0,0 +1,471 @@
+import { DEFAULT_INDEXER_CATEGORIES } from '@bookorbit/types';
+
+/**
+ * Grabbing a .torrent pins the connection to the address that passed policy, and that path goes
+ * through undici's fetch rather than the global one. The adapter is what is under test, so undici
+ * is pointed back at the stub each test installs; what the dispatcher does is proven in
+ * `safe-fetch.test.ts`.
+ */
+vi.mock('undici', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('undici')>()),
+  fetch: (...args: Parameters<typeof fetch>) => fetch(...args),
+}));
+
+/** Every name in these tests is a stand-in, so one public answer stands for all of them. */
+vi.mock('dns/promises', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('dns/promises')>()),
+  lookup: vi.fn(() => Promise.resolve([{ address: '93.184.216.34', family: 4 }])),
+}));
+
+import { ProxyAgent } from 'undici';
+
+import { forgetDispatchers } from '../../../../common/utils/safe-fetch';
+import { IndexerSearchException, type ReleaseQuery, type ResolvedIndexerConfig } from '../indexer-adapter';
+import { TorznabAdapter } from './torznab.adapter';
+
+const RELEASE = {
+  indexerId: 7,
+  guid: 'g',
+  title: 'Dune',
+  downloadUrl: 'https://tracker.example.com/download/1.torrent?key=abc',
+  sizeBytes: null,
+  seeders: null,
+  leechers: null,
+};
+
+function redirectTo(location: string): Response {
+  return new Response(null, { status: 302, headers: { location } });
+}
+
+/** A body that never ends, and counts how much of it the adapter actually pulled. */
+function endlessStream(chunkBytes: number): { stream: ReadableStream<Uint8Array>; pulled: () => number } {
+  let pulls = 0;
+  // No read-ahead, so the count is what the reader asked for rather than what the queue primed.
+  const stream = new ReadableStream<Uint8Array>(
+    {
+      pull(controller) {
+        pulls++;
+        controller.enqueue(new Uint8Array(chunkBytes));
+      },
+    },
+    { highWaterMark: 0 },
+  );
+  return { stream, pulled: () => pulls };
+}
+
+function config(overrides: Partial<ResolvedIndexerConfig> = {}): ResolvedIndexerConfig {
+  return {
+    id: 7,
+    name: 'jackett',
+    adapterType: 'torznab',
+    // A Jackett on the LAN, which is the deployment the private-address opt-in exists for.
+    baseUrl: 'http://127.0.0.1:9117/api/v2.0/indexers/all/results/torznab',
+    credential: 'secret-key',
+    allowPrivateAddress: true,
+    categories: DEFAULT_INDEXER_CATEGORIES.torznab,
+    settings: null,
+    ...overrides,
+  };
+}
+
+function query(overrides: Partial<ReleaseQuery> = {}): ReleaseQuery {
+  return {
+    title: 'Dune',
+    author: 'Frank Herbert',
+    isbn13: '9780441013593',
+    isbn13s: ['9780441013593'],
+    mediaKind: 'ebook',
+    language: null,
+    limit: 50,
+    ...overrides,
+  };
+}
+
+function feed(items: string): string {
+  return `<?xml version="1.0" encoding="UTF-8"?><rss version="2.0" xmlns:torznab="http://torznab.com/schemas/2015/feed"><channel>${items}</channel></rss>`;
+}
+
+const ITEM = `
+  <item>
+    <title>Dune - Frank Herbert (retail) [EPUB]</title>
+    <guid>https://tracker.example.com/details/1</guid>
+    <link>https://tracker.example.com/download/1.torrent?key=abc</link>
+    <pubDate>Tue, 01 Apr 2025 10:00:00 +0000</pubDate>
+    <enclosure url="https://tracker.example.com/download/1.torrent?key=abc" length="1048576" type="application/x-bittorrent" />
+    <torznab:attr name="seeders" value="42" />
+    <torznab:attr name="peers" value="50" />
+    <torznab:attr name="size" value="1048576" />
+    <torznab:attr name="infohash" value="C9E15763F722F23E98A29DECDFAE341B98D53056" />
+    <torznab:attr name="downloadvolumefactor" value="0" />
+  </item>`;
+
+describe('TorznabAdapter', () => {
+  let fetchMock: ReturnType<typeof vi.fn>;
+
+  beforeEach(() => {
+    fetchMock = vi.fn();
+    vi.stubGlobal('fetch', fetchMock);
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+    forgetDispatchers();
+  });
+
+  function lastUrl(): URL {
+    return new URL(fetchMock.mock.calls.at(-1)![0].toString());
+  }
+
+  it('searches under the base URL path rather than replacing it', async () => {
+    fetchMock.mockResolvedValue(new Response(feed(ITEM)));
+
+    await new TorznabAdapter().search(query(), config(), AbortSignal.timeout(1000));
+
+    const url = lastUrl();
+    expect(url.pathname).toBe('/api/v2.0/indexers/all/results/torznab/api');
+    expect(url.searchParams.get('t')).toBe('search');
+    expect(url.searchParams.get('apikey')).toBe('secret-key');
+    expect(url.searchParams.get('cat')).toBe('7020');
+    // The ISBN is not in the query text: trackers do not index it, and it is a scoring signal.
+    expect(url.searchParams.get('q')).toBe('Dune Frank Herbert');
+  });
+
+  /** Some proxies hand the operator a base with the key already in it. */
+  it('keeps query parameters the base URL carries, without letting them shadow ours', async () => {
+    fetchMock.mockResolvedValue(new Response(feed(ITEM)));
+
+    await new TorznabAdapter().search(
+      query(),
+      config({ baseUrl: 'http://127.0.0.1:9117/api?apikey=from-base&passkey=abc' }),
+      AbortSignal.timeout(1000),
+    );
+
+    const url = lastUrl();
+    expect(url.searchParams.get('passkey')).toBe('abc');
+    expect(url.searchParams.getAll('apikey')).toEqual(['secret-key']);
+  });
+
+  /** A feed nobody vets must not decide how much CPU a search costs. */
+  it('stops reading a feed past the item ceiling, and drops an item with an absurd title', async () => {
+    const oversized = ITEM.replace('Dune - Frank Herbert (retail) [EPUB]', 'x'.repeat(5000));
+    fetchMock.mockResolvedValue(new Response(feed(oversized + ITEM.repeat(600))));
+
+    const releases = await new TorznabAdapter().search(query(), config(), AbortSignal.timeout(1000));
+
+    // 500 items read, of which the first is the one with the 5000-character title.
+    expect(releases.length).toBe(499);
+    expect(releases.every((release) => release.title.length < 5000)).toBe(true);
+  });
+
+  it('does not append a second /api when the base URL already ends in one', async () => {
+    fetchMock.mockResolvedValue(new Response(feed('')));
+
+    await new TorznabAdapter().search(query(), config({ baseUrl: 'http://127.0.0.1:9117/api' }), AbortSignal.timeout(1000));
+
+    expect(lastUrl().pathname).toBe('/api');
+  });
+
+  it('reads seeders, size, infohash and freeleech off the torznab attributes', async () => {
+    fetchMock.mockResolvedValue(new Response(feed(ITEM)));
+
+    const [release] = await new TorznabAdapter().search(query(), config(), AbortSignal.timeout(1000));
+
+    expect(release).toMatchObject({
+      indexerId: 7,
+      guid: 'https://tracker.example.com/details/1',
+      title: 'Dune - Frank Herbert (retail) [EPUB]',
+      downloadUrl: 'https://tracker.example.com/download/1.torrent?key=abc',
+      infoHash: 'c9e15763f722f23e98a29decdfae341b98d53056',
+      sizeBytes: 1048576,
+      seeders: 42,
+      freeleech: true,
+    });
+    // `peers` counts seeders, so leechers is the difference and not the raw 50.
+    expect(release.leechers).toBe(8);
+  });
+
+  it('treats a lone item as a list rather than dropping it', async () => {
+    fetchMock.mockResolvedValue(new Response(feed(ITEM)));
+    expect(await new TorznabAdapter().search(query(), config(), AbortSignal.timeout(1000))).toHaveLength(1);
+  });
+
+  it('carries a magnet link through when the proxy publishes one', async () => {
+    const magnetItem = `<item><title>Dune</title><guid>2</guid><link>magnet:?xt=urn:btih:abc</link></item>`;
+    fetchMock.mockResolvedValue(new Response(feed(magnetItem)));
+
+    const [release] = await new TorznabAdapter().search(query(), config(), AbortSignal.timeout(1000));
+
+    expect(release.magnet).toBe('magnet:?xt=urn:btih:abc');
+    expect(release.downloadUrl).toBeUndefined();
+  });
+
+  /**
+   * The failure this exists for: torznab reports a bad key as a 200 carrying `<error>`, which
+   * would otherwise reach the approver as "no releases found" rather than "fix your key".
+   */
+  it('raises an unauthorized failure for a 200 carrying a torznab error element', async () => {
+    fetchMock.mockResolvedValue(new Response('<error code="100" description="Incorrect user credentials" />'));
+
+    await expect(new TorznabAdapter().search(query(), config(), AbortSignal.timeout(1000))).rejects.toMatchObject({
+      failure: 'unauthorized',
+    });
+  });
+
+  it('distinguishes throttling from an ordinary failure', async () => {
+    fetchMock.mockResolvedValue(new Response('', { status: 429 }));
+
+    await expect(new TorznabAdapter().search(query(), config(), AbortSignal.timeout(1000))).rejects.toBeInstanceOf(IndexerSearchException);
+    await expect(new TorznabAdapter().search(query(), config(), AbortSignal.timeout(1000))).rejects.toMatchObject({ failure: 'throttled' });
+  });
+
+  it('reports a caps document as a successful test', async () => {
+    fetchMock.mockResolvedValue(new Response('<caps><server title="Jackett" version="0.21" /></caps>'));
+
+    await expect(new TorznabAdapter().test(config())).resolves.toEqual({ success: true, indexerName: 'Jackett' });
+    expect(lastUrl().searchParams.get('t')).toBe('caps');
+  });
+
+  it('fails the test when the URL answers with something that is not torznab', async () => {
+    fetchMock.mockResolvedValue(new Response('<html><body>hello</body></html>'));
+
+    await expect(new TorznabAdapter().test(config())).resolves.toMatchObject({ success: false });
+  });
+
+  /**
+   * Real Prowlarr output. `booktitle` is the bare work title where the release name is decorated,
+   * and the seed figures are the tracker's own requirements passed through.
+   */
+  it('reads booktitle and the tracker seed requirements', async () => {
+    fetchMock.mockResolvedValue(
+      new Response(
+        feed(`
+        <item>
+          <title>Project Hail Mary by Andy Weir [ENG / M4B]</title>
+          <guid>https://tracker.example.com/details/9</guid>
+          <link>https://tracker.example.com/download/9.torrent</link>
+          <torznab:attr name="booktitle" value="Project Hail Mary" />
+          <torznab:attr name="author" value="Andy Weir" />
+          <torznab:attr name="seeders" value="7414" />
+          <torznab:attr name="minimumratio" value="1" />
+          <torznab:attr name="minimumseedtime" value="259200" />
+        </item>`),
+      ),
+    );
+
+    const [release] = await new TorznabAdapter().search(query(), config(), AbortSignal.timeout(1000));
+    expect(release.bookTitle).toBe('Project Hail Mary');
+    // The release name keeps its flags, because that is what the picker shows.
+    expect(release.title).toBe('Project Hail Mary by Andy Weir [ENG / M4B]');
+    expect(release.seedRatioGoal).toBe(1);
+    // Torznab states seconds; 259200 is the 72 hours the tracker asks for.
+    expect(release.seedTimeMinutes).toBe(4320);
+  });
+
+  it('leaves the seed requirements and booktitle unset when the indexer states none', async () => {
+    fetchMock.mockResolvedValue(new Response(feed(ITEM)));
+
+    const [release] = await new TorznabAdapter().search(query(), config(), AbortSignal.timeout(1000));
+    expect(release.bookTitle).toBeUndefined();
+    expect(release.seedRatioGoal).toBeUndefined();
+    expect(release.seedTimeMinutes).toBeUndefined();
+  });
+});
+
+/**
+ * `redirect: 'follow'` checks the URL it was given and nothing after it, then lets the global
+ * fetch take up to twenty hops unchecked. A compromised or intercepted indexer could answer the
+ * search itself with a 302 at loopback or the link-local metadata address and have the body read
+ * and parsed, which is the same hole `fetchTorrentFile` was already closed against.
+ */
+describe('TorznabAdapter search redirects', () => {
+  let fetchMock: ReturnType<typeof vi.fn>;
+
+  beforeEach(() => {
+    fetchMock = vi.fn();
+    vi.stubGlobal('fetch', fetchMock);
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+    forgetDispatchers();
+  });
+
+  /** A public proxy, because a LAN Jackett is allowed private addresses and has nothing to prove. */
+  function publicConfig(): ResolvedIndexerConfig {
+    return config({ baseUrl: 'https://tracker.example.com/api', allowPrivateAddress: false });
+  }
+
+  it('checks each hop rather than only the URL configured', async () => {
+    fetchMock.mockResolvedValueOnce(new Response(null, { status: 302, headers: { location: 'http://169.254.169.254/latest/meta-data' } }));
+
+    await expect(new TorznabAdapter().search(query(), publicConfig(), AbortSignal.timeout(1000))).rejects.toThrow(/private or local/);
+    // The metadata address was never opened: the refusal happened between the hops.
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+  });
+
+  it('follows a redirect to a public address and parses what it answered', async () => {
+    fetchMock
+      .mockResolvedValueOnce(new Response(null, { status: 302, headers: { location: 'https://proxy.example.com/api?t=search' } }))
+      .mockResolvedValueOnce(new Response(feed(ITEM)));
+
+    const releases = await new TorznabAdapter().search(query(), publicConfig(), AbortSignal.timeout(1000));
+
+    expect(releases).toHaveLength(1);
+    expect(new URL(fetchMock.mock.calls.at(-1)![0].toString()).origin).toBe('https://proxy.example.com');
+  });
+
+  it('gives up on a chain that never lands', async () => {
+    fetchMock.mockResolvedValue(new Response(null, { status: 302, headers: { location: 'https://tracker.example.com/again' } }));
+
+    await expect(new TorznabAdapter().search(query(), publicConfig(), AbortSignal.timeout(1000))).rejects.toThrow(/redirected more than/);
+  });
+
+  it('refuses a redirect that says nothing about where to go', async () => {
+    fetchMock.mockResolvedValueOnce(new Response(null, { status: 302 }));
+
+    await expect(new TorznabAdapter().search(query(), publicConfig(), AbortSignal.timeout(1000))).rejects.toThrow(/without saying where/);
+  });
+});
+
+/**
+ * The one URL on this adapter a tracker chose rather than an operator, and so the one that gets
+ * checked on every hop rather than only on the first.
+ */
+describe('TorznabAdapter.fetchTorrentFile', () => {
+  let fetchMock: ReturnType<typeof vi.fn>;
+
+  beforeEach(() => {
+    fetchMock = vi.fn();
+    vi.stubGlobal('fetch', fetchMock);
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+    forgetDispatchers();
+  });
+
+  /** A public host is the only thing the pre-flight approves, so a public one is what it starts as. */
+  function publicConfig(overrides: Partial<ResolvedIndexerConfig> = {}): ResolvedIndexerConfig {
+    return config({ baseUrl: 'https://tracker.example.com/api', allowPrivateAddress: false, ...overrides });
+  }
+
+  it('returns the .torrent a tracker answered with', async () => {
+    fetchMock.mockResolvedValue(new Response(Buffer.from('d8:announce...e')));
+
+    await expect(new TorznabAdapter().fetchTorrentFile(RELEASE, publicConfig())).resolves.toEqual(Buffer.from('d8:announce...e'));
+  });
+
+  it('follows a redirect and grabs the file from where it points', async () => {
+    fetchMock.mockResolvedValueOnce(redirectTo('https://cdn.example.com/1.torrent')).mockResolvedValueOnce(new Response(Buffer.from('d8:announcee')));
+
+    await expect(new TorznabAdapter().fetchTorrentFile(RELEASE, publicConfig())).resolves.toEqual(Buffer.from('d8:announcee'));
+    expect(new URL(fetchMock.mock.calls.at(-1)![0].toString()).href).toBe('https://cdn.example.com/1.torrent');
+  });
+
+  it('returns a magnet when a Torznab download endpoint redirects to one', async () => {
+    const magnet = 'magnet:?xt=urn:btih:c9e15763f722f23e98a29decdfae341b98d53056&dn=Dune';
+    fetchMock.mockResolvedValueOnce(redirectTo(magnet));
+
+    await expect(new TorznabAdapter().fetchTorrentFile(RELEASE, publicConfig())).resolves.toEqual({ magnet });
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+  });
+
+  it('refuses a redirect to loopback', async () => {
+    fetchMock.mockResolvedValueOnce(redirectTo('http://127.0.0.1:8080/secret'));
+
+    await expect(new TorznabAdapter().fetchTorrentFile(RELEASE, publicConfig())).rejects.toThrow(/private or local/);
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+  });
+
+  /** The address a cloud instance answers its own credentials on. */
+  it('refuses a redirect to a link-local metadata address', async () => {
+    fetchMock.mockResolvedValueOnce(redirectTo('http://169.254.169.254/latest/meta-data/iam/security-credentials/'));
+
+    await expect(new TorznabAdapter().fetchTorrentFile(RELEASE, publicConfig())).rejects.toThrow(/private or local/);
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+  });
+
+  /** The hop that is checked has to be every hop, not only the one the release named. */
+  it('refuses a private address reached through a chain of public redirects', async () => {
+    fetchMock
+      .mockResolvedValueOnce(redirectTo('https://cdn.example.com/a'))
+      .mockResolvedValueOnce(redirectTo('https://mirror.example.com/b'))
+      .mockResolvedValueOnce(redirectTo('http://10.0.0.5/internal'));
+
+    await expect(new TorznabAdapter().fetchTorrentFile(RELEASE, publicConfig())).rejects.toThrow(/private or local/);
+    expect(fetchMock).toHaveBeenCalledTimes(3);
+  });
+
+  it('gives up rather than following redirects forever', async () => {
+    fetchMock.mockResolvedValue(redirectTo('https://tracker.example.com/again'));
+
+    await expect(new TorznabAdapter().fetchTorrentFile(RELEASE, publicConfig())).rejects.toThrow(/redirected more than/);
+  });
+
+  /**
+   * The grab used the global fetch while the search honoured the profile, so an indexer reachable
+   * only through a proxy searched fine and then failed at the moment it mattered.
+   */
+  it('carries the operator egress the search already honours', async () => {
+    fetchMock.mockResolvedValue(new Response(Buffer.from('d8:announcee')));
+
+    await new TorznabAdapter().fetchTorrentFile(RELEASE, publicConfig({ networkProfile: { proxyUrl: 'http://proxy.example.com:8080' } }));
+
+    expect(fetchMock.mock.calls.at(-1)![1]).toMatchObject({ dispatcher: expect.any(ProxyAgent) });
+  });
+
+  it('refuses a .torrent that declares itself past the ceiling', async () => {
+    fetchMock.mockResolvedValue(new Response(Buffer.from('d8:e'), { headers: { 'content-length': String(4 * 1024 * 1024) } }));
+
+    await expect(new TorznabAdapter().fetchTorrentFile(RELEASE, publicConfig())).rejects.toThrow(/too large/);
+  });
+
+  /** Two megabytes of metadata is already impossible; the rest of an endless body is not read. */
+  it('aborts a .torrent that streams past the ceiling rather than buffering it', async () => {
+    const chunk = 64 * 1024;
+    const { stream, pulled } = endlessStream(chunk);
+    fetchMock.mockResolvedValue(new Response(stream));
+
+    await expect(new TorznabAdapter().fetchTorrentFile(RELEASE, publicConfig())).rejects.toThrow(/too large/);
+    // The ceiling plus the one chunk it takes to notice, rather than however much was on offer.
+    expect(pulled()).toBe((2 * 1024 * 1024) / chunk + 1);
+  });
+
+  it('refuses a release with no download link at all', async () => {
+    await expect(new TorznabAdapter().fetchTorrentFile({ ...RELEASE, downloadUrl: undefined }, publicConfig())).rejects.toBeInstanceOf(
+      IndexerSearchException,
+    );
+  });
+});
+
+/** A feed is a document, and a document that never ends is not one. */
+describe('TorznabAdapter search response bounds', () => {
+  let fetchMock: ReturnType<typeof vi.fn>;
+
+  beforeEach(() => {
+    fetchMock = vi.fn();
+    vi.stubGlobal('fetch', fetchMock);
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+    forgetDispatchers();
+  });
+
+  it('fails an endless feed as a bounded error rather than reading it all', async () => {
+    const chunk = 256 * 1024;
+    const { stream, pulled } = endlessStream(chunk);
+    fetchMock.mockResolvedValue(new Response(stream));
+
+    await expect(new TorznabAdapter().search(query(), config(), AbortSignal.timeout(5000))).rejects.toMatchObject({ failure: 'error' });
+    expect(pulled()).toBe((16 * 1024 * 1024) / chunk + 1);
+  });
+
+  it('refuses a feed that declares itself past the ceiling before reading it', async () => {
+    const { stream, pulled } = endlessStream(1024);
+    fetchMock.mockResolvedValue(new Response(stream, { headers: { 'content-length': String(64 * 1024 * 1024) } }));
+
+    await expect(new TorznabAdapter().search(query(), config(), AbortSignal.timeout(5000))).rejects.toThrow(/more XML/);
+    expect(pulled()).toBe(0);
+  });
+});
diff --git a/server/src/modules/book-request/indexers/adapters/torznab.adapter.ts b/server/src/modules/book-request/indexers/adapters/torznab.adapter.ts
new file mode 100644
index 000000000..3cba4a1b5
--- /dev/null
+++ b/server/src/modules/book-request/indexers/adapters/torznab.adapter.ts
@@ -0,0 +1,363 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { XMLParser } from 'fast-xml-parser';
+import { MAX_INDEXER_RELEASE_GUID_LENGTH, type BookRequestMediaKind, type IndexerTestResult } from '@bookorbit/types';
+
+import { readBoundedBytes, ResponseTooLargeError } from '../../../../common/utils/bounded-response';
+import { sanitizeLogValue } from '../../../../common/utils/log-sanitize.utils';
+import { safeFetch } from '../../../../common/utils/safe-fetch';
+import { ensureSafeUrl } from '../../../../common/utils/ssrf.utils';
+import {
+  IndexerSearchException,
+  type IndexerAdapter,
+  type ReleaseCandidate,
+  type ReleaseQuery,
+  type ResolvedIndexerConfig,
+  type TorrentFetchResult,
+} from '../indexer-adapter';
+// An ISBN is the one query a tracker almost never indexes, so it stays out of the search text.
+import { buildSearchText } from '../search-text';
+import { infoHashFromMagnet, MAX_TORRENT_FILE_BYTES } from '../../fulfillment/torrent.utils';
+
+/**
+ * A generous ceiling on a feed document, not an expectation. A hundred extended results run to a
+ * few hundred kilobytes and a Jackett capabilities document to rather less; a body past this is a
+ * stream that will not end rather than a feed worth parsing.
+ */
+const MAX_XML_RESPONSE_BYTES = 16 * 1024 * 1024;
+/**
+ * Bounds inside the byte bound. 16MB is generous enough to hold a hundred thousand tiny items, or
+ * one item carrying a megabyte of title, and every one of them would be parsed, scored, deduped
+ * and cached: a feed nobody vets should not be able to spend seconds of synchronous CPU per
+ * search. Ten times what any search asks any indexer for, and no honest title or link is 4KB.
+ */
+const MAX_FEED_ITEMS = 500;
+const MAX_FEED_FIELD_CHARS = MAX_INDEXER_RELEASE_GUID_LENGTH;
+const REQUEST_TIMEOUT_MS = 25_000;
+/** The same ceiling the direct fetcher uses, and for the same reason: a chain, not a loop. */
+const MAX_REDIRECTS = 5;
+
+const parser = new XMLParser({ ignoreAttributes: false, attributeNamePrefix: '@_', textNodeName: '#text' });
+
+interface TorznabItem {
+  title?: string;
+  guid?: unknown;
+  link?: string;
+  size?: string | number;
+  pubDate?: string;
+  enclosure?: { '@_url'?: string; '@_length'?: string | number } | Array<{ '@_url'?: string; '@_length'?: string | number }>;
+  'torznab:attr'?: TorznabAttr | TorznabAttr[];
+}
+
+interface TorznabAttr {
+  '@_name'?: string;
+  '@_value'?: string;
+}
+
+/**
+ * The generic adapter, and deliberately the first one built: proving the interface on the case
+ * every torznab proxy speaks keeps a single tracker's quirks from shaping the abstraction.
+ */
+@Injectable()
+export class TorznabAdapter implements IndexerAdapter {
+  readonly type = 'torznab' as const;
+  readonly label = 'Torznab';
+  /** Whatever the proxy behind it indexes, which is every medium a request can ask for. */
+  readonly mediaKinds: readonly BookRequestMediaKind[] = ['ebook', 'audiobook', 'comic'];
+  readonly supportsIsbnSearch = false;
+  /** Jackett and Prowlarr want an API key, but a self-hosted proxy may be left open. */
+  readonly requiresCredential = false;
+
+  private readonly logger = new Logger(TorznabAdapter.name);
+
+  async search(query: ReleaseQuery, config: ResolvedIndexerConfig, signal: AbortSignal): Promise<ReleaseCandidate[]> {
+    const params = new URLSearchParams({ t: 'search', q: buildSearchText(query), limit: String(query.limit), extended: '1' });
+    if (config.credential) params.set('apikey', config.credential);
+    const categories = config.categories[query.mediaKind];
+    if (categories.length > 0) params.set('cat', categories.join(','));
+
+    const xml = await this.callXml(config, params, signal);
+    return parseItems(xml, config.id);
+  }
+
+  async test(config: ResolvedIndexerConfig): Promise<IndexerTestResult> {
+    const params = new URLSearchParams({ t: 'caps' });
+    if (config.credential) params.set('apikey', config.credential);
+
+    try {
+      const xml = await this.callXml(config, params, AbortSignal.timeout(REQUEST_TIMEOUT_MS));
+      const parsed = parser.parse(xml) as { caps?: { server?: { '@_title'?: string; '@_version'?: string } } };
+      const server = parsed.caps?.server;
+      if (!parsed.caps) {
+        return { success: false, error: 'That URL answered, but not with a torznab capabilities document' };
+      }
+      return { success: true, indexerName: server?.['@_title'] ?? undefined };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      this.logger.warn(`[request_indexer.test] [fail] indexerId=${config.id} error="${sanitizeLogValue(message)}" - torznab test failed`);
+      return { success: false, error: message };
+    }
+  }
+
+  /**
+   * Torznab links are one-shot, credentialed URLs, so the fetch goes through the same host check
+   * as everything else rather than being handed to the download client to open.
+   *
+   * This is the one URL on the adapter that a tracker chose rather than an operator, so it gets
+   * the strong shape: redirects followed by hand with every hop checked, the connection pinned to
+   * the address that passed, the operator's egress honoured, and the body counted as it arrives.
+   */
+  async fetchTorrentFile(release: ReleaseCandidate, config: ResolvedIndexerConfig): Promise<TorrentFetchResult> {
+    if (!release.downloadUrl) throw new IndexerSearchException('error', 'That release has no download link');
+
+    const deadline = AbortSignal.timeout(REQUEST_TIMEOUT_MS);
+    let current = await ensureSafeUrl(release.downloadUrl, { allowPrivate: config.allowPrivateAddress });
+
+    for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
+      const response = await safeFetch(
+        current.href,
+        { signal: deadline, redirect: 'manual', headers: { Accept: 'application/x-bittorrent, */*' } },
+        { allowPrivate: config.allowPrivateAddress, profile: config.networkProfile, pinResolvedAddress: true },
+      );
+
+      if (response.status >= 300 && response.status < 400) {
+        const location = response.headers.get('location');
+        void response.body?.cancel().catch(() => undefined);
+        if (!location) throw new IndexerSearchException('error', `The indexer answered ${response.status} without saying where the file is`);
+        const redirected = new URL(location, current);
+        if (redirected.protocol === 'magnet:') {
+          try {
+            infoHashFromMagnet(redirected.href);
+          } catch (error) {
+            throw new IndexerSearchException('error', error instanceof Error ? error.message : 'The indexer returned an invalid magnet link');
+          }
+          return { magnet: redirected.href };
+        }
+        current = await ensureSafeUrl(redirected.href, { allowPrivate: config.allowPrivateAddress });
+        continue;
+      }
+
+      if (!response.ok) throw new IndexerSearchException('error', `The indexer answered ${response.status} for that download link`);
+
+      const body = await readBounded(response, MAX_TORRENT_FILE_BYTES, 'The indexer returned a .torrent file that is too large');
+      if (body.byteLength === 0) throw new IndexerSearchException('error', 'The indexer returned an empty .torrent file');
+      return body;
+    }
+
+    throw new IndexerSearchException('error', `That download link redirected more than ${MAX_REDIRECTS} times`);
+  }
+
+  /**
+   * A search or a capabilities call, with the redirect chain walked by hand.
+   *
+   * `redirect: 'follow'` checks the first URL and nothing after it: the global fetch then takes up
+   * to twenty hops unchecked, so a compromised or intercepted indexer can answer 302 pointing at
+   * loopback or a link-local metadata address and have the body read and parsed. This is the same
+   * shape `fetchTorrentFile` already uses. The API key needs no separate handling: it rides in the
+   * query string, and a redirect target carries only the query the indexer itself named.
+   */
+  private async callXml(config: ResolvedIndexerConfig, params: URLSearchParams, signal: AbortSignal): Promise<string> {
+    const options = { allowPrivate: config.allowPrivateAddress, profile: config.networkProfile, pinResolvedAddress: true };
+    let current = await this.endpointUrl(config, params);
+    let response: Response | null = null;
+
+    for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
+      try {
+        response = await safeFetch(current.href, { signal, redirect: 'manual', headers: { Accept: 'application/xml, text/xml' } }, options);
+      } catch (error) {
+        if (error instanceof Error && (error.name === 'AbortError' || error.name === 'TimeoutError')) {
+          throw new IndexerSearchException('timeout', `${config.name} did not answer in time`);
+        }
+        throw new IndexerSearchException('unreachable', `Could not reach ${config.name}: ${error instanceof Error ? error.message : String(error)}`);
+      }
+
+      if (response.status < 300 || response.status >= 400) break;
+
+      const location = response.headers.get('location');
+      void response.body?.cancel().catch(() => undefined);
+      if (!location) throw new IndexerSearchException('error', `${config.name} answered ${response.status} without saying where to go`);
+      current = await ensureSafeUrl(new URL(location, current).href, options);
+      response = null;
+    }
+
+    if (!response) throw new IndexerSearchException('error', `${config.name} redirected more than ${MAX_REDIRECTS} times`);
+
+    if (response.status === 429) throw new IndexerSearchException('throttled', `${config.name} is rate limiting us`);
+    if (response.status === 401 || response.status === 403) {
+      throw new IndexerSearchException('unauthorized', `${config.name} rejected the API key`);
+    }
+    if (!response.ok) throw new IndexerSearchException('error', `${config.name} answered ${response.status}`);
+
+    const body = (await readBounded(response, MAX_XML_RESPONSE_BYTES, `${config.name} answered with more XML than BookOrbit will read`)).toString(
+      'utf8',
+    );
+    // Torznab reports its own failures as a 200 carrying an <error> element, so the status alone
+    // is not the answer: an expired key would otherwise read as "no releases found".
+    const error = readErrorElement(body);
+    if (error) throw new IndexerSearchException(error.failure, `${config.name}: ${error.description}`);
+    return body;
+  }
+
+  /**
+   * `new URL('/api', base)` throws away any path the base carries, which breaks every Jackett
+   * deployment (its endpoints live under `/api/v2.0/indexers/<id>/results/torznab`). Join under
+   * the base's own path instead, and accept a base that already ends in `/api`.
+   *
+   * Anything the base's own query string carries is kept underneath what this call asks for. Some
+   * proxies hand the operator a base with the key already in it (`.../api?apikey=...`), and
+   * replacing the query wholesale dropped it, so the indexer answered every search with a 401 that
+   * looked like a wrong key. Our own parameters still win, so `t`, `q` and the rest are never
+   * shadowed by a stale copy in the base.
+   */
+  private async endpointUrl(config: ResolvedIndexerConfig, params: URLSearchParams): Promise<URL> {
+    const base = await ensureSafeUrl(config.baseUrl, { allowPrivate: config.allowPrivateAddress });
+    const prefix = base.pathname.replace(/\/+$/, '');
+    const target = new URL(base.href);
+    target.pathname = prefix.endsWith('/api') ? prefix : `${prefix}/api`;
+
+    const merged = new URLSearchParams(base.search);
+    for (const key of new Set(params.keys())) merged.delete(key);
+    for (const [key, value] of params) merged.append(key, value);
+    target.search = merged.toString();
+    target.hash = '';
+    return target;
+  }
+}
+
+/**
+ * A ceiling breach is the indexer misbehaving, so it reaches the picker as an indexer failure
+ * rather than as an unexplained crash halfway through a search.
+ */
+async function readBounded(response: Response, limitBytes: number, message: string): Promise<Buffer> {
+  try {
+    return await readBoundedBytes(response, limitBytes);
+  } catch (error) {
+    if (error instanceof ResponseTooLargeError) throw new IndexerSearchException('error', message);
+    throw error;
+  }
+}
+
+/**
+ * Newznab reserves the 100 block for credential and account failures, which is the distinction
+ * worth surfacing: a wrong key is the operator's to fix, anything else is the tracker's.
+ */
+function readErrorElement(body: string): { failure: 'unauthorized' | 'error'; description: string } | null {
+  const element = /<error\b[^>]*\/?>/i.exec(body);
+  if (!element) return null;
+
+  const description = /\bdescription="([^"]*)"/i.exec(element[0])?.[1] ?? 'the indexer reported an error';
+  const code = Number(/\bcode="(\d+)"/i.exec(element[0])?.[1]);
+  return { failure: Number.isFinite(code) && code >= 100 && code < 200 ? 'unauthorized' : 'error', description };
+}
+
+function parseItems(xml: string, indexerId: number): ReleaseCandidate[] {
+  const parsed = parser.parse(xml) as { rss?: { channel?: { item?: TorznabItem | TorznabItem[] } } };
+  // Bounded before the loop, so an item count nobody asked for costs one slice rather than a pass.
+  const items = toArray(parsed.rss?.channel?.item).slice(0, MAX_FEED_ITEMS);
+
+  const releases: ReleaseCandidate[] = [];
+  for (const item of items) {
+    const title = typeof item.title === 'string' ? item.title.trim() : '';
+    if (!title || !withinFieldBound(title)) continue;
+
+    const attrs = attrMap(item);
+    const enclosure = toArray(item.enclosure)[0];
+    const guid = readGuid(item) ?? enclosure?.['@_url'] ?? title;
+    if (!withinFieldBound(guid)) continue;
+    // A proxy may publish the release as a magnet in `link`, in an enclosure, or in an attribute.
+    const link = withinFieldBound(item.link ?? enclosure?.['@_url']) ? (item.link ?? enclosure?.['@_url']) : undefined;
+    const magnet = attrs.get('magneturl') ?? (link?.startsWith('magnet:') ? link : undefined);
+    const downloadUrl = link && !link.startsWith('magnet:') ? link : undefined;
+    const infoHash = attrs.get('infohash');
+    // A bare count includes cover art, so it is a scoring penalty rather than a hard filter.
+    const fileCount = toNumber(attrs.get('files'));
+    const publishedAt = parseDate(item.pubDate);
+    // What the tracker asks of a grab, which a proxy passes through from the tracker's own rules.
+    // Torznab states the seed time in seconds; our column and the download clients want minutes.
+    const seedRatioGoal = toNumber(attrs.get('minimumratio'));
+    const seedTimeSeconds = toNumber(attrs.get('minimumseedtime'));
+    const seedTimeMinutes = seedTimeSeconds === null ? null : Math.round(seedTimeSeconds / 60);
+    const bookTitle = attrs.get('booktitle')?.trim();
+
+    releases.push({
+      indexerId,
+      guid,
+      title,
+      ...(bookTitle ? { bookTitle } : {}),
+      ...(downloadUrl ? { downloadUrl } : {}),
+      ...(magnet ? { magnet } : {}),
+      ...(infoHash ? { infoHash: infoHash.toLowerCase() } : {}),
+      sizeBytes: toNumber(attrs.get('size') ?? item.size ?? enclosure?.['@_length']),
+      seeders: toNumber(attrs.get('seeders')),
+      leechers: leecherCount(attrs),
+      ...(attrs.get('author') ? { author: attrs.get('author') } : {}),
+      ...(attrs.get('language') ? { language: attrs.get('language') } : {}),
+      // Torznab reports freeleech as a downloadvolumefactor of 0: the release costs no download.
+      freeleech: toNumber(attrs.get('downloadvolumefactor')) === 0,
+      ...(publishedAt ? { publishedAt } : {}),
+      ...(fileCount !== null ? { fileCount } : {}),
+      ...(seedRatioGoal !== null ? { seedRatioGoal } : {}),
+      ...(seedTimeMinutes !== null ? { seedTimeMinutes } : {}),
+    });
+  }
+
+  return releases;
+}
+
+/** `peers` counts seeders too, so leechers is the difference rather than the raw number. */
+function leecherCount(attrs: Map<string, string>): number | null {
+  const explicit = toNumber(attrs.get('leechers'));
+  if (explicit !== null) return explicit;
+  const peers = toNumber(attrs.get('peers'));
+  if (peers === null) return null;
+  return Math.max(0, peers - (toNumber(attrs.get('seeders')) ?? 0));
+}
+
+/** An unparseable pubDate would otherwise throw out of the whole feed on `toISOString()`. */
+function parseDate(raw: string | undefined): string | undefined {
+  if (!raw) return undefined;
+  const parsed = new Date(raw);
+  return Number.isNaN(parsed.getTime()) ? undefined : parsed.toISOString();
+}
+
+function attrMap(item: TorznabItem): Map<string, string> {
+  const map = new Map<string, string>();
+  for (const attr of toArray(item['torznab:attr'])) {
+    const name = attr['@_name']?.toLowerCase();
+    const value = attr['@_value'];
+    if (!name || value === undefined || map.has(name)) continue;
+    // Bounded here rather than per field: every attribute-derived value on a release, from the
+    // magnet link to the language, passes through this map.
+    const text = String(value);
+    if (withinFieldBound(text)) map.set(name, text);
+  }
+  return map;
+}
+
+/** A title, link or attribute longer than the bound is not one; the item is dropped rather than kept. */
+function withinFieldBound(value: string | undefined): boolean {
+  return value === undefined || value.length <= MAX_FEED_FIELD_CHARS;
+}
+
+/** `guid` is a bare string on some proxies and `{ '#text', '@_isPermaLink' }` on others. */
+function readGuid(item: TorznabItem): string | undefined {
+  const guid = item.guid;
+  if (typeof guid === 'string' && guid.trim()) return guid.trim();
+  if (typeof guid === 'number') return String(guid);
+  if (guid && typeof guid === 'object') {
+    const text = (guid as { '#text'?: unknown })['#text'];
+    if (typeof text === 'string' && text.trim()) return text.trim();
+    if (typeof text === 'number') return String(text);
+  }
+  return undefined;
+}
+
+function toNumber(value: string | number | undefined | null): number | null {
+  if (value === undefined || value === null || value === '') return null;
+  const parsed = Number(value);
+  return Number.isFinite(parsed) ? parsed : null;
+}
+
+function toArray<T>(value: T | T[] | undefined | null): T[] {
+  if (value === undefined || value === null) return [];
+  return Array.isArray(value) ? value : [value];
+}
diff --git a/server/src/modules/book-request/indexers/dto/indexer.dto.ts b/server/src/modules/book-request/indexers/dto/indexer.dto.ts
new file mode 100644
index 000000000..457007578
--- /dev/null
+++ b/server/src/modules/book-request/indexers/dto/indexer.dto.ts
@@ -0,0 +1,220 @@
+import { Type } from 'class-transformer';
+import {
+  ArrayMaxSize,
+  IsArray,
+  IsBoolean,
+  IsIP,
+  IsIn,
+  IsInt,
+  IsObject,
+  IsOptional,
+  IsString,
+  Matches,
+  MaxLength,
+  Min,
+  MinLength,
+  ValidateNested,
+} from 'class-validator';
+import { BOOK_REQUEST_MEDIA_KINDS, INDEXER_COLORS } from '@bookorbit/types';
+import type { BookRequestMediaKind, IndexerAdapterTypeName, IndexerColor } from '@bookorbit/types';
+
+/** The same slug shape the `adapter_type` CHECK enforces. */
+const ADAPTER_TYPE_SLUG = /^[a-z0-9][a-z0-9-]{0,29}$/;
+
+/** Category ids are the indexer's own numbering, so the only thing to validate is the shape. */
+class IndexerCategoriesDto {
+  @IsOptional()
+  @IsArray()
+  @ArrayMaxSize(30)
+  @IsInt({ each: true })
+  @Min(0, { each: true })
+  ebook?: number[];
+
+  @IsOptional()
+  @IsArray()
+  @ArrayMaxSize(30)
+  @IsInt({ each: true })
+  @Min(0, { each: true })
+  audiobook?: number[];
+
+  @IsOptional()
+  @IsArray()
+  @ArrayMaxSize(30)
+  @IsInt({ each: true })
+  @Min(0, { each: true })
+  comic?: number[];
+}
+
+/**
+ * How the server should reach this source. Operator configuration rather than adapter choice, so
+ * it is validated here in full: the proxy address is the one value that decides where a request
+ * actually goes, and a bad one must be refused at the form.
+ */
+class NetworkProfileDto {
+  @IsOptional()
+  @IsArray()
+  @ArrayMaxSize(4)
+  @IsIP(undefined, { each: true })
+  resolvers?: string[];
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(2048)
+  @Matches(/^https?:\/\//, { message: 'proxyUrl must be an http or https address' })
+  proxyUrl?: string;
+}
+
+export class CreateIndexerDto {
+  @IsString()
+  @MinLength(1)
+  @MaxLength(100)
+  name!: string;
+
+  /**
+   * Only shape here. Which adapter names exist is a runtime fact once adapters can be loaded from
+   * disk, so `IndexerConfigService` rejects an unknown one against the registry instead.
+   */
+  @IsString()
+  @Matches(ADAPTER_TYPE_SLUG)
+  adapterType!: IndexerAdapterTypeName;
+
+  @IsString()
+  @MaxLength(2048)
+  baseUrl!: string;
+
+  /**
+   * A slug from the closed palette, never a colour value: the client resolves it to a token tuned
+   * per theme. `IsOptional` passes null through, which is how a colour is cleared.
+   */
+  @IsOptional()
+  @IsIn(INDEXER_COLORS)
+  color?: IndexerColor | null;
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(1024)
+  credential?: string;
+
+  @IsOptional()
+  @IsBoolean()
+  enabled?: boolean;
+
+  @IsOptional()
+  @IsBoolean()
+  allowPrivateAddress?: boolean;
+
+  @IsOptional()
+  @ValidateNested()
+  @Type(() => IndexerCategoriesDto)
+  categories?: IndexerCategoriesDto;
+
+  /**
+   * Narrowing only, and bounded by how many media exist rather than by a guess. Listing a medium
+   * the adapter does not carry is allowed and does nothing: that source was already left out.
+   */
+  @IsOptional()
+  @IsArray()
+  @ArrayMaxSize(BOOK_REQUEST_MEDIA_KINDS.length)
+  @IsIn(BOOK_REQUEST_MEDIA_KINDS, { each: true })
+  disabledMediaKinds?: BookRequestMediaKind[];
+
+  /** Accepted for any adapter, and simply unused by one that never searches an ISBN. */
+  @IsOptional()
+  @IsBoolean()
+  isbnSearchDisabled?: boolean;
+
+  /**
+   * Deliberately opaque here. An adapter loaded at runtime declares its own fields, so no class
+   * could enumerate them; `IndexerConfigService` validates the object against the adapter's own
+   * `settingsFields` and drops anything it did not declare, which is the same protection
+   * `forbidNonWhitelisted` gives the fields it does know about.
+   */
+  @IsOptional()
+  @IsObject()
+  settings?: Record<string, unknown>;
+
+  @IsOptional()
+  @ValidateNested()
+  @Type(() => NetworkProfileDto)
+  networkProfile?: NetworkProfileDto | null;
+}
+
+/**
+ * Spelled out rather than derived from the create DTO: `whitelist` plus `forbidNonWhitelisted`
+ * means the accepted field list has to be exact, and an inherited-then-loosened field is easy to
+ * get subtly wrong.
+ */
+export class UpdateIndexerDto {
+  @IsOptional()
+  @IsString()
+  @MinLength(1)
+  @MaxLength(100)
+  name?: string;
+
+  @IsOptional()
+  @IsString()
+  @Matches(ADAPTER_TYPE_SLUG)
+  adapterType?: IndexerAdapterTypeName;
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(2048)
+  baseUrl?: string;
+
+  /**
+   * A slug from the closed palette, never a colour value: the client resolves it to a token tuned
+   * per theme. `IsOptional` passes null through, which is how a colour is cleared.
+   */
+  @IsOptional()
+  @IsIn(INDEXER_COLORS)
+  color?: IndexerColor | null;
+
+  /** An omitted credential keeps the stored one; an empty string clears it. */
+  @IsOptional()
+  @IsString()
+  @MaxLength(1024)
+  credential?: string;
+
+  @IsOptional()
+  @IsBoolean()
+  enabled?: boolean;
+
+  @IsOptional()
+  @IsBoolean()
+  allowPrivateAddress?: boolean;
+
+  @IsOptional()
+  @ValidateNested()
+  @Type(() => IndexerCategoriesDto)
+  categories?: IndexerCategoriesDto;
+
+  /**
+   * Narrowing only, and bounded by how many media exist rather than by a guess. Listing a medium
+   * the adapter does not carry is allowed and does nothing: that source was already left out.
+   */
+  @IsOptional()
+  @IsArray()
+  @ArrayMaxSize(BOOK_REQUEST_MEDIA_KINDS.length)
+  @IsIn(BOOK_REQUEST_MEDIA_KINDS, { each: true })
+  disabledMediaKinds?: BookRequestMediaKind[];
+
+  /** Accepted for any adapter, and simply unused by one that never searches an ISBN. */
+  @IsOptional()
+  @IsBoolean()
+  isbnSearchDisabled?: boolean;
+
+  /**
+   * Deliberately opaque here. An adapter loaded at runtime declares its own fields, so no class
+   * could enumerate them; `IndexerConfigService` validates the object against the adapter's own
+   * `settingsFields` and drops anything it did not declare, which is the same protection
+   * `forbidNonWhitelisted` gives the fields it does know about.
+   */
+  @IsOptional()
+  @IsObject()
+  settings?: Record<string, unknown>;
+
+  @IsOptional()
+  @ValidateNested()
+  @Type(() => NetworkProfileDto)
+  networkProfile?: NetworkProfileDto | null;
+}
diff --git a/server/src/modules/book-request/indexers/indexer-adapter.ts b/server/src/modules/book-request/indexers/indexer-adapter.ts
new file mode 100644
index 000000000..ff379779a
--- /dev/null
+++ b/server/src/modules/book-request/indexers/indexer-adapter.ts
@@ -0,0 +1,191 @@
+import type {
+  BookRequestMediaKind,
+  IndexerSettingsField,
+  IndexerAdapterType,
+  IndexerCategoryMap,
+  IndexerColor,
+  IndexerSearchFailure,
+  IndexerSettings,
+  IndexerTestResult,
+  NetworkProfile,
+  ReleaseAudioInfo,
+} from '@bookorbit/types';
+
+/** An indexer row with its credential already decrypted. Never logged, never returned over HTTP. */
+export interface ResolvedIndexerConfig {
+  id: number;
+  name: string;
+  /** The operator's colour for this source, carried so a search status can report it unlooked-up. */
+  color: IndexerColor | null;
+  adapterType: IndexerAdapterType;
+  baseUrl: string;
+  /** A torznab API key or a tracker session id, depending on the adapter. */
+  credential: string | null;
+  /**
+   * Why the stored credential could not be read, where that is what happened. Set only on the
+   * batch resolve behind a search: a rotated or unset encryption key must not abort a fan-out over
+   * every other source, so the row is searched-as-refused rather than left out or thrown over.
+   * Null everywhere else, including on the single-indexer resolve, which throws instead.
+   */
+  credentialError: string | null;
+  allowPrivateAddress: boolean;
+  categories: IndexerCategoryMap;
+  /** Media the operator took this source out of, on top of what its adapter declares it carries. */
+  disabledMediaKinds: readonly BookRequestMediaKind[];
+  /**
+   * Whether the operator has taken the ISBN away from this source. Applied by withholding it from
+   * the query rather than by asking the adapter to ignore one, so an adapter that searches an ISBN
+   * alongside the title and author is turned off just as completely as one that only searches it.
+   */
+  isbnSearchDisabled: boolean;
+  settings: IndexerSettings | null;
+  /** How to reach this source, applied by the host rather than chosen by the adapter. */
+  networkProfile: NetworkProfile | null;
+}
+
+export interface ReleaseQuery {
+  title: string;
+  author: string | null;
+  isbn13: string | null;
+  /** Every canonical ISBN accepted for the work. `isbn13` remains the first for older plugins. */
+  isbn13s: string[];
+  mediaKind: BookRequestMediaKind;
+  /** Language the request asked for, as a hard filter when the release states one. */
+  language: string | null;
+  limit: number;
+}
+
+/**
+ * One release as an indexer describes it. Everything past `title` is optional because trackers
+ * differ wildly in what they expose, and scoring has to degrade rather than reject a sparse row.
+ */
+export interface ReleaseCandidate {
+  indexerId: number;
+  /** Stable within an indexer, and how a grab names the release it wants. */
+  guid: string;
+  title: string;
+  /**
+   * The bare work title, where the indexer publishes one alongside the decorated release name.
+   * Scored against instead of `title`, never displayed: the release name is what carries the
+   * language and format flags an approver reads.
+   */
+  bookTitle?: string;
+  downloadUrl?: string;
+  magnet?: string;
+  infoHash?: string;
+  sizeBytes: number | null;
+  /**
+   * Null means the indexer reported no swarm counts, which must not be read as zero seeders: the
+   * zero-seeder hard filter would then drop every release from an indexer that omits the field.
+   */
+  seeders: number | null;
+  leechers: number | null;
+  format?: string;
+  language?: string;
+  author?: string;
+  /**
+   * An identifier the indexer states for the edition. Deliberately not typed as an ISBN:
+   * MyAnonaMouse returns `ASIN:B08G9PRS1K` in the same field, and normalisation rejects it.
+   */
+  isbn?: string;
+  freeleech?: boolean;
+  /**
+   * The account behind this indexer has already snatched this release, where the source says so.
+   * Shown on the row and never filtered on: sources report it minutes late.
+   */
+  alreadyGrabbed?: boolean;
+  /**
+   * The tracker answers the download link with a refusal unless the account is VIP, so the picker
+   * marks the release rather than letting the approver find out at grab time.
+   */
+  vipOnly?: boolean;
+  publishedAt?: string;
+  /** Where the indexer publishes audio characteristics. Shown and sorted on, never scored. */
+  audio?: ReleaseAudioInfo;
+  /**
+   * Primary-format files this release carries, where the indexer exposes an actual file list.
+   * Undefined means it did not, and the multi-file check falls through to import time.
+   */
+  primaryFileCount?: number;
+  /**
+   * Total files, where the indexer reports only a count. Weaker than `primaryFileCount`, since a
+   * cover image counts too, so it is a scoring penalty rather than a hard filter.
+   */
+  fileCount?: number;
+  /**
+   * Seeding the tracker requires of this release, where it states them. A default only: the
+   * operator's own per-indexer figures win, since those are a deliberate choice and these are
+   * merely what the tracker asks for.
+   */
+  seedRatioGoal?: number;
+  seedTimeMinutes?: number;
+}
+
+/**
+ * A failure the picker can act on. An expired tracker session must never reach the UI as an
+ * empty result list, which is exactly how MyAnonaMouse reports one.
+ */
+export class IndexerSearchException extends Error {
+  constructor(
+    readonly failure: IndexerSearchFailure,
+    message: string,
+  ) {
+    super(message);
+    this.name = 'IndexerSearchException';
+  }
+}
+
+/** One file, resolved from a release that is served over plain HTTP rather than as a torrent. */
+export interface ReleaseFile {
+  url: string;
+  fileName: string;
+  /** Known here even where the search could not state one, since a single file has a real size. */
+  sizeBytes: number | null;
+  format: string;
+}
+
+/** What a credentialed torrent download endpoint resolves to after redirects are followed. */
+export type TorrentFetchResult = Buffer | { magnet: string };
+
+export interface IndexerAdapter {
+  readonly type: IndexerAdapterType;
+  readonly label: string;
+  /**
+   * Which media this source can answer for. A source asked for one it does not serve is reported
+   * as not covering it, rather than contributing an empty list that reads as "nothing exists".
+   */
+  readonly mediaKinds: readonly BookRequestMediaKind[];
+  /** Whether an ISBN replaces the title and author query when one is active. */
+  readonly supportsIsbnSearch: boolean;
+  /**
+   * Extra settings this adapter reads. The list is what the form renders and what the service
+   * whitelists against, so an adapter that declares nothing can store nothing.
+   */
+  readonly settingsFields?: readonly IndexerSettingsField[];
+  /**
+   * Whether the adapter can do anything at all without one. A private tracker cannot, and saving
+   * a row that every search will reject is worth refusing at the form rather than discovering in
+   * the picker.
+   */
+  readonly requiresCredential: boolean;
+
+  /** The signal carries the per-indexer timeout, so one slow tracker cannot hold up the merge. */
+  search(query: ReleaseQuery, config: ResolvedIndexerConfig, signal: AbortSignal): Promise<ReleaseCandidate[]>;
+  test(config: ResolvedIndexerConfig): Promise<IndexerTestResult>;
+  /** Private trackers need an authenticated .torrent fetch rather than a public magnet. */
+  fetchTorrentFile?(release: ReleaseCandidate, config: ResolvedIndexerConfig): Promise<TorrentFetchResult>;
+  /**
+   * Sources that serve the file itself. An adapter implements this or `fetchTorrentFile`, never
+   * both: which one it declares is what decides whether a grab becomes a torrent or a download.
+   */
+  resolveFile?(release: ReleaseCandidate, config: ResolvedIndexerConfig, signal: AbortSignal): Promise<ReleaseFile>;
+  /**
+   * Trackers whose session expires on its own clock. Called on a schedule for every enabled row
+   * of this type, so a session does not lapse between one approval and the next.
+   */
+  keepalive?(config: ResolvedIndexerConfig): Promise<void>;
+  /** Drop anything cached against this indexer id when its URL or credential changes. */
+  forget?(indexerId: number): void;
+}
+
+export const INDEXER_ADAPTERS = Symbol('INDEXER_ADAPTERS');
diff --git a/server/src/modules/book-request/indexers/indexer-config.service.test.ts b/server/src/modules/book-request/indexers/indexer-config.service.test.ts
new file mode 100644
index 000000000..580f0f1e2
--- /dev/null
+++ b/server/src/modules/book-request/indexers/indexer-config.service.test.ts
@@ -0,0 +1,373 @@
+import { BadRequestException, ConflictException, NotFoundException } from '@nestjs/common';
+import { DEFAULT_INDEXER_CATEGORIES, INDEXER_COLORS } from '@bookorbit/types';
+
+import type { RequestIndexerRow } from '../../../db/schema';
+import { IndexerConfigService } from './indexer-config.service';
+
+function indexerRow(overrides: Partial<RequestIndexerRow> = {}): RequestIndexerRow {
+  return {
+    id: 9,
+    name: 'jackett',
+    adapterType: 'torznab',
+    enabled: true,
+    // TEST-NET-3 literal: no DNS lookup in tests, and not a private address.
+    baseUrl: 'http://203.0.113.10:9117',
+    credentialsEnc: 'cipher',
+    allowPrivateAddress: false,
+    categories: null,
+    settings: null,
+    lastTestedAt: null,
+    lastTestOk: null,
+    lastErrorMessage: null,
+    createdAt: new Date('2026-08-18T00:00:00Z'),
+    updatedAt: new Date('2026-08-18T00:00:00Z'),
+    ...overrides,
+  };
+}
+
+function makeService(
+  overrides: {
+    repo?: Record<string, unknown>;
+    credentials?: Record<string, unknown>;
+    adapter?: Record<string, unknown>;
+    registry?: Record<string, unknown>;
+  } = {},
+) {
+  const repo = {
+    findAll: vi.fn().mockResolvedValue([indexerRow()]),
+    findAssignedColors: vi.fn().mockResolvedValue([null]),
+    findById: vi.fn().mockResolvedValue(indexerRow()),
+    findAllEnabled: vi.fn().mockResolvedValue([indexerRow()]),
+    create: vi.fn().mockResolvedValue(indexerRow()),
+    update: vi.fn().mockResolvedValue(indexerRow()),
+    delete: vi.fn().mockResolvedValue(undefined),
+    recordTestResult: vi.fn().mockResolvedValue(undefined),
+    ...overrides.repo,
+  };
+  const credentials = {
+    encrypt: vi.fn().mockReturnValue('cipher'),
+    decrypt: vi.fn().mockReturnValue('api-key'),
+    isConfigured: vi.fn().mockReturnValue(true),
+    ...overrides.credentials,
+  };
+  const adapter = {
+    label: 'Torznab',
+    requiresCredential: false,
+    test: vi.fn().mockResolvedValue({ success: true, indexerName: 'Jackett' }),
+    forget: vi.fn(),
+    ...overrides.adapter,
+  };
+  const registry = {
+    require: vi.fn().mockReturnValue(adapter),
+    find: vi.fn().mockReturnValue(adapter),
+    defaultCategories: vi.fn().mockReturnValue(DEFAULT_INDEXER_CATEGORIES.torznab),
+    ...overrides.registry,
+  };
+  return {
+    service: new IndexerConfigService(repo as never, credentials as never, registry as never),
+    repo,
+    credentials,
+    registry,
+    adapter,
+  };
+}
+
+const createDto = { name: 'jackett', adapterType: 'torznab' as const, baseUrl: 'http://203.0.113.10:9117' };
+
+describe('IndexerConfigService', () => {
+  it('never returns the stored credential, only whether there is one', async () => {
+    const { service } = makeService();
+
+    const { indexers } = await service.findAll();
+
+    expect(indexers[0].hasCredential).toBe(true);
+    expect(JSON.stringify(indexers[0])).not.toContain('cipher');
+  });
+
+  it('encrypts a credential rather than storing it in the clear', async () => {
+    const { service, credentials, repo } = makeService();
+
+    await service.create({ ...createDto, credential: 'api-key' });
+
+    expect(credentials.encrypt).toHaveBeenCalledWith('api-key');
+    expect(repo.create).toHaveBeenCalledWith(expect.objectContaining({ credentialsEnc: 'cipher' }));
+  });
+
+  it('assigns a random unused color when a new indexer does not name one', async () => {
+    const existing = INDEXER_COLORS.filter((color) => color !== 'teal');
+    const { service, repo } = makeService({ repo: { findAssignedColors: vi.fn().mockResolvedValue(existing) } });
+
+    await service.create(createDto);
+
+    expect(repo.create).toHaveBeenCalledWith(expect.objectContaining({ color: 'teal' }));
+  });
+
+  it('preserves an explicit no-color choice on a new indexer', async () => {
+    const { service, repo } = makeService();
+
+    await service.create({ ...createDto, color: null });
+
+    expect(repo.findAssignedColors).not.toHaveBeenCalled();
+    expect(repo.create).toHaveBeenCalledWith(expect.objectContaining({ color: null }));
+  });
+
+  /** The refusal is the point: a tracker key in the clear is worse than a form that will not save. */
+  it('lets the refusal to encrypt without a key surface instead of saving plaintext', async () => {
+    const { service, repo } = makeService({
+      credentials: {
+        encrypt: vi.fn(() => {
+          throw new BadRequestException({ message: 'no key', errorCode: 'REQUEST_ENCRYPTION_KEY_MISSING' });
+        }),
+      },
+    });
+
+    await expect(service.create({ ...createDto, credential: 'api-key' })).rejects.toThrow(BadRequestException);
+    expect(repo.create).not.toHaveBeenCalled();
+  });
+
+  /**
+   * Unlike a download client this defaults to off: a public tracker has no business resolving to a
+   * private address, and a self-hosted torznab proxy is the one case worth opting into.
+   */
+  it('refuses a private address unless the row opts in', async () => {
+    const { service, repo } = makeService();
+
+    await expect(service.create({ ...createDto, baseUrl: 'http://192.168.1.10:9117' })).rejects.toMatchObject({
+      response: expect.objectContaining({ errorCode: 'INDEXER_URL_PRIVATE' }),
+    });
+    expect(repo.create).not.toHaveBeenCalled();
+
+    await expect(service.create({ ...createDto, baseUrl: 'http://192.168.1.10:9117', allowPrivateAddress: true })).resolves.toBeDefined();
+  });
+
+  it('keeps the stored credential when the form omits one', async () => {
+    const { service, repo } = makeService();
+
+    await service.update(9, { enabled: false });
+
+    expect(repo.update).toHaveBeenCalledWith(9, { enabled: false });
+  });
+
+  it('clears the credential when the form sends an empty one', async () => {
+    const { service, repo } = makeService();
+
+    await service.update(9, { credential: '' });
+
+    expect(repo.update).toHaveBeenCalledWith(9, { credentialsEnc: null });
+  });
+
+  /**
+   * A rotated or unset `BOOK_REQUEST_ENCRYPTION_KEY` leaves stored credentials unreadable. One such
+   * row used to abort the whole resolve, so a search fanned out over nothing and the picker showed
+   * an error with no sources in it.
+   */
+  it('carries the refusal on the row rather than abandoning every other enabled source', async () => {
+    const { service, credentials } = makeService({
+      repo: { findAllEnabled: vi.fn().mockResolvedValue([indexerRow({ id: 1 }), indexerRow({ id: 2, credentialsEnc: null })]) },
+    });
+    credentials.decrypt.mockImplementation(() => {
+      throw new BadRequestException('Stored credentials could not be decrypted');
+    });
+
+    const configs = await service.resolveEnabledConfigs();
+
+    expect(configs).toHaveLength(2);
+    expect(configs[0]).toMatchObject({ id: 1, credential: null, credentialError: expect.stringContaining('could not be decrypted') });
+    // A source holding no credential never touched the key, so it is unaffected.
+    expect(configs[1]).toMatchObject({ id: 2, credential: null, credentialError: null });
+  });
+
+  /** The single-indexer resolve is about that one indexer, so its caller wants the refusal thrown. */
+  it('still throws when a single indexer is resolved by id', async () => {
+    const { service, credentials } = makeService();
+    credentials.decrypt.mockImplementation(() => {
+      throw new BadRequestException('Stored credentials could not be decrypted');
+    });
+
+    await expect(service.resolveConfig(9)).rejects.toThrow(BadRequestException);
+  });
+
+  /** A cached session outliving its config would keep talking to the old host with the old key. */
+  it('drops the adapter session when the connection details change', async () => {
+    const { service, adapter } = makeService();
+
+    await service.update(9, { baseUrl: 'http://203.0.113.11:9117' });
+    expect(adapter.forget).toHaveBeenCalledWith(9);
+
+    adapter.forget.mockClear();
+    await service.update(9, { enabled: false });
+    expect(adapter.forget).not.toHaveBeenCalled();
+  });
+
+  it('falls back to the adapter default categories for a medium left blank', async () => {
+    const { service, repo } = makeService();
+
+    await service.create({ ...createDto, categories: { ebook: [8010] } });
+
+    expect(repo.create).toHaveBeenCalledWith(expect.objectContaining({ categories: { ebook: [8010], audiobook: [3030], comic: [7030] } }));
+  });
+
+  /** A key for one tracker is not a key for another, and its settings are the old adapter's. */
+  it('drops the stored credential and settings when the adapter type changes', async () => {
+    const { service, repo } = makeService({
+      repo: { findById: vi.fn().mockResolvedValue(indexerRow({ adapterType: 'torznab', credentialsEnc: 'cipher', settings: { seedTime: 4 } })) },
+    });
+
+    await service.update(1, { adapterType: 'newznab' as never });
+
+    expect(repo.update).toHaveBeenCalledWith(1, expect.objectContaining({ credentialsEnc: null, settings: null }));
+  });
+
+  it('does not carry an overlapping setting key into a different adapter', async () => {
+    const { service, repo } = makeService({
+      repo: { findById: vi.fn().mockResolvedValue(indexerRow({ adapterType: 'old-plugin', settings: { minSeeders: 4 } })) },
+      registry: {
+        require: vi.fn().mockReturnValue({ settingsFields: [{ key: 'minSeeders', label: 'Minimum seeders', type: 'number' }] }),
+      },
+    });
+
+    await service.update(1, { adapterType: 'new-plugin' as never });
+
+    expect(repo.update).toHaveBeenCalledWith(1, expect.objectContaining({ settings: null }));
+  });
+
+  it('keeps the stored credential when the adapter type is unchanged', async () => {
+    const { service, repo } = makeService({
+      repo: { findById: vi.fn().mockResolvedValue(indexerRow({ adapterType: 'torznab', credentialsEnc: 'cipher' })) },
+    });
+
+    await service.update(1, { name: 'renamed' });
+
+    expect(repo.update).toHaveBeenCalledWith(1, { name: 'renamed' });
+  });
+
+  /** A plugin declares its own; the compile-time map only knows the built-ins. */
+  it('falls back to a plugin adapter default categories rather than to nothing', async () => {
+    const { service, repo } = makeService({
+      registry: { defaultCategories: vi.fn().mockReturnValue({ ebook: [4040], audiobook: [4050], comic: [] }) },
+    });
+
+    await service.create({ ...createDto, adapterType: 'librivox' as never, categories: undefined });
+
+    expect(repo.create).toHaveBeenCalledWith(expect.objectContaining({ categories: { ebook: [4040], audiobook: [4050], comic: [] } }));
+  });
+
+  it('reports a duplicate name as a conflict rather than a 500', async () => {
+    const { service } = makeService({
+      repo: { create: vi.fn().mockRejectedValue(new Error('Failed query', { cause: Object.assign(new Error('dupe'), { code: '23505' }) })) },
+    });
+
+    await expect(service.create(createDto)).rejects.toThrow(ConflictException);
+  });
+
+  it('404s an indexer that does not exist', async () => {
+    const { service } = makeService({ repo: { findById: vi.fn().mockResolvedValue(undefined) } });
+
+    await expect(service.findOne(9)).rejects.toThrow(NotFoundException);
+  });
+
+  it('refuses a source-only delete for a plugin-backed indexer', async () => {
+    const { service, repo } = makeService({ repo: { findById: vi.fn().mockResolvedValue(indexerRow({ adapterType: 'demo-tracker' })) } });
+
+    await expect(service.remove(9)).rejects.toThrow(/deleted with its plugin/i);
+    expect(repo.delete).not.toHaveBeenCalled();
+  });
+
+  /**
+   * An indexer that needs a key rejects every search without one, and doing so as a per-indexer
+   * failure in the picker hides it from the one person who could fix it.
+   */
+  it('refuses to save an adapter that cannot work without a credential', async () => {
+    const { service, repo } = makeService({ adapter: { label: 'Torznab', requiresCredential: true } });
+
+    await expect(service.create({ ...createDto, adapterType: 'torznab' })).rejects.toMatchObject({
+      response: expect.objectContaining({ errorCode: 'INDEXER_CREDENTIAL_REQUIRED' }),
+    });
+    expect(repo.create).not.toHaveBeenCalled();
+
+    await expect(service.create({ ...createDto, adapterType: 'torznab', credential: 'an-api-key' })).resolves.toBeDefined();
+  });
+
+  /** Editing an unrelated field must not trip the rule on a row that already holds a session. */
+  it('counts the stored credential when the form omits one', async () => {
+    const { service, repo } = makeService({ adapter: { label: 'Torznab', requiresCredential: true } });
+
+    await expect(service.update(9, { enabled: false })).resolves.toBeDefined();
+    expect(repo.update).toHaveBeenCalledWith(9, { enabled: false });
+
+    await expect(service.update(9, { credential: '' })).rejects.toMatchObject({
+      response: expect.objectContaining({ errorCode: 'INDEXER_CREDENTIAL_REQUIRED' }),
+    });
+  });
+
+  it('stamps the row with the test outcome so the settings card can show it', async () => {
+    const { service, repo } = makeService();
+
+    await expect(service.test(9)).resolves.toMatchObject({ success: true });
+    expect(repo.recordTestResult).toHaveBeenCalledWith(9, true, null);
+  });
+
+  it('keeps bounded plugin strings large enough for challenge cookies', async () => {
+    const { service, repo } = makeService({
+      adapter: { settingsFields: [{ key: 'challengeCookies', type: 'string', label: 'Challenge cookies' }] },
+    });
+    const challengeCookies = 'x'.repeat(2_048);
+
+    await service.create({ ...createDto, settings: { challengeCookies } });
+
+    expect(repo.create).toHaveBeenCalledWith(expect.objectContaining({ settings: { challengeCookies } }));
+  });
+
+  it('drops plugin strings above the bounded setting limit', async () => {
+    const { service, repo } = makeService({
+      adapter: { settingsFields: [{ key: 'challengeCookies', type: 'string', label: 'Challenge cookies' }] },
+    });
+
+    await service.create({ ...createDto, settings: { challengeCookies: 'x'.repeat(2_049) } });
+
+    expect(repo.create).toHaveBeenCalledWith(expect.objectContaining({ settings: null }));
+  });
+
+  it('canonicalizes a constrained plugin list before storing it', async () => {
+    const { service, repo } = makeService({
+      adapter: {
+        settingsFields: [
+          {
+            key: 'ebookFormats',
+            type: 'string',
+            format: 'list',
+            label: 'Ebook formats',
+            options: ['epub', 'mobi', 'pdf'],
+            minItems: 1,
+          },
+        ],
+      },
+    });
+
+    await service.create({ ...createDto, settings: { ebookFormats: ' EPUB, mobi,epub ' } });
+
+    expect(repo.create).toHaveBeenCalledWith(expect.objectContaining({ settings: { ebookFormats: 'epub,mobi' } }));
+  });
+
+  it.each(['epubdsdsd', ''])('refuses an unusable constrained plugin list: %s', async (ebookFormats) => {
+    const { service, repo } = makeService({
+      adapter: {
+        settingsFields: [
+          {
+            key: 'ebookFormats',
+            type: 'string',
+            format: 'list',
+            label: 'Ebook formats',
+            options: ['epub', 'mobi', 'pdf'],
+            minItems: 1,
+          },
+        ],
+      },
+    });
+
+    await expect(service.create({ ...createDto, settings: { ebookFormats } })).rejects.toMatchObject({
+      response: expect.objectContaining({ errorCode: 'INDEXER_SETTINGS_INVALID' }),
+    });
+    expect(repo.create).not.toHaveBeenCalled();
+  });
+});
diff --git a/server/src/modules/book-request/indexers/indexer-config.service.ts b/server/src/modules/book-request/indexers/indexer-config.service.ts
new file mode 100644
index 000000000..65590c515
--- /dev/null
+++ b/server/src/modules/book-request/indexers/indexer-config.service.ts
@@ -0,0 +1,396 @@
+import { BadGatewayException, BadRequestException, ConflictException, HttpStatus, Injectable, Logger, NotFoundException } from '@nestjs/common';
+import { BOOK_REQUEST_MEDIA_KINDS, INDEXER_ADAPTER_TYPES, pickUnusedIndexerColor } from '@bookorbit/types';
+import type {
+  BookRequestMediaKind,
+  BookRequestSourceStatus,
+  IndexerAdapterType,
+  IndexerCategoryMap,
+  IndexerErrorCode,
+  IndexerItem,
+  IndexerListResult,
+  IndexerSettings,
+  IndexerSettingsField,
+  IndexerTestResult,
+} from '@bookorbit/types';
+
+import { isUniqueViolation } from '../../../common/utils/db-error.utils';
+import { sanitizeLogValue } from '../../../common/utils/log-sanitize.utils';
+import { PrivateAddressException, ensureSafeUrl } from '../../../common/utils/ssrf.utils';
+import type { RequestIndexerRow } from '../../../db/schema';
+import { RequestCredentialService } from '../request-credential.service';
+import type { ResolvedIndexerConfig } from './indexer-adapter';
+import { IndexerRegistry } from './indexer-registry';
+import { IndexerRepository } from './indexer.repository';
+import type { CreateIndexerDto, UpdateIndexerDto } from './dto/indexer.dto';
+
+const MAX_INDEXER_SETTING_STRING_LENGTH = 2_048;
+
+/** Editing any of these changes how the adapter reaches the tracker, so its session must be dropped. */
+const CONNECTION_FIELDS = ['baseUrl', 'credential', 'allowPrivateAddress', 'adapterType'] as const satisfies ReadonlyArray<keyof UpdateIndexerDto>;
+
+@Injectable()
+export class IndexerConfigService {
+  private readonly logger = new Logger(IndexerConfigService.name);
+
+  constructor(
+    private readonly repo: IndexerRepository,
+    private readonly credentials: RequestCredentialService,
+    private readonly registry: IndexerRegistry,
+  ) {}
+
+  async findAll(): Promise<IndexerListResult> {
+    const rows = await this.repo.findAll();
+    return { indexers: rows.map((row) => this.toItem(row)), encryptionConfigured: this.credentials.isConfigured() };
+  }
+
+  async findOne(id: number): Promise<IndexerItem> {
+    return this.toItem(await this.requireIndexer(id));
+  }
+
+  /**
+   * The categories a row actually searches: what the operator chose, or what the adapter declares
+   * for the ones they left alone. Read through the registry, so a plugin's own defaults are used
+   * rather than the compile-time map, which only knows the built-ins.
+   */
+  private resolveCategories(row: RequestIndexerRow): IndexerCategoryMap {
+    return mergeCategories(this.registry.defaultCategories(row.adapterType), row.categories ?? undefined);
+  }
+
+  private toItem(row: RequestIndexerRow): IndexerItem {
+    return toItem(row, this.resolveCategories(row));
+  }
+
+  async create(dto: CreateIndexerDto): Promise<IndexerItem> {
+    // Everything that can reject the save runs before anything is written, so a rejected URL does
+    // not leave a half-made indexer behind whose name the operator then cannot save over.
+    await this.assertReachableUrl(dto.baseUrl, dto.allowPrivateAddress ?? false);
+    this.assertCredentialPresent(dto.adapterType, Boolean(dto.credential?.trim()));
+    const credentialsEnc = dto.credential ? this.credentials.encrypt(dto.credential) : null;
+    const color = dto.color === undefined ? pickUnusedIndexerColor(await this.repo.findAssignedColors()) : dto.color;
+
+    try {
+      const created = await this.repo.create({
+        name: dto.name.trim(),
+        color,
+        adapterType: dto.adapterType,
+        baseUrl: dto.baseUrl.trim(),
+        credentialsEnc,
+        enabled: dto.enabled ?? true,
+        allowPrivateAddress: dto.allowPrivateAddress ?? false,
+        categories: mergeCategories(this.registry.defaultCategories(dto.adapterType), dto.categories),
+        disabledMediaKinds: normalizeDisabledMediaKinds(dto.disabledMediaKinds),
+        isbnSearchDisabled: dto.isbnSearchDisabled ?? false,
+        settings: this.cleanSettings(dto.adapterType, dto.settings),
+        networkProfile: dto.networkProfile ?? null,
+      });
+      this.logger.log(`[request_indexer.create] [end] indexerId=${created.id} adapterType=${created.adapterType} - indexer created`);
+      return this.toItem(created);
+    } catch (error) {
+      throw this.translateUniqueViolation(error);
+    }
+  }
+
+  async update(id: number, dto: UpdateIndexerDto): Promise<IndexerItem> {
+    const existing = await this.requireIndexer(id);
+
+    const baseUrl = dto.baseUrl?.trim() ?? existing.baseUrl;
+    const allowPrivate = dto.allowPrivateAddress ?? existing.allowPrivateAddress;
+    if (dto.baseUrl !== undefined || dto.allowPrivateAddress !== undefined) {
+      await this.assertReachableUrl(baseUrl, allowPrivate);
+    }
+
+    const adapterType = (dto.adapterType ?? existing.adapterType) as IndexerAdapterType;
+    // A credential and a settings blob belong to the adapter they were entered for. Carrying them
+    // across a type change leaves the row holding a key of the wrong kind and settings the new
+    // adapter never declared, which then reach it as a rejected search rather than as a refusal
+    // the operator can act on while the form is still open.
+    const changesAdapter = adapterType !== existing.adapterType;
+    const keepsCredential = dto.credential === undefined ? !changesAdapter && existing.credentialsEnc !== null : Boolean(dto.credential.trim());
+    this.assertCredentialPresent(adapterType, keepsCredential);
+
+    const patch: Partial<RequestIndexerRow> = {};
+    if (dto.name !== undefined) patch.name = dto.name.trim();
+    if (dto.color !== undefined) patch.color = dto.color;
+    if (dto.adapterType !== undefined) patch.adapterType = dto.adapterType;
+    if (dto.baseUrl !== undefined) patch.baseUrl = baseUrl;
+    if (dto.enabled !== undefined) patch.enabled = dto.enabled;
+    if (dto.allowPrivateAddress !== undefined) patch.allowPrivateAddress = dto.allowPrivateAddress;
+    if (dto.categories !== undefined) patch.categories = mergeCategories(this.registry.defaultCategories(adapterType), dto.categories);
+    if (dto.disabledMediaKinds !== undefined) patch.disabledMediaKinds = normalizeDisabledMediaKinds(dto.disabledMediaKinds);
+    if (dto.isbnSearchDisabled !== undefined) patch.isbnSearchDisabled = dto.isbnSearchDisabled;
+    if (dto.settings !== undefined) patch.settings = this.cleanSettings(adapterType, dto.settings);
+    else if (changesAdapter) patch.settings = null;
+    if (dto.networkProfile !== undefined) patch.networkProfile = dto.networkProfile;
+    // An omitted credential keeps the stored one, so the settings form never round-trips a secret.
+    if (dto.credential !== undefined) patch.credentialsEnc = dto.credential ? this.credentials.encrypt(dto.credential) : null;
+    else if (changesAdapter) patch.credentialsEnc = null;
+
+    try {
+      if (Object.keys(patch).length > 0 && !(await this.repo.update(id, patch))) {
+        throw new NotFoundException('Indexer not found');
+      }
+    } catch (error) {
+      throw this.translateUniqueViolation(error);
+    }
+
+    // A cached session outliving the config it was opened with would keep talking to the old host
+    // with the old credential until it happened to be rejected.
+    if (CONNECTION_FIELDS.some((field) => dto[field] !== undefined)) {
+      this.registry.find(existing.adapterType as IndexerAdapterType)?.forget?.(id);
+    }
+
+    return this.toItem(await this.requireIndexer(id));
+  }
+
+  async remove(id: number): Promise<void> {
+    const existing = await this.requireIndexer(id);
+    if (!(INDEXER_ADAPTER_TYPES as readonly string[]).includes(existing.adapterType)) {
+      throw new BadRequestException('A plugin-backed source must be deleted with its plugin');
+    }
+    this.registry.find(existing.adapterType as IndexerAdapterType)?.forget?.(id);
+    await this.repo.delete(id);
+    this.logger.log(`[request_indexer.delete] [end] indexerId=${id} - indexer removed`);
+  }
+
+  /**
+   * A test that ran and came back negative answers 502 rather than 200. The stored health stamp
+   * is written either way, so the card still shows what happened; what changes is that a script,
+   * a curl or a log line can no longer read a refused connection as a pass.
+   */
+  async test(id: number): Promise<IndexerTestResult> {
+    const config = await this.resolveConfig(id);
+    const adapter = this.registry.require(config.adapterType);
+    const result = await adapter.test(config);
+    const reason = result.success ? null : (result.error ?? 'Unknown error');
+    await this.repo.recordTestResult(id, result.success, reason);
+
+    if (reason !== null) {
+      throw new BadGatewayException({ message: reason, errorCode: 'INDEXER_TEST_FAILED', statusCode: HttpStatus.BAD_GATEWAY });
+    }
+    return result;
+  }
+
+  /**
+   * How many sources exist and how many are on. The only fact about the indexer list a requester
+   * is allowed, and what lets an empty release list say why it is empty.
+   */
+  countSources(): Promise<BookRequestSourceStatus> {
+    return this.repo.countSources();
+  }
+
+  /**
+   * How the last real search went, per source. Written by the search rather than read by it: the
+   * settings list is where this is shown, and a picker's live failure list stops existing the
+   * moment the drawer closes.
+   */
+  recordSearchOutcomes(outcomes: ReadonlyArray<{ indexerId: number; ok: boolean; error: string | null }>): Promise<void> {
+    return this.repo.recordSearchOutcomes(outcomes);
+  }
+
+  /**
+   * Every enabled indexer, resolved for search. One decrypt pass, not one per release.
+   *
+   * Decrypted per row rather than in one throwing pass. A rotated or unset
+   * `BOOK_REQUEST_ENCRYPTION_KEY` leaves stored credentials unreadable, and one such row used to
+   * abort the whole fan-out: every other source, including the ones holding no credential at all,
+   * went unsearched and the picker showed an error with nothing in it. The row travels with its
+   * own refusal instead, so the search reports it as that source's failure.
+   */
+  async resolveEnabledConfigs(): Promise<ResolvedIndexerConfig[]> {
+    const rows = await this.repo.findAllEnabled();
+    return rows.map((row) => {
+      try {
+        return this.toConfig(row);
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        this.logger.warn(
+          `[request_indexer.resolve] [fail] indexerId=${row.id} error="${sanitizeLogValue(message)}" - the stored credential could not be read, so this source is reported as unauthorized`,
+        );
+        return { ...this.toConfig({ ...row, credentialsEnc: null }), credentialError: message };
+      }
+    });
+  }
+
+  /**
+   * The only place a credential is decrypted. Callers get a value object, never the row, so a
+   * `credentialsEnc` blob cannot reach a response body or a log line by accident.
+   */
+  async resolveConfig(id: number): Promise<ResolvedIndexerConfig> {
+    return this.toConfig(await this.requireIndexer(id));
+  }
+
+  private toConfig(row: RequestIndexerRow): ResolvedIndexerConfig {
+    return {
+      id: row.id,
+      name: row.name,
+      color: row.color ?? null,
+      adapterType: row.adapterType as IndexerAdapterType,
+      baseUrl: row.baseUrl,
+      credential: row.credentialsEnc ? this.credentials.decrypt(row.credentialsEnc) : null,
+      credentialError: null,
+      allowPrivateAddress: row.allowPrivateAddress,
+      categories: this.resolveCategories(row),
+      disabledMediaKinds: normalizeDisabledMediaKinds(row.disabledMediaKinds),
+      isbnSearchDisabled: row.isbnSearchDisabled,
+      settings: row.settings ?? null,
+      networkProfile: row.networkProfile ?? null,
+    };
+  }
+
+  private async requireIndexer(id: number): Promise<RequestIndexerRow> {
+    const row = await this.repo.findById(id);
+    if (!row) throw new NotFoundException('Indexer not found');
+    return row;
+  }
+
+  /**
+   * Whitelisting by the adapter's own declaration, since the pipe cannot: `settings` is opaque at
+   * the DTO because an adapter loaded at runtime names its own fields. Anything undeclared is
+   * dropped rather than stored, so a jsonb column never takes a blob nobody asked for.
+   */
+  private cleanSettings(adapterType: string, settings: Record<string, unknown> | undefined): IndexerSettings | null {
+    if (!settings) return null;
+    const declared = this.registry.require(adapterType).settingsFields ?? [];
+    const kept: Record<string, unknown> = {};
+
+    for (const field of declared) {
+      const value = settings[field.key];
+      if (value === undefined || value === null) continue;
+      if (field.type === 'boolean' && typeof value !== 'boolean') continue;
+      if (field.type === 'number' && (typeof value !== 'number' || !Number.isFinite(value))) continue;
+      if (field.type === 'string' && (typeof value !== 'string' || value.length > MAX_INDEXER_SETTING_STRING_LENGTH)) continue;
+      kept[field.key] = field.type === 'string' && field.format === 'list' ? this.cleanListSetting(field, value as string) : value;
+    }
+
+    const dropped = Object.keys(settings).filter((key) => !(key in kept));
+    if (dropped.length > 0) {
+      this.logger.warn(
+        `[request_indexer.settings] [fail] adapterType=${adapterType} dropped="${sanitizeLogValue(dropped.join(','))}" - settings the adapter does not declare`,
+      );
+    }
+    return Object.keys(kept).length > 0 ? kept : null;
+  }
+
+  private cleanListSetting(field: IndexerSettingsField, value: string): string {
+    const canonicalByValue = field.options ? new Map(field.options.map((option) => [option.toLowerCase(), option])) : null;
+    const entries = canonicalByValue
+      ? [
+          ...new Map(
+            value
+              .split(',')
+              .map((entry) => entry.trim())
+              .filter(Boolean)
+              .map((entry) => [entry.toLowerCase(), entry]),
+          ).values(),
+        ]
+      : [
+          ...new Set(
+            value
+              .split(',')
+              .map((entry) => entry.trim())
+              .filter(Boolean),
+          ),
+        ];
+    const canonical = canonicalByValue
+      ? entries.map((entry) => canonicalByValue.get(entry.toLowerCase())).filter((entry): entry is string => entry !== undefined)
+      : entries;
+
+    if (canonicalByValue && canonical.length !== entries.length) {
+      throw indexerError('INDEXER_SETTINGS_INVALID', `${field.label} contains a value the plugin does not support`);
+    }
+    if (canonical.length < (field.minItems ?? 0)) {
+      throw indexerError('INDEXER_SETTINGS_INVALID', `${field.label} requires at least ${field.minItems} selection`);
+    }
+    return canonical.join(',');
+  }
+
+  /**
+   * A private tracker rejects every search without one, and it would do so as a per-indexer
+   * failure in the picker rather than as a save error the operator can act on.
+   */
+  private assertCredentialPresent(adapterType: string, hasCredential: boolean): void {
+    const adapter = this.registry.require(adapterType);
+    if (adapter.requiresCredential && !hasCredential) {
+      throw indexerError('INDEXER_CREDENTIAL_REQUIRED', `${adapter.label} cannot be used without a credential`);
+    }
+  }
+
+  /**
+   * Unlike a download client this defaults to off: a public tracker has no business resolving to
+   * a private address, and a self-hosted torznab proxy is the one case worth opting into.
+   */
+  private async assertReachableUrl(baseUrl: string, allowPrivate: boolean): Promise<void> {
+    try {
+      await ensureSafeUrl(baseUrl, { allowPrivate });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      this.logger.warn(`[request_indexer.url_check] [fail] error="${sanitizeLogValue(message)}" - rejected indexer base URL`);
+      const isPrivateAddress = error instanceof PrivateAddressException;
+      throw indexerError(
+        isPrivateAddress ? 'INDEXER_URL_PRIVATE' : 'INDEXER_URL_UNSAFE',
+        isPrivateAddress && !allowPrivate ? `${message}. Enable "Allow private addresses" if this is a torznab proxy on your own network.` : message,
+      );
+    }
+  }
+
+  private translateUniqueViolation(error: unknown): unknown {
+    if (isUniqueViolation(error)) {
+      return new ConflictException({ message: 'An indexer with this name already exists', errorCode: 'INDEXER_NAME_TAKEN' });
+    }
+    return error;
+  }
+}
+
+/** Carries a stable code alongside the English text, so the settings form can translate it. */
+function indexerError(errorCode: IndexerErrorCode, message: string): BadRequestException {
+  return new BadRequestException({ message, errorCode, statusCode: HttpStatus.BAD_REQUEST });
+}
+
+/**
+ * A medium the operator left blank falls back to the adapter's default rather than searching no
+ * categories at all, which most trackers answer with everything they have.
+ */
+function mergeCategories(defaults: IndexerCategoryMap, categories: Partial<IndexerCategoryMap> | undefined): IndexerCategoryMap {
+  return {
+    ebook: categories?.ebook ?? defaults.ebook,
+    audiobook: categories?.audiobook ?? defaults.audiobook,
+    comic: categories?.comic ?? defaults.comic,
+  };
+}
+
+/**
+ * A jsonb column can hold whatever a hand-edited row put there, and this list decides which
+ * searches a source is left out of. Anything that is not a medium is dropped rather than kept,
+ * so a typo cannot silently take a tracker out of every search.
+ */
+function normalizeDisabledMediaKinds(value: unknown): BookRequestMediaKind[] {
+  if (!Array.isArray(value)) return [];
+  return BOOK_REQUEST_MEDIA_KINDS.filter((kind) => value.includes(kind));
+}
+
+function toItem(row: RequestIndexerRow, categories: IndexerCategoryMap): IndexerItem {
+  return {
+    id: row.id,
+    name: row.name,
+    color: row.color ?? null,
+    adapterType: row.adapterType as IndexerAdapterType,
+    enabled: row.enabled,
+    baseUrl: row.baseUrl,
+    hasCredential: row.credentialsEnc !== null,
+    allowPrivateAddress: row.allowPrivateAddress,
+    categories,
+    disabledMediaKinds: normalizeDisabledMediaKinds(row.disabledMediaKinds),
+    isbnSearchDisabled: row.isbnSearchDisabled,
+    settings: row.settings ?? {},
+    networkProfile: row.networkProfile ?? null,
+    lastTestedAt: row.lastTestedAt?.toISOString() ?? null,
+    lastTestOk: row.lastTestOk,
+    lastErrorMessage: row.lastErrorMessage,
+    lastSearchAt: row.lastSearchAt?.toISOString() ?? null,
+    lastSearchOk: row.lastSearchOk,
+    lastSearchError: row.lastSearchError,
+    searchFailureStreak: row.searchFailureStreak,
+    createdAt: row.createdAt.toISOString(),
+    updatedAt: row.updatedAt.toISOString(),
+  };
+}
diff --git a/server/src/modules/book-request/indexers/indexer-credential-store.test.ts b/server/src/modules/book-request/indexers/indexer-credential-store.test.ts
new file mode 100644
index 000000000..c2d444b97
--- /dev/null
+++ b/server/src/modules/book-request/indexers/indexer-credential-store.test.ts
@@ -0,0 +1,130 @@
+import { IndexerCredentialStore } from './indexer-credential-store';
+
+/**
+ * A store over one in-memory row, with plaintext standing in for ciphertext. What is under test is
+ * which write lands, not the cipher, and the real `RequestCredentialService` is covered on its own.
+ */
+function makeStore(initial: string | null = 'session-1') {
+  const row: { id: number; credentialsEnc: string | null; updatedAt: Date } = {
+    id: 4,
+    credentialsEnc: initial,
+    updatedAt: new Date('2026-08-25T00:00:00Z'),
+  };
+  const repo = {
+    findById: vi.fn(() => Promise.resolve({ ...row })),
+    updateCredentialIfCurrent: vi.fn((_id: number, current: string | null, updatedAt: Date, replacement: string) => {
+      if (row.credentialsEnc !== current || row.updatedAt.getTime() !== updatedAt.getTime()) return Promise.resolve(false);
+      row.credentialsEnc = replacement;
+      row.updatedAt = new Date(row.updatedAt.getTime() + 1);
+      return Promise.resolve(true);
+    }),
+  };
+  const credentials = {
+    encrypt: vi.fn((value: string) => `enc:${value}`),
+    decrypt: vi.fn((value: string) => value.replace(/^enc:/, '')),
+  };
+
+  return { store: new IndexerCredentialStore(repo as never, credentials as never), repo, credentials, stored: () => row.credentialsEnc };
+}
+
+describe('IndexerCredentialStore.rotate', () => {
+  it('stores a session rotated from the one the caller was using', async () => {
+    const { store, stored } = makeStore();
+
+    await store.rotate(4, 'session-2', 'session-1');
+
+    expect(stored()).toBe('enc:session-2');
+  });
+
+  /**
+   * A tracker that rotates its session every request has a plugin calling this several times inside
+   * one search. The host advances the prior credential after each accepted write, so every save
+   * names the session it actually follows.
+   */
+  it('accepts a chain of rotations inside one search', async () => {
+    const { store, stored } = makeStore();
+
+    await store.rotate(4, 'session-2', 'session-1');
+    await store.rotate(4, 'session-3', 'session-2');
+
+    expect(stored()).toBe('enc:session-3');
+  });
+
+  /**
+   * The operator pasted a fresh credential into the settings form while a search was running. The
+   * search's rotation follows on from the session it opened with, which is no longer the one that
+   * matters, and writing it back would undo the save with no sign anything happened.
+   */
+  it('refuses a rotation from a session an operator has replaced', async () => {
+    const { store, repo, stored } = makeStore('enc:operator-typed-this');
+
+    await store.rotate(4, 'session-2', 'session-1');
+
+    expect(repo.updateCredentialIfCurrent).not.toHaveBeenCalled();
+    expect(stored()).toBe('enc:operator-typed-this');
+  });
+
+  it('accepts a rotation that follows on from the credential an operator just saved', async () => {
+    const { store, stored } = makeStore('enc:operator-typed-this');
+
+    await store.rotate(4, 'session-2', 'operator-typed-this');
+
+    expect(stored()).toBe('enc:session-2');
+  });
+
+  /**
+   * Two searches and the keepalive tick can be in flight against one row at once. Unserialized,
+   * each reads before any of them writes, so all three pass the check and the last to land wins
+   * whether or not its session was the newest.
+   */
+  it('serializes concurrent rotations rather than letting them interleave', async () => {
+    const { store, repo, stored } = makeStore();
+
+    await Promise.all([store.rotate(4, 'session-2', 'session-1'), store.rotate(4, 'session-3', 'session-2')]);
+
+    expect(repo.updateCredentialIfCurrent).toHaveBeenCalledTimes(2);
+    expect(stored()).toBe('enc:session-3');
+  });
+
+  /** An indexer deleted mid-search has nothing to rotate, and re-creating its row is not our job. */
+  it('writes nothing for an indexer that no longer exists', async () => {
+    const { store, repo } = makeStore();
+    repo.findById.mockResolvedValue(undefined as never);
+
+    await store.rotate(4, 'session-2', 'session-1');
+
+    expect(repo.updateCredentialIfCurrent).not.toHaveBeenCalled();
+  });
+
+  /**
+   * The one value that can still be recovered by putting the encryption key back. Overwriting it
+   * with a session opened without it would destroy that.
+   */
+  it('leaves a stored credential it cannot read alone', async () => {
+    const { store, repo, credentials } = makeStore();
+    credentials.decrypt.mockImplementation(() => {
+      throw new Error('BOOK_REQUEST_ENCRYPTION_KEY may have changed');
+    });
+
+    await store.rotate(4, 'session-2', 'session-1');
+
+    expect(repo.updateCredentialIfCurrent).not.toHaveBeenCalled();
+  });
+
+  /** A search that found releases must not fail because the write-back could not be stored. */
+  it('swallows a failed write rather than failing the search behind it', async () => {
+    const { store, repo } = makeStore();
+    repo.updateCredentialIfCurrent.mockRejectedValue(new Error('connection lost') as never);
+
+    await expect(store.rotate(4, 'session-2', 'session-1')).resolves.toBe(false);
+  });
+
+  it('does not overwrite an operator save that lands after the credential was read', async () => {
+    const { store, repo, stored } = makeStore();
+    repo.updateCredentialIfCurrent.mockImplementationOnce(() => Promise.resolve(false));
+
+    await expect(store.rotate(4, 'session-2', 'session-1')).resolves.toBe(false);
+
+    expect(stored()).toBe('session-1');
+  });
+});
diff --git a/server/src/modules/book-request/indexers/indexer-credential-store.ts b/server/src/modules/book-request/indexers/indexer-credential-store.ts
new file mode 100644
index 000000000..09bf46447
--- /dev/null
+++ b/server/src/modules/book-request/indexers/indexer-credential-store.ts
@@ -0,0 +1,81 @@
+import { Injectable, Logger } from '@nestjs/common';
+
+import { sanitizeLogValue } from '../../../common/utils/log-sanitize.utils';
+import { RequestCredentialService } from '../request-credential.service';
+import { IndexerRepository } from './indexer.repository';
+
+/**
+ * Write-back for a session id the tracker rotated under us. Kept to its own tiny service so an
+ * adapter never reaches for the repository, and so the dependency runs adapter -> store ->
+ * repository rather than back into `IndexerConfigService`, which owns the adapters.
+ *
+ * Without this, a rotated session lives only in adapter memory and stops working at the next
+ * restart - a failure that looks like "the tracker suddenly logged us out" days later.
+ *
+ * Every write goes through a per-indexer lock and an atomic check of what is stored. The caller
+ * supplies the credential this rotation follows, so a late response cannot replace a newer
+ * session or an operator's just-saved credential.
+ */
+@Injectable()
+export class IndexerCredentialStore {
+  private readonly logger = new Logger(IndexerCredentialStore.name);
+  /** One tail per indexer, so writes to one row queue while writes to the others run freely. */
+  private readonly writes = new Map<number, Promise<unknown>>();
+
+  constructor(
+    private readonly repo: IndexerRepository,
+    private readonly credentials: RequestCredentialService,
+  ) {}
+
+  /**
+   * Stores a rotated session. `previous` is the credential the caller was working from, which is
+   * what tells a rotation of the current session apart from one of a session that has since been
+   * replaced.
+   */
+  async rotate(indexerId: number, credential: string, previous: string | null): Promise<boolean> {
+    const tail = (this.writes.get(indexerId) ?? Promise.resolve()).then(() => this.write(indexerId, credential, previous));
+    // Cleared only if nothing queued behind it, so the tail is always the newest write.
+    const tracked = tail.finally(() => {
+      if (this.writes.get(indexerId) === tracked) this.writes.delete(indexerId);
+    });
+    this.writes.set(indexerId, tracked);
+    return tail;
+  }
+
+  private async write(indexerId: number, credential: string, previous: string | null): Promise<boolean> {
+    const started = Date.now();
+    try {
+      const row = await this.repo.findById(indexerId);
+      if (!row || !this.matches(row.credentialsEnc, previous)) {
+        this.logger.log(
+          `[request_indexer.rotate] [end] indexerId=${indexerId} stored=false reason=changed durationMs=${Date.now() - started} - the stored credential changed while this session was in use`,
+        );
+        return false;
+      }
+
+      if (!(await this.repo.updateCredentialIfCurrent(indexerId, row.credentialsEnc, row.updatedAt, this.credentials.encrypt(credential)))) {
+        this.logger.log(
+          `[request_indexer.rotate] [end] indexerId=${indexerId} stored=false reason=raced durationMs=${Date.now() - started} - the stored credential changed while this session was being saved`,
+        );
+        return false;
+      }
+      this.logger.log(
+        `[request_indexer.rotate] [end] indexerId=${indexerId} stored=true durationMs=${Date.now() - started} - stored a rotated tracker session`,
+      );
+      return true;
+    } catch (error) {
+      // A search that found releases must not fail because we could not write the new session
+      // back; the old one keeps working until it lapses, and the next tick tries again.
+      const message = error instanceof Error ? error.message : String(error);
+      this.logger.warn(
+        `[request_indexer.rotate] [fail] indexerId=${indexerId} durationMs=${Date.now() - started} errorClass=${error instanceof Error ? error.constructor.name : 'UnknownError'} error="${sanitizeLogValue(message)}" - could not store the rotated session`,
+      );
+      return false;
+    }
+  }
+
+  private matches(encrypted: string | null, previous: string | null): boolean {
+    if (encrypted === null) return previous === null;
+    return this.credentials.decrypt(encrypted) === previous;
+  }
+}
diff --git a/server/src/modules/book-request/indexers/indexer-keepalive.service.test.ts b/server/src/modules/book-request/indexers/indexer-keepalive.service.test.ts
new file mode 100644
index 000000000..d9fdb74e6
--- /dev/null
+++ b/server/src/modules/book-request/indexers/indexer-keepalive.service.test.ts
@@ -0,0 +1,105 @@
+import type { ResolvedIndexerConfig } from './indexer-adapter';
+import { IndexerKeepaliveService } from './indexer-keepalive.service';
+import { IndexerOperationLock } from './indexer-operation-lock';
+
+function config(overrides: Partial<ResolvedIndexerConfig> = {}): ResolvedIndexerConfig {
+  return {
+    id: 1,
+    name: 'myanonamouse',
+    color: null,
+    adapterType: 'myanonamouse' as ResolvedIndexerConfig['adapterType'],
+    baseUrl: 'https://www.myanonamouse.net',
+    credential: 'a-session',
+    allowPrivateAddress: false,
+    categories: { ebook: [], audiobook: [], comic: [] },
+    disabledMediaKinds: [],
+    isbnSearchDisabled: false,
+    settings: null,
+    networkProfile: null,
+    credentialError: null,
+    ...overrides,
+  };
+}
+
+function makeService(configs: ResolvedIndexerConfig[], adapters: Record<string, { keepalive?: ReturnType<typeof vi.fn> }>) {
+  const indexers = {
+    resolveEnabledConfigs: vi.fn().mockResolvedValue(configs),
+    resolveConfig: vi.fn((id: number) => Promise.resolve(configs.find((item) => item.id === id))),
+  };
+  const registry = { find: vi.fn((type: string) => adapters[type]) };
+  return { service: new IndexerKeepaliveService(indexers as never, registry as never, new IndexerOperationLock()), indexers, registry };
+}
+
+describe('IndexerKeepaliveService', () => {
+  it('touches every enabled source whose adapter has a session to keep', async () => {
+    const keepalive = vi.fn().mockResolvedValue(undefined);
+    const { service } = makeService([config(), config({ id: 2, adapterType: 'torznab' })], { myanonamouse: { keepalive }, torznab: {} });
+
+    await service.tick();
+
+    expect(keepalive).toHaveBeenCalledTimes(1);
+  });
+
+  /**
+   * There is nothing to refresh from: the stored session cannot be read, so a keepalive would open
+   * an unauthenticated one and, on an adapter that rotates, write it back over the original. The
+   * fix is the encryption key, not another round trip.
+   */
+  it('skips a source whose stored credential cannot be read', async () => {
+    const keepalive = vi.fn().mockResolvedValue(undefined);
+    const { service } = makeService([config({ credentialError: 'BOOK_REQUEST_ENCRYPTION_KEY may have changed' })], {
+      myanonamouse: { keepalive },
+    });
+
+    await service.tick();
+
+    expect(keepalive).not.toHaveBeenCalled();
+  });
+
+  it('carries on to the next source when one refuses', async () => {
+    const failing = vi.fn().mockRejectedValue(new Error('the tracker is down'));
+    const working = vi.fn().mockResolvedValue(undefined);
+    const { service } = makeService(
+      [config(), config({ id: 2, name: 'other', adapterType: 'other-tracker' as ResolvedIndexerConfig['adapterType'] })],
+      {
+        myanonamouse: { keepalive: failing },
+        'other-tracker': { keepalive: working },
+      },
+    );
+
+    await service.tick();
+
+    expect(working).toHaveBeenCalledTimes(1);
+  });
+
+  /**
+   * The failure the per-source bound exists for. Errors were already handled here; a hang was not,
+   * and the `running` latch is only cleared when the sweep returns - so one adapter that never
+   * settled stopped every future tick for the life of the process, visible only as sessions
+   * quietly lapsing weeks later. The bound itself is `withDeadline`, proven in
+   * `with-deadline.utils.test.ts` where it costs milliseconds rather than the real minute.
+   */
+  it('releases the latch after a source failed, so the next tick still runs', async () => {
+    const failing = vi.fn().mockRejectedValue(new Error('the tracker never finished'));
+    const { service, indexers } = makeService([config()], { myanonamouse: { keepalive: failing } });
+
+    await service.tick();
+    await service.tick();
+
+    expect(indexers.resolveEnabledConfigs).toHaveBeenCalledTimes(2);
+  });
+
+  it('does not start a second sweep on top of one already running', async () => {
+    let release!: () => void;
+    const keepalive = vi.fn(() => new Promise<void>((resolve) => (release = resolve)));
+    const { service, indexers } = makeService([config()], { myanonamouse: { keepalive } });
+
+    const first = service.tick();
+    await vi.waitFor(() => expect(keepalive).toHaveBeenCalledTimes(1));
+    await service.tick();
+    release();
+    await first;
+
+    expect(indexers.resolveEnabledConfigs).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/server/src/modules/book-request/indexers/indexer-keepalive.service.ts b/server/src/modules/book-request/indexers/indexer-keepalive.service.ts
new file mode 100644
index 000000000..74766b374
--- /dev/null
+++ b/server/src/modules/book-request/indexers/indexer-keepalive.service.ts
@@ -0,0 +1,94 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { Cron } from '@nestjs/schedule';
+
+import { sanitizeLogValue } from '../../../common/utils/log-sanitize.utils';
+import { withDeadline } from '../../../common/utils/with-deadline.utils';
+import { IndexerConfigService } from './indexer-config.service';
+import { IndexerOperationLock } from './indexer-operation-lock';
+import { IndexerRegistry } from './indexer-registry';
+
+/**
+ * How long one tracker gets to answer a keepalive.
+ *
+ * Generous, because a session refresh on a private tracker is several requests. Bounded at all
+ * because the alternative is worse than a missed refresh: `running` is only cleared when the sweep
+ * returns, so one adapter that never settles silently stops every future tick until a restart, and
+ * nothing about that is visible except sessions quietly lapsing weeks later.
+ */
+const PER_INDEXER_TIMEOUT_MS = 60_000;
+
+/**
+ * Some trackers hand out a session that lapses on its own clock rather than on use, and the only
+ * thing that surfaces the lapse is the next approval failing. Touching each of them on a schedule
+ * moves that discovery to a background tick and, for adapters that rotate their session, keeps
+ * the stored credential current while there is still a valid one to rotate from.
+ *
+ * Adapters that need nothing simply do not implement `keepalive`, so this costs a quiet instance
+ * one query every six hours.
+ */
+@Injectable()
+export class IndexerKeepaliveService {
+  private readonly logger = new Logger(IndexerKeepaliveService.name);
+  private running = false;
+
+  constructor(
+    private readonly indexers: IndexerConfigService,
+    private readonly registry: IndexerRegistry,
+    private readonly operationLock: IndexerOperationLock,
+  ) {}
+
+  @Cron('0 0 */6 * * *')
+  async tick(): Promise<void> {
+    if (this.running) return;
+    this.running = true;
+    try {
+      await this.refreshSessions();
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      this.logger.warn(`[request_indexer.keepalive] [fail] error="${sanitizeLogValue(message)}" - keepalive tick failed`);
+    } finally {
+      this.running = false;
+    }
+  }
+
+  private async refreshSessions(): Promise<void> {
+    const configs = await this.indexers.resolveEnabledConfigs();
+
+    for (const config of configs) {
+      const adapter = this.registry.find(config.adapterType);
+      if (!adapter?.keepalive) continue;
+      // Nothing to refresh from: the stored session cannot be read, so a keepalive would open an
+      // unauthenticated one and, for an adapter that rotates, write it back over the unreadable
+      // original. The operator's fix is the encryption key, not another round trip.
+      if (config.credentialError) {
+        this.logger.warn(
+          `[request_indexer.keepalive] [fail] indexerId=${config.id} error="${sanitizeLogValue(config.credentialError)}" - the stored credential could not be read, so the session was not refreshed`,
+        );
+        continue;
+      }
+
+      try {
+        await this.operationLock.run(config.id, async () => {
+          const current = await this.indexers.resolveConfig(config.id);
+          const currentAdapter = this.registry.find(current.adapterType);
+          if (!currentAdapter?.keepalive) return;
+          // An adapter is handed no signal here, so nothing inside it is watching one: racing a
+          // timer against the call is what makes a hang a logged failure rather than a keepalive
+          // loop that silently never ticks again.
+          await withDeadline(
+            currentAdapter.keepalive(current),
+            AbortSignal.timeout(PER_INDEXER_TIMEOUT_MS),
+            () => new Error(`${current.name} did not answer in time`),
+          );
+        });
+      } catch (error) {
+        // One tracker being unreachable, or never answering at all, must not stop the others from
+        // being kept alive - nor leave the latch above held for the life of the process.
+        const message = error instanceof Error ? error.message : String(error);
+        this.logger.warn(
+          `[request_indexer.keepalive] [fail] indexerId=${config.id} error="${sanitizeLogValue(message)}" - could not refresh the tracker session`,
+        );
+      }
+    }
+  }
+}
diff --git a/server/src/modules/book-request/indexers/indexer-operation-lock.ts b/server/src/modules/book-request/indexers/indexer-operation-lock.ts
new file mode 100644
index 000000000..207c4b99b
--- /dev/null
+++ b/server/src/modules/book-request/indexers/indexer-operation-lock.ts
@@ -0,0 +1,22 @@
+import { Injectable } from '@nestjs/common';
+
+@Injectable()
+export class IndexerOperationLock {
+  private readonly tails = new Map<number, Promise<void>>();
+
+  async run<T>(indexerId: number, operation: () => Promise<T>): Promise<T> {
+    const previous = this.tails.get(indexerId) ?? Promise.resolve();
+    const current = previous.catch(() => undefined).then(operation);
+    const tail = current.then(
+      () => undefined,
+      () => undefined,
+    );
+    this.tails.set(indexerId, tail);
+
+    try {
+      return await current;
+    } finally {
+      if (this.tails.get(indexerId) === tail) this.tails.delete(indexerId);
+    }
+  }
+}
diff --git a/server/src/modules/book-request/indexers/indexer-registry.test.ts b/server/src/modules/book-request/indexers/indexer-registry.test.ts
new file mode 100644
index 000000000..22f3c4d69
--- /dev/null
+++ b/server/src/modules/book-request/indexers/indexer-registry.test.ts
@@ -0,0 +1,30 @@
+import type { IndexerPlugin } from '@bookorbit/plugin-api';
+
+import { IndexerRegistry } from './indexer-registry';
+import { PluginIndexerAdapter } from './plugins/plugin-host';
+
+function plugin(): IndexerPlugin {
+  return {
+    apiVersion: 1,
+    version: '2.4.1',
+    type: 'example-tracker',
+    label: 'Example Tracker',
+    requiresCredential: false,
+    credentialKind: null,
+    mediaKinds: ['ebook'],
+    usesCategories: false,
+    seedsBack: false,
+    search: () => Promise.resolve([]),
+    test: () => Promise.resolve({ success: true }),
+    resolveFile: () => Promise.resolve({ url: 'https://example.com/book.epub', fileName: 'book.epub', sizeBytes: null, format: 'epub' }),
+  };
+}
+
+describe('IndexerRegistry', () => {
+  it('includes a plugin release version in its client descriptor', () => {
+    const registry = new IndexerRegistry([], { load: vi.fn() } as never);
+    registry.register(new PluginIndexerAdapter(plugin(), { rotate: vi.fn() } as never));
+
+    expect(registry.describe()).toContainEqual(expect.objectContaining({ type: 'example-tracker', version: '2.4.1' }));
+  });
+});
diff --git a/server/src/modules/book-request/indexers/indexer-registry.ts b/server/src/modules/book-request/indexers/indexer-registry.ts
new file mode 100644
index 000000000..615cff61d
--- /dev/null
+++ b/server/src/modules/book-request/indexers/indexer-registry.ts
@@ -0,0 +1,164 @@
+import { BadRequestException, Inject, Injectable, Logger, type OnModuleInit } from '@nestjs/common';
+import {
+  DEFAULT_INDEXER_CATEGORIES,
+  INDEXER_CREDENTIAL_KINDS,
+  INDEXER_DEFAULT_BASE_URLS,
+  INDEXER_MEDIA_KINDS,
+  INDEXER_SEEDS_BACK,
+  INDEXER_USES_CATEGORIES,
+  type IndexerAdapterDescriptor,
+  type IndexerAdapterType,
+  type IndexerCategoryMap,
+} from '@bookorbit/types';
+
+import { INDEXER_ADAPTERS, type IndexerAdapter } from './indexer-adapter';
+import { PluginIndexerAdapter } from './plugins/plugin-host';
+import { PluginLoaderService } from './plugins/plugin-loader.service';
+
+/** What an adapter this build no longer has, or one that declares none, searches with. */
+const EMPTY_CATEGORIES: IndexerCategoryMap = { ebook: [], audiobook: [], comic: [] };
+
+/**
+ * Every adapter this install can use, built-in or loaded from disk.
+ *
+ * A map rather than the injected array it used to be, because plugins are discovered at boot and
+ * cannot be declared as providers. `require()` still fails loudly on a type nothing provides,
+ * which is what should happen when a plugin is removed while rows still name it.
+ */
+@Injectable()
+export class IndexerRegistry implements OnModuleInit {
+  private readonly logger = new Logger(IndexerRegistry.name);
+  private readonly adapters = new Map<string, IndexerAdapter>();
+
+  constructor(
+    @Inject(INDEXER_ADAPTERS) private readonly builtIn: IndexerAdapter[],
+    private readonly plugins: PluginLoaderService,
+  ) {
+    for (const adapter of builtIn) this.adapters.set(adapter.type, adapter);
+  }
+
+  async onModuleInit(): Promise<void> {
+    for (const adapter of await this.plugins.load()) {
+      this.adapters.set(adapter.type, adapter);
+    }
+
+    this.logger.log(`[request_indexer.registry] [end] adapters=${this.adapters.size} - indexer adapters registered`);
+  }
+
+  /**
+   * Adding and dropping an adapter while the process runs is what makes installing or removing a
+   * plugin take effect at once. Without it the page keeps listing a plugin whose files are gone,
+   * and the only way to act on that list is to restart the server.
+   */
+  register(adapter: IndexerAdapter): void {
+    this.adapters.set(adapter.type, adapter);
+    this.logger.log(`[request_indexer.registry] [end] type=${adapter.type} adapters=${this.adapters.size} - adapter registered`);
+  }
+
+  /** Built-ins are compiled in, so only a plugin-supplied adapter can be dropped. */
+  unregister(type: string): void {
+    const adapter = this.adapters.get(type);
+    if (!(adapter instanceof PluginIndexerAdapter)) return;
+
+    this.adapters.delete(type);
+    this.logger.log(`[request_indexer.registry] [end] type=${type} adapters=${this.adapters.size} - adapter dropped`);
+  }
+
+  all(): IndexerAdapter[] {
+    return [...this.adapters.values()];
+  }
+
+  find(type: IndexerAdapterType | string): IndexerAdapter | undefined {
+    return this.adapters.get(type);
+  }
+
+  /** Used on every search and grab, so a row whose type was dropped from the build fails loudly. */
+  require(type: IndexerAdapterType | string): IndexerAdapter {
+    const adapter = this.find(type);
+    if (!adapter) throw new BadRequestException(`Unknown indexer type: ${type}`);
+    return adapter;
+  }
+
+  /**
+   * Whether a grab from this adapter joins a swarm. The picker needs it per search, where
+   * building the whole descriptor list would be wasteful, so both read the same branch.
+   *
+   * An adapter this build no longer has claims no swarm. It contributes no releases either, so
+   * nothing is displayed on the strength of the answer.
+   */
+  seedsBack(type: IndexerAdapterType | string): boolean {
+    const adapter = this.find(type);
+    if (!adapter) return false;
+    return adapter instanceof PluginIndexerAdapter ? adapter.plugin.seedsBack : INDEXER_SEEDS_BACK[adapter.type];
+  }
+
+  /**
+   * The categories a source of this type searches when the operator has not chosen any.
+   *
+   * Read through the adapter for the same reason `seedsBack` is: a plugin declares its own, and a
+   * compile-time map only knows the built-ins. A row saved with no categories used to fall back to
+   * nothing at all for every plugin-backed source, which searches every category rather than the
+   * ones the plugin said it has.
+   */
+  defaultCategories(type: IndexerAdapterType | string): IndexerCategoryMap {
+    const adapter = this.find(type);
+    if (adapter instanceof PluginIndexerAdapter) return adapter.plugin.defaultCategories ?? EMPTY_CATEGORIES;
+    if (adapter) return DEFAULT_INDEXER_CATEGORIES[adapter.type];
+    return EMPTY_CATEGORIES;
+  }
+
+  /**
+   * What the settings form needs to render each adapter, so the client stops reading compile-time
+   * constants and a plugin-supplied adapter is indistinguishable from a built-in one.
+   */
+  describe(): IndexerAdapterDescriptor[] {
+    return this.all().map((adapter) => (adapter instanceof PluginIndexerAdapter ? describePlugin(adapter) : describeBuiltIn(adapter)));
+  }
+}
+
+function describeBuiltIn(adapter: IndexerAdapter): IndexerAdapterDescriptor {
+  const type = adapter.type;
+  return {
+    type,
+    label: adapter.label,
+    builtIn: true,
+    requiresCredential: adapter.requiresCredential,
+    credentialKind: INDEXER_CREDENTIAL_KINDS[type],
+    mediaKinds: [...INDEXER_MEDIA_KINDS[type]],
+    usesCategories: INDEXER_USES_CATEGORIES[type],
+    seedsBack: INDEXER_SEEDS_BACK[type],
+    supportsIsbnSearch: adapter.supportsIsbnSearch,
+    defaultCategories: DEFAULT_INDEXER_CATEGORIES[type],
+    ...(INDEXER_DEFAULT_BASE_URLS[type] ? { defaultBaseUrl: INDEXER_DEFAULT_BASE_URLS[type] } : {}),
+    // Read off the adapter rather than hardcoded empty, so a built-in that declares settings fields
+    // gets them the same way a plugin does. Torznab declares none, so today this is always empty.
+    settingsFields: [...(adapter.settingsFields ?? [])],
+  };
+}
+
+/**
+ * A plugin carries its own copy of everything a built-in reads from `@bookorbit/types`, because
+ * the client cannot have compile-time knowledge of an adapter that arrived at runtime. Its
+ * strings are untranslated English: plugin text cannot go through the translation workflow, and
+ * the client falls back to these only where it has no message of its own.
+ */
+function describePlugin(adapter: PluginIndexerAdapter): IndexerAdapterDescriptor {
+  const { plugin } = adapter;
+  return {
+    type: plugin.type as IndexerAdapterType,
+    label: plugin.label,
+    builtIn: false,
+    ...(plugin.version ? { version: plugin.version } : {}),
+    requiresCredential: plugin.requiresCredential,
+    credentialKind: plugin.credentialKind,
+    mediaKinds: [...plugin.mediaKinds],
+    usesCategories: plugin.usesCategories,
+    seedsBack: plugin.seedsBack,
+    // The adapter's, not the plugin's: a plugin may leave the field off entirely.
+    supportsIsbnSearch: adapter.supportsIsbnSearch,
+    defaultCategories: plugin.defaultCategories ?? { ebook: [], audiobook: [], comic: [] },
+    ...(plugin.defaultBaseUrl ? { defaultBaseUrl: plugin.defaultBaseUrl } : {}),
+    ...(plugin.baseUrlHint ? { baseUrlHint: plugin.baseUrlHint } : {}),
+    settingsFields: [...(plugin.settingsFields ?? [])],
+  };
+}
diff --git a/server/src/modules/book-request/indexers/indexer-search.service.test.ts b/server/src/modules/book-request/indexers/indexer-search.service.test.ts
new file mode 100644
index 000000000..ea655a613
--- /dev/null
+++ b/server/src/modules/book-request/indexers/indexer-search.service.test.ts
@@ -0,0 +1,698 @@
+import type { BookRequestRow } from '../../../db/schema';
+import { emptyReleaseProfiles } from '@bookorbit/types';
+import type { IndexerAdapterType } from '@bookorbit/types';
+
+import { IndexerSearchException, type ReleaseCandidate, type ResolvedIndexerConfig } from './indexer-adapter';
+import { IndexerOperationLock } from './indexer-operation-lock';
+import { IndexerSearchService } from './indexer-search.service';
+
+function request(overrides: Partial<BookRequestRow> = {}): BookRequestRow {
+  return {
+    id: 7,
+    title: 'Dune',
+    authors: ['Frank Herbert'],
+    isbn13: null,
+    isbn10: null,
+    metadataSources: [],
+    mediaKind: 'ebook',
+    preferredFormats: ['epub'],
+    language: null,
+    ...overrides,
+  } as BookRequestRow;
+}
+
+/**
+ * Torznab is the only built-in type, so anything else a row can name is a plugin slug. Cast the way
+ * `IndexerConfigService` casts a row it read from the database, which is where these come from.
+ */
+const pluginType = (slug: string) => slug as IndexerAdapterType;
+
+function indexer(overrides: Partial<ResolvedIndexerConfig> = {}): ResolvedIndexerConfig {
+  return {
+    id: 1,
+    name: 'jackett',
+    adapterType: 'torznab',
+    baseUrl: 'http://127.0.0.1:9117',
+    credential: null,
+    allowPrivateAddress: true,
+    categories: { ebook: [7020], audiobook: [3030], comic: [7030] },
+    disabledMediaKinds: [],
+    isbnSearchDisabled: false,
+    settings: null,
+    credentialError: null,
+    ...overrides,
+  };
+}
+
+function release(overrides: Partial<ReleaseCandidate> = {}): ReleaseCandidate {
+  return {
+    indexerId: 1,
+    guid: 'g1',
+    title: 'Frank Herbert - Dune [EPUB]',
+    sizeBytes: 2 * 1024 * 1024,
+    seeders: 10,
+    leechers: 1,
+    format: 'epub',
+    ...overrides,
+  };
+}
+
+/**
+ * Adapters here declare every medium unless a test says otherwise, so a stub is not silently read
+ * as a source that carries nothing.
+ */
+function makeService(
+  configs: ResolvedIndexerConfig[],
+  adapters: Record<string, { search: ReturnType<typeof vi.fn>; mediaKinds?: readonly string[]; seedsBack?: boolean; supportsIsbnSearch?: boolean }>,
+) {
+  // The rows that exist, of which `configs` is the enabled subset. Every case here builds its
+  // sources enabled, so the two counts match unless a case says otherwise.
+  const indexers = {
+    resolveEnabledConfigs: vi.fn().mockResolvedValue(configs),
+    resolveConfig: vi.fn((id: number) => Promise.resolve(configs.find((config) => config.id === id))),
+    countSources: vi.fn().mockResolvedValue({ configured: configs.length, enabled: configs.length }),
+    recordSearchOutcomes: vi.fn().mockResolvedValue(undefined),
+  };
+  const registry = {
+    find: vi.fn((type: string) => {
+      const adapter = adapters[type];
+      return adapter ? { mediaKinds: ['ebook', 'audiobook', 'comic'], supportsIsbnSearch: false, ...adapter } : undefined;
+    }),
+    seedsBack: vi.fn((type: string) => adapters[type]?.seedsBack ?? true),
+  };
+  // No profile, which is the shipped default and keeps these cases about search and scoring.
+  const automationSettings = { get: vi.fn(() => Promise.resolve({ profiles: emptyReleaseProfiles() })) };
+  return {
+    service: new IndexerSearchService(indexers as never, registry as never, automationSettings as never, new IndexerOperationLock()),
+    indexers,
+    adapters,
+    automationSettings,
+  };
+}
+
+describe('IndexerSearchService', () => {
+  /**
+   * A rotated or unset encryption key leaves stored credentials unreadable. Decrypting the whole
+   * enabled list up front meant one such row threw out of the resolve and took every other source
+   * with it, including the ones holding no credential at all.
+   */
+  it('reports a source whose credential cannot be read without abandoning the others', async () => {
+    const torznab = { search: vi.fn().mockResolvedValue([release()]) };
+    const archive = { search: vi.fn().mockResolvedValue([release({ indexerId: 2, guid: 'g2' })]) };
+    const { service } = makeService(
+      [
+        indexer({ credentialError: 'BOOK_REQUEST_ENCRYPTION_KEY may have changed' }),
+        indexer({ id: 2, name: 'archive', adapterType: 'internet-archive' }),
+      ],
+      { torznab, 'internet-archive': archive },
+    );
+
+    const result = await service.search(request());
+
+    expect(torznab.search).not.toHaveBeenCalled();
+    expect(archive.search).toHaveBeenCalled();
+    expect(result.releases.map((item) => item.indexerName)).toEqual(['archive']);
+    expect(result.indexers.find((status) => status.indexerId === 1)).toMatchObject({
+      ok: false,
+      failure: 'unauthorized',
+      error: expect.stringContaining('ENCRYPTION_KEY'),
+    });
+  });
+
+  /**
+   * A grab resolves a release by guid, so an indexer that returns one twice is describing one
+   * release however many rows it sent. The resolution map already collapsed them, so the picker
+   * offered a duplicate row that resolved to the same release and the source's count claimed one
+   * it does not have.
+   */
+  it('collapses a guid one indexer returned more than once', async () => {
+    const torznab = { search: vi.fn().mockResolvedValue([release(), release(), release({ guid: 'g2' })]) };
+    const { service } = makeService([indexer()], { torznab });
+
+    const result = await service.search(request());
+
+    expect(result.releases.map((item) => item.guid)).toEqual(['g1', 'g2']);
+    expect(result.indexers[0]).toMatchObject({ ok: true, count: 2, filtered: 0 });
+  });
+
+  /** Two indexers naming the same guid are two releases; the key is scoped to the source. */
+  it('keeps the same guid from two different indexers apart', async () => {
+    const torznab = { search: vi.fn().mockResolvedValue([release()]) };
+    const archive = { search: vi.fn().mockResolvedValue([release({ indexerId: 2 })]) };
+    const { service } = makeService([indexer(), indexer({ id: 2, name: 'archive', adapterType: 'internet-archive' })], {
+      torznab,
+      'internet-archive': archive,
+    });
+
+    const result = await service.search(request());
+
+    expect(result.releases).toHaveLength(2);
+  });
+
+  it('merges every enabled indexer into one list ranked by score', async () => {
+    const torznab = { search: vi.fn().mockResolvedValue([release({ title: 'Something Else [EPUB]', seeders: 400 })]) };
+    const archive = { search: vi.fn().mockResolvedValue([release({ indexerId: 2, guid: 'g2', seeders: 5 })]) };
+    const { service } = makeService([indexer(), indexer({ id: 2, name: 'archive', adapterType: 'internet-archive' })], {
+      torznab,
+      'internet-archive': archive,
+    });
+
+    const result = await service.search(request());
+
+    expect(result.releases.map((item) => item.indexerName)).toEqual(['archive', 'jackett']);
+    expect(result.releases[0].score).toBeGreaterThan(result.releases[1].score);
+  });
+
+  it('records the outcome of every source that took part in a real search', async () => {
+    const torznab = { search: vi.fn().mockResolvedValue([release()]) };
+    const archive = { search: vi.fn().mockRejectedValue(new Error('tracker is offline')) };
+    const { service, indexers } = makeService([indexer(), indexer({ id: 2, name: 'archive', adapterType: 'internet-archive' })], {
+      torznab,
+      'internet-archive': archive,
+    });
+
+    await service.search(request());
+
+    expect(indexers.recordSearchOutcomes).toHaveBeenCalledWith([
+      { indexerId: 1, ok: true, error: null },
+      { indexerId: 2, ok: false, error: 'tracker is offline' },
+    ]);
+  });
+
+  it('reports the request fields used to search and rank the releases', async () => {
+    const torznab = { search: vi.fn().mockResolvedValue([]) };
+    const { service } = makeService([indexer()], { torznab });
+
+    const result = await service.search(
+      request({
+        authors: ['Frank Herbert', 'Brian Herbert'],
+        isbn10: '0441172717',
+        isbn13: '9780441172719',
+        language: 'en',
+        preferredFormats: ['epub', 'azw3'],
+      }),
+    );
+
+    expect(result.criteria).toEqual({
+      title: 'Dune',
+      authors: ['Frank Herbert', 'Brian Herbert'],
+      isbn10: null,
+      isbn13: '9780441172719',
+      activeIsbn: '9780441172719',
+      isbns: ['9780441172719'],
+      mediaKind: 'ebook',
+      language: 'en',
+      preferredFormats: ['epub', 'azw3'],
+    });
+  });
+
+  it('searches only the recommended ISBN while retaining every distinct provider ISBN as an alternative', async () => {
+    const libgen = { search: vi.fn().mockResolvedValue([]), supportsIsbnSearch: true };
+    const { service } = makeService([indexer({ adapterType: pluginType('libgen') })], { libgen });
+
+    const result = await service.search(
+      request({
+        metadataSources: [
+          { providerKey: 'google', providerId: 'g1', providerLabel: 'Google Books', isbn10: '0441013597', isbn13: null },
+          { providerKey: 'amazon', providerId: 'a1', providerLabel: 'Amazon', isbn10: null, isbn13: '9781250301697' },
+        ],
+      }),
+    );
+
+    expect(libgen.search).toHaveBeenCalledWith(
+      expect.objectContaining({ isbn13: '9780441013593', isbn13s: ['9780441013593'] }),
+      expect.anything(),
+      expect.anything(),
+    );
+    expect(result.criteria).toMatchObject({ activeIsbn: '9780441013593', isbns: ['9780441013593', '9781250301697'] });
+    expect(result.indexers[0]?.query).toEqual({ kind: 'isbn', value: '9780441013593' });
+  });
+
+  it('uses explicit picker overrides instead of silently retaining request search fields', async () => {
+    const libgen = { search: vi.fn().mockResolvedValue([]), supportsIsbnSearch: true };
+    const { service } = makeService([indexer({ adapterType: pluginType('libgen') })], { libgen });
+
+    const result = await service.search(request({ isbn13: '9780441172719', language: 'en' }), {
+      refresh: true,
+      overrides: {
+        title: 'Dune Messiah',
+        authors: ['Frank Herbert'],
+        isbn: '9780593098233',
+        language: null,
+        preferredFormats: ['azw3'],
+      },
+    });
+
+    expect(libgen.search).toHaveBeenCalledWith(
+      expect.objectContaining({
+        title: 'Dune Messiah',
+        author: 'Frank Herbert',
+        isbn13: '9780593098233',
+        isbn13s: ['9780593098233'],
+        language: null,
+      }),
+      expect.anything(),
+      expect.anything(),
+    );
+    expect(result.criteria).toEqual({
+      title: 'Dune Messiah',
+      authors: ['Frank Herbert'],
+      isbn10: null,
+      isbn13: '9780593098233',
+      activeIsbn: '9780593098233',
+      isbns: ['9780593098233', '9780441172719'],
+      mediaKind: 'ebook',
+      language: null,
+      preferredFormats: ['azw3'],
+    });
+  });
+
+  it('lets an explicit null ISBN select a title and author search', async () => {
+    const libgen = { search: vi.fn().mockResolvedValue([]), supportsIsbnSearch: true };
+    const { service } = makeService([indexer({ adapterType: pluginType('libgen') })], { libgen });
+
+    const result = await service.search(request({ isbn13: '9780441172719' }), { refresh: true, overrides: { isbn: null } });
+
+    expect(libgen.search).toHaveBeenCalledWith(expect.objectContaining({ isbn13: null, isbn13s: [] }), expect.anything(), expect.anything());
+    expect(result.criteria).toMatchObject({ activeIsbn: null, isbns: ['9780441172719'] });
+    expect(result.indexers[0]?.query).toEqual({ kind: 'titleAuthor', value: 'Dune Frank Herbert' });
+  });
+
+  it('withholds the ISBN from a source the operator took it away from', async () => {
+    const libgen = { search: vi.fn().mockResolvedValue([]), supportsIsbnSearch: true };
+    const { service } = makeService([indexer({ adapterType: pluginType('libgen'), isbnSearchDisabled: true })], { libgen });
+
+    const result = await service.search(request({ isbn13: '9780441172719' }));
+
+    expect(libgen.search).toHaveBeenCalledWith(expect.objectContaining({ isbn13: null, isbn13s: [] }), expect.anything(), expect.anything());
+    expect(result.indexers[0]?.query).toEqual({ kind: 'titleAuthor', value: 'Dune Frank Herbert' });
+    // Still the request's ISBN: taking it from one source does not change what was asked for.
+    expect(result.criteria).toMatchObject({ activeIsbn: '9780441172719' });
+  });
+
+  it('leaves a source with the ISBN taken away out of an ISBN-capable pass', async () => {
+    const libgen = { search: vi.fn().mockResolvedValue([]), supportsIsbnSearch: true };
+    const other = { search: vi.fn().mockResolvedValue([]), supportsIsbnSearch: true };
+    const { service } = makeService(
+      [indexer({ adapterType: pluginType('libgen'), isbnSearchDisabled: true }), indexer({ id: 2, name: 'other', adapterType: pluginType('other') })],
+      { libgen, other },
+    );
+
+    const result = await service.search(request({ isbn13: '9780441172719' }), { indexerMode: 'isbn-capable' });
+
+    expect(libgen.search).not.toHaveBeenCalled();
+    expect(result.indexers.map((status) => status.indexerName)).toEqual(['other']);
+  });
+
+  it('limits fallback passes to ISBN-capable indexers', async () => {
+    const torznab = { search: vi.fn().mockResolvedValue([]) };
+    const libgen = { search: vi.fn().mockResolvedValue([]), supportsIsbnSearch: true };
+    const { service } = makeService([indexer(), indexer({ id: 2, name: 'libgen', adapterType: pluginType('libgen') })], {
+      torznab,
+      libgen,
+    });
+
+    const result = await service.search(request({ isbn13: '9780441172719' }), { indexerMode: 'isbn-capable' });
+
+    expect(torznab.search).not.toHaveBeenCalled();
+    expect(libgen.search).toHaveBeenCalledTimes(1);
+    expect(result.indexers.map((status) => status.indexerName)).toEqual(['libgen']);
+    expect(result.uncoveredIndexerCount).toBe(0);
+  });
+
+  it('sends the final title fallback only to ISBN-capable indexers', async () => {
+    const torznab = { search: vi.fn().mockResolvedValue([]) };
+    const libgen = { search: vi.fn().mockResolvedValue([]), supportsIsbnSearch: true };
+    const { service } = makeService([indexer(), indexer({ id: 2, name: 'libgen', adapterType: pluginType('libgen') })], {
+      torznab,
+      libgen,
+    });
+
+    const result = await service.search(request({ isbn13: '9780441172719' }), {
+      indexerMode: 'isbn-capable',
+      overrides: { isbn: null },
+    });
+
+    expect(torznab.search).not.toHaveBeenCalled();
+    expect(libgen.search).toHaveBeenCalledWith(expect.objectContaining({ isbn13: null, isbn13s: [] }), expect.anything(), expect.anything());
+    expect(result.indexers[0]?.query).toEqual({ kind: 'titleAuthor', value: 'Dune Frank Herbert' });
+  });
+
+  /** One tracker being down is a per-indexer state in the picker, not a failed search. */
+  it('reports a failing indexer beside the results the others returned', async () => {
+    const torznab = { search: vi.fn().mockRejectedValue(new IndexerSearchException('unauthorized', 'bad key')) };
+    const archive = { search: vi.fn().mockResolvedValue([release({ indexerId: 2, guid: 'g2' })]) };
+    const { service } = makeService([indexer(), indexer({ id: 2, name: 'archive', adapterType: 'internet-archive' })], {
+      torznab,
+      'internet-archive': archive,
+    });
+
+    const result = await service.search(request());
+
+    expect(result.releases).toHaveLength(1);
+    expect(result.indexers).toEqual([
+      {
+        indexerId: 1,
+        indexerName: 'jackett',
+        ok: false,
+        count: 0,
+        filtered: 0,
+        query: { kind: 'titleAuthor', value: 'Dune Frank Herbert' },
+        failure: 'unauthorized',
+        error: 'bad key',
+        seedsBack: true,
+      },
+      {
+        indexerId: 2,
+        indexerName: 'archive',
+        ok: true,
+        count: 1,
+        filtered: 0,
+        query: { kind: 'titleAuthor', value: 'Dune Frank Herbert' },
+        seedsBack: true,
+      },
+    ]);
+  });
+
+  /**
+   * A source that serves the file itself has no swarm to report, which the picker must not read
+   * as one release having omitted its seeder count. The answer belongs to the adapter, so it
+   * travels with the indexer's status rather than being guessed from the merged release list.
+   */
+  it('reports whether each source joins a swarm', async () => {
+    const torznab = { search: vi.fn().mockResolvedValue([release()]) };
+    const libgen = { search: vi.fn().mockResolvedValue([release({ indexerId: 2, guid: 'g2', seeders: null })]), seedsBack: false };
+    const { service } = makeService([indexer(), indexer({ id: 2, name: 'libgen', adapterType: 'libgen' })], { torznab, libgen });
+
+    const result = await service.search(request());
+
+    expect(result.indexers.map((status) => [status.indexerName, status.seedsBack])).toEqual([
+      ['jackett', true],
+      ['libgen', false],
+    ]);
+  });
+
+  it('counts what the hard filters dropped, so an empty list stays explainable', async () => {
+    const torznab = { search: vi.fn().mockResolvedValue([release({ seeders: 0 }), release({ guid: 'g2', format: 'mp3' })]) };
+    const { service } = makeService([indexer()], { torznab });
+
+    const result = await service.search(request());
+
+    expect(result.releases).toHaveLength(0);
+    expect(result.indexers[0]).toMatchObject({ ok: true, count: 0, filtered: 2 });
+  });
+
+  it('retries a title and author miss with the title alone', async () => {
+    const torznab = {
+      search: vi.fn((query: { author: string | null }) => Promise.resolve(query.author ? [] : [release()])),
+    };
+    const { service } = makeService([indexer()], { torznab });
+
+    const result = await service.search(request());
+
+    expect(torznab.search).toHaveBeenCalledTimes(2);
+    expect(torznab.search).toHaveBeenNthCalledWith(
+      1,
+      expect.objectContaining({ title: 'Dune', author: 'Frank Herbert' }),
+      expect.anything(),
+      expect.anything(),
+    );
+    expect(torznab.search).toHaveBeenNthCalledWith(2, expect.objectContaining({ title: 'Dune', author: null }), expect.anything(), expect.anything());
+    expect(result.releases).toHaveLength(1);
+  });
+
+  /** Reopening the picker must not re-hit a private tracker; `refresh` is the way past that. */
+  it('serves a repeat search from the cache until asked to refresh', async () => {
+    const torznab = { search: vi.fn().mockResolvedValue([release()]) };
+    const { service } = makeService([indexer()], { torznab });
+
+    await service.search(request());
+    const second = await service.search(request());
+    expect(second.cached).toBe(true);
+    expect(torznab.search).toHaveBeenCalledTimes(1);
+
+    const refreshed = await service.search(request(), { refresh: true });
+    expect(refreshed.cached).toBe(false);
+    expect(torznab.search).toHaveBeenCalledTimes(2);
+  });
+
+  it('keeps manual and default search caches separate while retaining both pickable result sets', async () => {
+    const torznab = {
+      search: vi.fn((query: { title: string }) =>
+        Promise.resolve([release(query.title === 'Dune Messiah' ? { guid: 'custom' } : { guid: 'default' })]),
+      ),
+    };
+    const { service } = makeService([indexer()], { torznab });
+
+    await service.search(request());
+    await service.search(request(), { overrides: { title: 'Dune Messiah' } });
+    const defaultAgain = await service.search(request());
+
+    expect(defaultAgain.cached).toBe(true);
+    expect(torznab.search).toHaveBeenCalledTimes(2);
+    expect(service.find(7, 1, 'default')).toBeDefined();
+    expect(service.find(7, 1, 'custom')).toBeDefined();
+  });
+
+  it('keeps all-indexer and ISBN-capable search caches separate', async () => {
+    const libgen = { search: vi.fn().mockResolvedValue([]), supportsIsbnSearch: true };
+    const { service } = makeService([indexer({ adapterType: pluginType('libgen') })], { libgen });
+    const book = request({ isbn13: '9780441172719' });
+
+    await service.search(book);
+    await service.search(book, { indexerMode: 'isbn-capable' });
+    const capableAgain = await service.search(book, { indexerMode: 'isbn-capable' });
+
+    expect(libgen.search).toHaveBeenCalledTimes(2);
+    expect(capableAgain.cached).toBe(true);
+  });
+
+  /**
+   * An open library that holds only text has nothing to say about an audiobook. Nothing goes wrong
+   * when it is asked for one, because it is never asked: the mismatch is a permanent property of
+   * the source, known before any request, so it is left out of the search rather than reported as
+   * a per-indexer failure the operator might try to fix.
+   */
+  it('leaves out a source that does not carry the requested medium instead of failing it', async () => {
+    const gutenberg = { search: vi.fn(), mediaKinds: ['ebook'] as const };
+    const { service } = makeService([indexer({ id: 2, name: 'gutenberg', adapterType: pluginType('project-gutenberg') })], {
+      'project-gutenberg': gutenberg,
+    });
+
+    const result = await service.search(request({ mediaKind: 'audiobook' }));
+
+    expect(gutenberg.search).not.toHaveBeenCalled();
+    expect(result.indexers).toEqual([]);
+  });
+
+  /**
+   * The operator's own narrowing, on top of what the adapter declares. A general torznab proxy in
+   * front of an audiobook-only tracker still says it carries all three, and an empty category list
+   * cannot express the exclusion either: torznab reads that as "send no `cat`".
+   */
+  it('leaves out a source the operator took out of this medium', async () => {
+    const torznab = { search: vi.fn().mockResolvedValue([release()]) };
+    const { service } = makeService([indexer({ disabledMediaKinds: ['ebook'] })], { torznab });
+
+    const result = await service.search(request({ mediaKind: 'ebook' }));
+
+    expect(torznab.search).not.toHaveBeenCalled();
+    expect(result.uncoveredIndexerCount).toBe(1);
+  });
+
+  it('still searches that source for the media it was left in', async () => {
+    const torznab = { search: vi.fn().mockResolvedValue([release()]) };
+    const { service } = makeService([indexer({ disabledMediaKinds: ['ebook'] })], { torznab });
+
+    await service.search(request({ mediaKind: 'audiobook' }));
+
+    expect(torznab.search).toHaveBeenCalledTimes(1);
+  });
+
+  /**
+   * A missing adapter is a fact about the build and is reported rather than hidden, but an
+   * exclusion is a decision about the source, and it stands whether or not the adapter loaded.
+   */
+  it('honours the exclusion even for a row whose adapter this build no longer has', async () => {
+    const { service } = makeService([indexer({ adapterType: pluginType('departed'), disabledMediaKinds: ['ebook'] })], {});
+
+    const result = await service.search(request({ mediaKind: 'ebook' }));
+
+    expect(result.indexers).toEqual([]);
+    expect(result.uncoveredIndexerCount).toBe(1);
+  });
+
+  /** Counted rather than dropped, so an empty list can still say why it is empty. */
+  it('counts the sources it left out, so an empty list stays explainable', async () => {
+    const gutenberg = { search: vi.fn(), mediaKinds: ['ebook'] as const };
+    const librivox = { search: vi.fn().mockResolvedValue([]), mediaKinds: ['audiobook'] as const };
+    const { service } = makeService(
+      [
+        indexer({ id: 2, name: 'gutenberg', adapterType: pluginType('project-gutenberg') }),
+        indexer({ id: 3, name: 'librivox', adapterType: pluginType('librivox') }),
+      ],
+      { 'project-gutenberg': gutenberg, librivox },
+    );
+
+    const result = await service.search(request({ mediaKind: 'audiobook' }));
+
+    expect(result.uncoveredIndexerCount).toBe(1);
+    expect(result.indexers).toEqual([expect.objectContaining({ indexerName: 'librivox', ok: true })]);
+  });
+
+  it('counts nothing as uncovered when every source carries the medium', async () => {
+    const torznab = { search: vi.fn().mockResolvedValue([release()]) };
+    const { service } = makeService([indexer()], { torznab });
+
+    await expect(service.search(request())).resolves.toMatchObject({ uncoveredIndexerCount: 0 });
+  });
+
+  /**
+   * The picker cannot ask for the indexer list, so an empty release list has to carry why it is
+   * empty. Without these two counts "nothing is set up", "everything is switched off" and "this
+   * book was not found" all arrive as the same empty array.
+   */
+  it('reports how many sources were enabled and how many exist at all', async () => {
+    const { service, indexers } = makeService([], {});
+    indexers.countSources.mockResolvedValue({ configured: 3, enabled: 0 });
+
+    const result = await service.search(request());
+
+    expect(result.enabledIndexerCount).toBe(0);
+    expect(result.configuredIndexerCount).toBe(3);
+    expect(result.releases).toEqual([]);
+    expect(result.indexers).toEqual([]);
+  });
+
+  /**
+   * A row whose adapter is gone cannot be judged on its media at all, so leaving it out here would
+   * hide the one state the operator has to act on.
+   */
+  it('still searches a row whose adapter this build no longer has, so it is reported', async () => {
+    const { service } = makeService([indexer({ adapterType: pluginType('departed') })], {});
+
+    const result = await service.search(request({ mediaKind: 'audiobook' }));
+
+    expect(result.uncoveredIndexerCount).toBe(0);
+    expect(result.indexers).toEqual([expect.objectContaining({ ok: false, failure: 'error' })]);
+  });
+
+  it('resolves a picked release from its own results rather than anything a client sent', async () => {
+    const torznab = { search: vi.fn().mockResolvedValue([release({ downloadUrl: 'https://tracker.example.com/dl?tid=1' })]) };
+    const { service } = makeService([indexer()], { torznab });
+
+    await service.search(request());
+
+    expect(service.find(7, 1, 'g1')).toMatchObject({ downloadUrl: 'https://tracker.example.com/dl?tid=1' });
+    expect(service.find(7, 1, 'unknown')).toBeUndefined();
+    expect(service.find(99, 1, 'g1')).toBeUndefined();
+  });
+
+  it('reports an indexer whose adapter is not built rather than silently skipping it', async () => {
+    const { service } = makeService([indexer({ adapterType: 'internet-archive' })], {});
+
+    const result = await service.search(request());
+
+    expect(result.indexers[0]).toMatchObject({ ok: false, failure: 'error' });
+  });
+
+  /**
+   * A signal an adapter is handed only ends the work that actually watches it, so the search races
+   * the adapter against its own deadline rather than trusting it: one that never settles used to
+   * hold a slot in the bounded search pool for the life of the process, and the `Promise.all` over
+   * the indexers never resolved - a picker spinning with nothing to show and nothing to report.
+   *
+   * That the race ends a wait nothing is watching is proven in `with-deadline.utils.test.ts`,
+   * where it costs milliseconds rather than the real twenty-second per-indexer deadline. What
+   * belongs here is the deadline reaching the adapter at all, and an overrun landing as one
+   * source's failure rather than the search's.
+   */
+  it('gives each source a deadline and reports the one that ran out of time', async () => {
+    const slow = {
+      search: vi.fn((_query: unknown, _config: unknown, signal: AbortSignal) => {
+        expect(signal.aborted).toBe(false);
+        return Promise.reject(new IndexerSearchException('timeout', 'jackett did not answer in time'));
+      }),
+    };
+    const working = { search: vi.fn().mockResolvedValue([release({ indexerId: 2, guid: 'g2' })]) };
+    const { service } = makeService([indexer(), indexer({ id: 2, name: 'archive', adapterType: pluginType('internet-archive') })], {
+      torznab: slow,
+      'internet-archive': working,
+    });
+
+    const result = await service.search(request());
+
+    expect(slow.search.mock.calls[0][2]).toBeInstanceOf(AbortSignal);
+    expect(result.indexers).toEqual([
+      expect.objectContaining({ indexerId: 1, ok: false, failure: 'timeout' }),
+      expect.objectContaining({ indexerId: 2, ok: true }),
+    ]);
+    expect(result.releases).toHaveLength(1);
+  });
+
+  it('serializes work for one source and resolves its latest credential inside the lock', async () => {
+    let releaseFirst!: () => void;
+    const firstHeld = new Promise<void>((resolve) => (releaseFirst = resolve));
+    let calls = 0;
+    let active = 0;
+    let maxActive = 0;
+    const credentialsSeen: Array<string | null> = [];
+    const torznab = {
+      search: vi.fn(async (_query: unknown, config: ResolvedIndexerConfig) => {
+        calls++;
+        active++;
+        maxActive = Math.max(maxActive, active);
+        credentialsSeen.push(config.credential);
+        if (calls === 1) await firstHeld;
+        active--;
+        return [release()];
+      }),
+    };
+    const { service, indexers } = makeService([indexer({ credential: 'session-1' })], { torznab });
+    indexers.resolveConfig.mockResolvedValueOnce(indexer({ credential: 'session-1' })).mockResolvedValueOnce(indexer({ credential: 'session-2' }));
+
+    const first = service.search(request({ id: 7 }), { refresh: true });
+    await vi.waitFor(() => expect(torznab.search).toHaveBeenCalledTimes(1));
+    const second = service.search(request({ id: 8 }), { refresh: true });
+    await Promise.resolve();
+    expect(torznab.search).toHaveBeenCalledTimes(1);
+
+    releaseFirst();
+    await Promise.all([first, second]);
+
+    expect(maxActive).toBe(1);
+    expect(credentialsSeen).toEqual(['session-1', 'session-2']);
+  });
+
+  /**
+   * Scoring runs per candidate, so a release the scorer cannot read is one source misbehaving.
+   * Outside the per-indexer accounting it threw out of the merge and 500d the whole picker,
+   * including every other indexer that answered perfectly well.
+   */
+  it('reports the one source whose release could not be scored and keeps the rest', async () => {
+    const malformed = {
+      search: vi.fn().mockResolvedValue([
+        // A getter rather than a value, because the sanitiser at the plugin boundary is what
+        // ordinarily catches a bad shape: this is the layer behind it.
+        Object.defineProperty(release(), 'title', {
+          get() {
+            throw new TypeError('title is not a string');
+          },
+        }),
+      ]),
+    };
+    const working = { search: vi.fn().mockResolvedValue([release({ indexerId: 2, guid: 'g2' })]) };
+    const { service } = makeService([indexer(), indexer({ id: 2, name: 'archive', adapterType: pluginType('internet-archive') })], {
+      torznab: malformed,
+      'internet-archive': working,
+    });
+
+    const result = await service.search(request());
+
+    expect(result.indexers).toEqual([
+      expect.objectContaining({ indexerId: 1, ok: false, failure: 'error' }),
+      expect.objectContaining({ indexerId: 2, ok: true, count: 1 }),
+    ]);
+    expect(result.releases).toHaveLength(1);
+  });
+});
diff --git a/server/src/modules/book-request/indexers/indexer-search.service.ts b/server/src/modules/book-request/indexers/indexer-search.service.ts
new file mode 100644
index 000000000..f745956ce
--- /dev/null
+++ b/server/src/modules/book-request/indexers/indexer-search.service.ts
@@ -0,0 +1,423 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { canonicalizeBookRequestIsbn, compareByTier, MAX_BOOK_REQUEST_SEARCH_ISBNS, releaseProfileIsActive } from '@bookorbit/types';
+import type {
+  BookRequestMediaKind,
+  IndexerSearchQuery,
+  IndexerSearchFailure,
+  IndexerSearchStatus,
+  ReleaseSearchOverrides,
+  ReleaseSearchCriteria,
+  ReleaseSearchResult,
+  ReleaseTier,
+} from '@bookorbit/types';
+
+import { sanitizeLogValue } from '../../../common/utils/log-sanitize.utils';
+import { withDeadline } from '../../../common/utils/with-deadline.utils';
+import type { BookRequestRow } from '../../../db/schema';
+import { RequestAutomationSettingsService } from '../fulfillment/request-automation-settings.service';
+import { IndexerSearchException, type ReleaseCandidate, type ReleaseQuery, type ResolvedIndexerConfig } from './indexer-adapter';
+import { IndexerConfigService } from './indexer-config.service';
+import { IndexerOperationLock } from './indexer-operation-lock';
+import { IndexerRegistry } from './indexer-registry';
+import { rejectRelease, scoreRelease, toReleaseItem, type ScoredRelease, type ScoringRequest } from './release-scoring';
+import { buildSearchText } from './search-text';
+
+/**
+ * Parallel search across every enabled indexer is exactly the pattern that gets a private tracker
+ * account throttled, so it is capped rather than unbounded, each indexer gets its own deadline,
+ * and a repeat open of the picker is served from the cache instead of hitting the trackers again.
+ */
+const MAX_CONCURRENT_SEARCHES = 3;
+const PER_INDEXER_TIMEOUT_MS = 20_000;
+const RESULT_LIMIT_PER_INDEXER = 50;
+const CACHE_TTL_MS = 3 * 60 * 1000;
+const MAX_CACHE_ENTRIES_PER_REQUEST = 5;
+/** A ceiling on the merged list. The picker shows a ranked shortlist, not a tracker browser. */
+const MAX_MERGED_RELEASES = 100;
+
+interface CacheEntry {
+  requestId: number;
+  result: ReleaseSearchResult;
+  expiresAt: number;
+  /** The resolved release, kept server-side so a grab names an id and never a URL. */
+  candidates: Map<string, ReleaseCandidate>;
+}
+
+export type IndexerSearchMode = 'all' | 'isbn-capable';
+
+interface IndexerSearchOptions {
+  refresh?: boolean;
+  overrides?: ReleaseSearchOverrides;
+  /** Internal automation pass selection. Manual searches always use every compatible indexer. */
+  indexerMode?: IndexerSearchMode;
+}
+
+@Injectable()
+export class IndexerSearchService {
+  private readonly logger = new Logger(IndexerSearchService.name);
+  private readonly cache = new Map<string, CacheEntry>();
+
+  constructor(
+    private readonly indexers: IndexerConfigService,
+    private readonly registry: IndexerRegistry,
+    private readonly automationSettings: RequestAutomationSettingsService,
+    private readonly operationLock: IndexerOperationLock,
+  ) {}
+
+  async search(request: BookRequestRow, options: IndexerSearchOptions = {}): Promise<ReleaseSearchResult> {
+    const searchKey = JSON.stringify({ overrides: options.overrides ?? null, indexerMode: options.indexerMode ?? 'all' });
+    const cacheKey = `${request.id}:${searchKey}`;
+    const cached = this.cache.get(cacheKey);
+    if (!options.refresh && cached && cached.expiresAt > Date.now()) {
+      return { ...cached.result, cached: true };
+    }
+
+    // Counted alongside the resolve rather than derived from it: an empty result has to be able to
+    // say whether anything was ever going to be searched, and "no source configured" and "every
+    // source switched off" need opposite fixes.
+    const [configs, sources] = await Promise.all([this.indexers.resolveEnabledConfigs(), this.indexers.countSources()]);
+    const { profiles } = await this.automationSettings.get();
+    const tiers = profiles[request.mediaKind] ?? [];
+    const { scoringRequest, availableIsbns } = prepareScoringRequest(request, tiers, options.overrides);
+    const query = toQuery(scoringRequest);
+
+    // A source that does not carry the requested medium is left out of the search rather than
+    // searched and reported: nothing went wrong, no request was ever going to be made, and a
+    // permanent property of the source has no business in a list of search outcomes. Counted, so
+    // an empty list can still say why it is empty.
+    const compatible = configs.filter((config) => this.carriesMedium(config, query.mediaKind));
+    const searchable = options.indexerMode === 'isbn-capable' ? compatible.filter((config) => this.searchesIsbn(config)) : compatible;
+    const uncoveredIndexerCount = configs.length - compatible.length;
+
+    const started = Date.now();
+    const outcomes = await this.searchAll(searchable, query);
+
+    const candidates = new Map<string, ReleaseCandidate>();
+    const statuses: IndexerSearchStatus[] = [];
+    const scored: Array<{ scored: ScoredRelease; indexerName: string }> = [];
+
+    for (const { config, releases, query: indexerQuery, failure, error } of outcomes) {
+      const seedsBack = this.registry.seedsBack(config.adapterType);
+      if (failure) {
+        statuses.push({
+          indexerId: config.id,
+          indexerName: config.name,
+          color: config.color,
+          ok: false,
+          count: 0,
+          filtered: 0,
+          ...(indexerQuery ? { query: indexerQuery } : {}),
+          failure,
+          error,
+          seedsBack,
+        });
+        continue;
+      }
+
+      // Inside the per-indexer accounting, like the search call itself. A release the filter or
+      // the scorer cannot read is one source misbehaving, and outside this it throws out of the
+      // merge and 500s the picker for every other indexer that answered perfectly well.
+      let filtered = 0;
+      let kept = 0;
+      try {
+        for (const candidate of releases) {
+          const rejection = rejectRelease(candidate, scoringRequest);
+          if (rejection) {
+            filtered++;
+            continue;
+          }
+          // A guid is what a grab resolves by, so an indexer that returns one twice describes one
+          // release however many rows it sent. The resolution map already collapsed them; without
+          // the same test here the picker showed the duplicate as a second row and the source's
+          // count claimed a release it does not have. Neither kept nor filtered: nothing was
+          // rejected, there was simply only ever one release.
+          const key = candidateKey(candidate);
+          if (candidates.has(key)) continue;
+
+          candidates.set(key, candidate);
+          scored.push({ scored: scoreRelease(candidate, scoringRequest), indexerName: config.name });
+          kept++;
+        }
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        const errorClass = error instanceof Error ? error.constructor.name : 'UnknownError';
+        this.logger.warn(
+          `[book_request.release_search] [fail] indexerId=${config.id} kept=${kept} durationMs=${Date.now() - started} errorClass=${errorClass} error="${sanitizeLogValue(message)}" - a release from this indexer could not be scored`,
+        );
+        statuses.push({
+          indexerId: config.id,
+          indexerName: config.name,
+          color: config.color,
+          ok: false,
+          count: kept,
+          filtered,
+          query: indexerQuery,
+          failure: 'error',
+          error: `${config.name} returned a release BookOrbit could not read: ${message}`,
+          seedsBack,
+        });
+        continue;
+      }
+
+      statuses.push({
+        indexerId: config.id,
+        indexerName: config.name,
+        color: config.color,
+        ok: true,
+        count: kept,
+        filtered,
+        query: indexerQuery,
+        seedsBack,
+      });
+    }
+
+    // Mapped before the sort because tier is a property of the finished item, and the merged list
+    // has to be cut on the same axis the automation will read it by: tier first, so truncating at
+    // a hundred can never drop a release from a tier the operator asked for in favour of an
+    // untiered one that merely scored well.
+    const items = scored.map((entry) => toReleaseItem(entry.scored, entry.indexerName, scoringRequest));
+    // An unreported seeder count sorts below a stated one rather than above every zero.
+    items.sort((a, b) => compareByTier(a.tier, b.tier) || b.score - a.score || (b.seeders ?? -1) - (a.seeders ?? -1));
+    const releases = items.slice(0, MAX_MERGED_RELEASES);
+
+    const result: ReleaseSearchResult = {
+      releases,
+      criteria: toSearchCriteria(scoringRequest, availableIsbns),
+      indexers: statuses,
+      uncoveredIndexerCount,
+      enabledIndexerCount: configs.length,
+      configuredIndexerCount: sources.configured,
+      profileActive: releaseProfileIsActive(tiers),
+      searchedAt: new Date().toISOString(),
+      cached: false,
+    };
+    this.cache.delete(cacheKey);
+    this.cache.set(cacheKey, { requestId: request.id, result, expiresAt: Date.now() + CACHE_TTL_MS, candidates });
+    this.prune(request.id);
+
+    // Not awaited: the picker is waiting on this response, and how a source has been behaving is
+    // an operator-facing fact rather than part of the answer. A write that fails costs a badge.
+    void this.indexers
+      .recordSearchOutcomes(
+        statuses.map((status) => ({ indexerId: status.indexerId, ok: status.ok, error: status.ok ? null : (status.error ?? null) })),
+      )
+      .catch((error: unknown) => {
+        const message = error instanceof Error ? error.message : String(error);
+        this.logger.warn(
+          `[book_request.release_search] [fail] requestId=${request.id} durationMs=${Date.now() - started} errorClass=${error instanceof Error ? error.constructor.name : typeof error} error="${sanitizeLogValue(message)}" - could not record per-indexer search health`,
+        );
+      });
+
+    this.logger.log(
+      `[book_request.release_search] [end] requestId=${request.id} indexers=${searchable.length} uncovered=${uncoveredIndexerCount} releases=${releases.length} durationMs=${Date.now() - started} - searched enabled indexers`,
+    );
+    return result;
+  }
+
+  /**
+   * The exact release the approver looked at, resolved server-side. A grab names an indexer and a
+   * guid; it never carries a download URL, so a client cannot point the download client anywhere.
+   */
+  find(requestId: number, indexerId: number, guid: string): ReleaseCandidate | undefined {
+    const key = `${indexerId}:${guid}`;
+    for (const entry of [...this.cache.values()].reverse()) {
+      if (entry.requestId !== requestId || entry.expiresAt <= Date.now()) continue;
+      const candidate = entry.candidates.get(key);
+      if (candidate) return candidate;
+    }
+    return undefined;
+  }
+
+  forget(requestId: number): void {
+    for (const [key, entry] of this.cache) {
+      if (entry.requestId === requestId) this.cache.delete(key);
+    }
+  }
+
+  /**
+   * Whether this source is searched for the requested medium: what its adapter can answer for, and
+   * then what the operator left it in. A row whose adapter is no longer part of this build cannot
+   * be judged on its media and is kept in the search, so `searchOne` reports the missing adapter
+   * instead of this hiding it; an operator's own exclusion still applies to such a row, because
+   * that one is a decision about the source rather than a fact about the build.
+   */
+  private carriesMedium(config: ResolvedIndexerConfig, mediaKind: BookRequestMediaKind): boolean {
+    if (config.disabledMediaKinds.includes(mediaKind)) return false;
+    const adapter = this.registry.find(config.adapterType);
+    return !adapter || adapter.mediaKinds.includes(mediaKind);
+  }
+
+  /**
+   * Whether this source gets the request's ISBN. Both halves have to hold: an adapter that cannot
+   * search one has nothing to do with it, and an operator can take it away from one that can.
+   */
+  private searchesIsbn(config: ResolvedIndexerConfig): boolean {
+    return !config.isbnSearchDisabled && this.registry.find(config.adapterType)?.supportsIsbnSearch === true;
+  }
+
+  private async searchAll(configs: ResolvedIndexerConfig[], query: ReleaseQuery): Promise<SearchOutcome[]> {
+    const outcomes: SearchOutcome[] = [];
+    const queue = [...configs];
+
+    const worker = async (): Promise<void> => {
+      for (let config = queue.shift(); config !== undefined; config = queue.shift()) {
+        outcomes.push(await this.searchOne(config, query));
+      }
+    };
+
+    await Promise.all(Array.from({ length: Math.min(MAX_CONCURRENT_SEARCHES, configs.length) }, worker));
+    // Workers drain a shared queue, so completion order is arbitrary; the UI wants pick order.
+    const order = new Map(configs.map((config, index) => [config.id, index]));
+    return outcomes.sort((a, b) => (order.get(a.config.id) ?? 0) - (order.get(b.config.id) ?? 0));
+  }
+
+  private async searchOne(config: ResolvedIndexerConfig, query: ReleaseQuery): Promise<SearchOutcome> {
+    // A credential nothing can read is this source's own problem and nobody else's. Reported here
+    // rather than thrown at the resolve, so a rotated encryption key costs the operator one row in
+    // the source list instead of the entire search.
+    if (config.credentialError) {
+      return { config, releases: [], failure: 'unauthorized', error: `${config.name}: ${config.credentialError}` };
+    }
+
+    return this.operationLock.run(config.id, async () => {
+      try {
+        return await this.searchResolved(await this.indexers.resolveConfig(config.id), query);
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return { config, releases: [], failure: 'error', error: message };
+      }
+    });
+  }
+
+  private async searchResolved(config: ResolvedIndexerConfig, query: ReleaseQuery): Promise<SearchOutcome> {
+    const adapter = this.registry.find(config.adapterType);
+    if (!adapter) {
+      // A row whose adapter is no longer part of the build. It is kept rather than deleted, so
+      // that the operator can see it and replace it instead of losing a stored credential.
+      return {
+        config,
+        releases: [],
+        failure: 'error',
+        error: `This install has no "${config.adapterType}" adapter. Edit it or delete its plugin under Settings > System > Requests.`,
+      };
+    }
+
+    // Withheld rather than flagged, so an adapter cannot search an identifier it was never given.
+    const indexerQuery: IndexerSearchQuery =
+      this.searchesIsbn(config) && query.isbn13 ? { kind: 'isbn', value: query.isbn13 } : { kind: 'titleAuthor', value: buildSearchText(query) };
+    const indexerScopedQuery: ReleaseQuery = indexerQuery.kind === 'isbn' ? query : { ...query, isbn13: null, isbn13s: [] };
+
+    const deadline = AbortSignal.timeout(PER_INDEXER_TIMEOUT_MS);
+    try {
+      // Raced against the deadline rather than merely handed it. An adapter that never settles -
+      // a plugin awaiting a dead promise, an HTTP client that loses its own timeout - holds one of
+      // the three search slots for the life of the process and `Promise.all` below never resolves,
+      // so the picker spins with no error to show for it.
+      let releases = await withDeadline(
+        adapter.search(indexerScopedQuery, config, deadline),
+        deadline,
+        () => new IndexerSearchException('timeout', `${config.name} did not answer in time`),
+      );
+      if (releases.length === 0 && indexerQuery.kind === 'titleAuthor' && query.author?.trim()) {
+        const titleOnlyQuery = { ...indexerScopedQuery, author: null };
+        releases = await withDeadline(
+          adapter.search(titleOnlyQuery, config, deadline),
+          deadline,
+          () => new IndexerSearchException('timeout', `${config.name} did not answer in time`),
+        );
+      }
+      return { config, releases, query: indexerQuery };
+    } catch (error) {
+      const failure: IndexerSearchFailure = error instanceof IndexerSearchException ? error.failure : 'error';
+      const message = error instanceof Error ? error.message : String(error);
+      // One tracker failing is a per-indexer state in the picker, not a failed search.
+      this.logger.warn(
+        `[book_request.release_search] [fail] indexerId=${config.id} failure=${failure} error="${sanitizeLogValue(message)}" - indexer search failed`,
+      );
+      return { config, releases: [], query: indexerQuery, failure, error: message };
+    }
+  }
+
+  /** Search variants are short-lived and bounded per request, so manual edits cannot grow this forever. */
+  private prune(requestId: number): void {
+    const now = Date.now();
+    for (const [key, entry] of this.cache) {
+      if (entry.expiresAt <= now) this.cache.delete(key);
+    }
+
+    const requestEntries = [...this.cache.entries()].filter(([, entry]) => entry.requestId === requestId);
+    for (const [key] of requestEntries.slice(0, -MAX_CACHE_ENTRIES_PER_REQUEST)) {
+      this.cache.delete(key);
+    }
+  }
+}
+
+interface SearchOutcome {
+  config: ResolvedIndexerConfig;
+  releases: ReleaseCandidate[];
+  query?: IndexerSearchQuery;
+  failure?: IndexerSearchFailure;
+  error?: string;
+}
+
+function candidateKey(candidate: ReleaseCandidate): string {
+  return `${candidate.indexerId}:${candidate.guid}`;
+}
+
+function toQuery(request: ScoringRequest): ReleaseQuery {
+  return {
+    title: request.title,
+    author: request.authors[0] ?? null,
+    isbn13: request.isbns[0] ?? null,
+    isbn13s: request.isbns,
+    mediaKind: request.mediaKind,
+    language: request.language,
+    limit: RESULT_LIMIT_PER_INDEXER,
+  };
+}
+
+function prepareScoringRequest(
+  request: BookRequestRow,
+  tiers: readonly ReleaseTier[],
+  overrides?: ReleaseSearchOverrides,
+): { scoringRequest: ScoringRequest; availableIsbns: string[] } {
+  const requestIdentifiers = bookRequestSearchIsbns(request);
+  const activeIsbn = overrides?.isbn !== undefined ? overrides.isbn : (requestIdentifiers[0] ?? null);
+  const availableIsbns = activeIsbn && !requestIdentifiers.includes(activeIsbn) ? [activeIsbn, ...requestIdentifiers] : requestIdentifiers;
+  return {
+    scoringRequest: {
+      title: overrides?.title ?? request.title,
+      authors: overrides?.authors ?? request.authors ?? [],
+      isbn13: activeIsbn,
+      isbn10: null,
+      isbns: activeIsbn ? [activeIsbn] : [],
+      mediaKind: request.mediaKind,
+      preferredFormats: overrides?.preferredFormats ?? request.preferredFormats ?? [],
+      language: overrides?.language !== undefined ? overrides.language : request.language,
+      tiers,
+    },
+    availableIsbns: availableIsbns.slice(0, MAX_BOOK_REQUEST_SEARCH_ISBNS),
+  };
+}
+
+function toSearchCriteria(request: ScoringRequest, availableIsbns: string[]): ReleaseSearchCriteria {
+  return {
+    title: request.title,
+    authors: request.authors,
+    isbn10: request.isbn10,
+    isbn13: request.isbn13,
+    activeIsbn: request.isbns[0] ?? null,
+    isbns: availableIsbns,
+    mediaKind: request.mediaKind,
+    language: request.language,
+    preferredFormats: request.preferredFormats,
+  };
+}
+
+export function bookRequestSearchIsbns(request: BookRequestRow): string[] {
+  const values = [
+    canonicalizeBookRequestIsbn(request.isbn10, request.isbn13),
+    ...(request.metadataSources ?? []).map((source) => canonicalizeBookRequestIsbn(source.isbn10, source.isbn13)),
+  ].filter((value): value is string => value !== null);
+  return [...new Set(values)].slice(0, MAX_BOOK_REQUEST_SEARCH_ISBNS);
+}
diff --git a/server/src/modules/book-request/indexers/indexer.controller.test.ts b/server/src/modules/book-request/indexers/indexer.controller.test.ts
new file mode 100644
index 000000000..e2e058670
--- /dev/null
+++ b/server/src/modules/book-request/indexers/indexer.controller.test.ts
@@ -0,0 +1,140 @@
+import { BadRequestException, ForbiddenException } from '@nestjs/common';
+import { Permission } from '@bookorbit/types';
+
+import { PERMISSION_KEY } from '../../../common/decorators/require-permission.decorator';
+import type { RequestUser } from '../../../common/types/request-user';
+import type { MultipartRequest } from '../../../common/types/multipart-request';
+import { IndexerController } from './indexer.controller';
+
+/**
+ * The three plugin routes are the highest-privilege surface this feature has: an installed plugin
+ * runs inside this process with this process's reach, including the database and the request
+ * encryption key. Their gate is a hand-rolled `assertSuperuser` rather than the permission guard,
+ * so nothing in the authorization matrix can see it, and until this file existed no test anywhere
+ * exercised a refusal.
+ */
+
+function makeUser(overrides: Partial<RequestUser> = {}): RequestUser {
+  return { id: 1, isSuperuser: false, permissions: [], email: 'operator@example.com', ...overrides } as RequestUser;
+}
+
+/** A request whose file would parse fine, so a refusal can only have come from the gate. */
+function makeUpload(): MultipartRequest {
+  return {
+    file: vi.fn().mockResolvedValue({
+      filename: 'demo.mjs',
+      file: { truncated: false },
+      toBuffer: () => Promise.resolve(Buffer.from('export const type = "demo";')),
+    }),
+  } as unknown as MultipartRequest;
+}
+
+describe('IndexerController plugin routes', () => {
+  const service = { findAll: vi.fn(), findOne: vi.fn(), create: vi.fn(), update: vi.fn(), remove: vi.fn(), test: vi.fn() };
+  const registry = { describe: vi.fn().mockReturnValue([]) };
+  const plugins = { loadFailures: vi.fn().mockReturnValue([]) };
+  const pluginInstaller = { inspect: vi.fn(), install: vi.fn(), remove: vi.fn() };
+
+  const controller = new IndexerController(service as never, registry as never, plugins as never, pluginInstaller as never);
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('gates the whole controller on ManageAppSettings', () => {
+    expect(Reflect.getMetadata(PERMISSION_KEY, IndexerController)).toBe(Permission.ManageAppSettings);
+  });
+
+  describe('refuses a non-superuser who holds every permission', () => {
+    // The exact account the gate exists for: an operator trusted with configuration, which is not
+    // the same as being trusted to run arbitrary code in the server process.
+    const operator = makeUser({ permissions: Object.values(Permission) });
+
+    it('refuses inspect', async () => {
+      const req = makeUpload();
+
+      await expect(controller.inspectPlugin(operator, req)).rejects.toBeInstanceOf(ForbiddenException);
+      // Refused before the upload is even read, so a rejected file is never parsed or buffered.
+      expect(req.file).not.toHaveBeenCalled();
+      expect(pluginInstaller.inspect).not.toHaveBeenCalled();
+    });
+
+    it('refuses install', async () => {
+      const req = makeUpload();
+
+      await expect(controller.installPlugin(operator, req)).rejects.toBeInstanceOf(ForbiddenException);
+      expect(req.file).not.toHaveBeenCalled();
+      expect(pluginInstaller.install).not.toHaveBeenCalled();
+    });
+
+    it('refuses remove', async () => {
+      await expect(controller.removePlugin(operator, 'demo')).rejects.toBeInstanceOf(ForbiddenException);
+      expect(pluginInstaller.remove).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('lets a superuser through', () => {
+    const admin = makeUser({ isSuperuser: true });
+
+    it('inspects the uploaded file', async () => {
+      pluginInstaller.inspect.mockResolvedValue({ type: 'demo' });
+
+      await expect(controller.inspectPlugin(admin, makeUpload())).resolves.toEqual({ type: 'demo' });
+      expect(pluginInstaller.inspect).toHaveBeenCalledWith('export const type = "demo";');
+    });
+
+    it('installs it, attributing the install to the caller', async () => {
+      pluginInstaller.install.mockResolvedValue({ type: 'demo' });
+
+      await controller.installPlugin(makeUser({ isSuperuser: true, email: 'admin@example.com' }), makeUpload());
+
+      expect(pluginInstaller.install).toHaveBeenCalledWith('export const type = "demo";', 'admin@example.com');
+    });
+
+    it('falls back to the user id when the account has no email to attribute to', async () => {
+      pluginInstaller.install.mockResolvedValue({ type: 'demo' });
+
+      await controller.installPlugin(makeUser({ id: 42, isSuperuser: true, email: null }), makeUpload());
+
+      expect(pluginInstaller.install).toHaveBeenCalledWith('export const type = "demo";', 'user:42');
+    });
+
+    it('removes a plugin by type', async () => {
+      pluginInstaller.remove.mockResolvedValue(undefined);
+
+      await controller.removePlugin(admin, 'demo');
+
+      expect(pluginInstaller.remove).toHaveBeenCalledWith('demo', 'operator@example.com');
+    });
+  });
+
+  describe('validates the upload only after the gate has passed', () => {
+    const admin = makeUser({ isSuperuser: true });
+
+    it('refuses a request carrying no file', async () => {
+      const req = { file: vi.fn().mockResolvedValue(undefined) } as unknown as MultipartRequest;
+
+      await expect(controller.installPlugin(admin, req)).rejects.toBeInstanceOf(BadRequestException);
+    });
+
+    it('refuses anything that is not a single .mjs file', async () => {
+      const req = {
+        file: vi.fn().mockResolvedValue({ filename: 'plugin.zip', file: { truncated: false }, toBuffer: () => Promise.resolve(Buffer.from('')) }),
+      } as unknown as MultipartRequest;
+
+      await expect(controller.installPlugin(admin, req)).rejects.toBeInstanceOf(BadRequestException);
+    });
+
+    it('refuses a file that hit the size cap, which arrives truncated rather than as an error', async () => {
+      const req = {
+        file: vi.fn().mockResolvedValue({
+          filename: 'huge.mjs',
+          file: { truncated: true },
+          toBuffer: () => Promise.resolve(Buffer.from('export const type = "demo";')),
+        }),
+      } as unknown as MultipartRequest;
+
+      await expect(controller.installPlugin(admin, req)).rejects.toBeInstanceOf(BadRequestException);
+    });
+  });
+});
diff --git a/server/src/modules/book-request/indexers/indexer.controller.ts b/server/src/modules/book-request/indexers/indexer.controller.ts
new file mode 100644
index 000000000..e6c70c112
--- /dev/null
+++ b/server/src/modules/book-request/indexers/indexer.controller.ts
@@ -0,0 +1,178 @@
+import {
+  BadRequestException,
+  Body,
+  Controller,
+  Delete,
+  ForbiddenException,
+  Get,
+  HttpCode,
+  HttpStatus,
+  Param,
+  ParseIntPipe,
+  Post,
+  Put,
+  Req,
+} from '@nestjs/common';
+import { AuditAction, AuditResource, Permission } from '@bookorbit/types';
+import type { IndexerAdapterListResult, PluginInspection, PluginInstallResult } from '@bookorbit/types';
+
+import { CurrentUser } from '../../../common/decorators/current-user.decorator';
+import { Auditable } from '../../../common/decorators/auditable.decorator';
+import { RequirePermission } from '../../../common/decorators/require-permission.decorator';
+import { IndexerConfigService } from './indexer-config.service';
+import { IndexerRegistry } from './indexer-registry';
+import { PluginLoaderService } from './plugins/plugin-loader.service';
+import { MAX_PLUGIN_BYTES, PluginInstallService } from './plugins/plugin-install.service';
+import { CreateIndexerDto, UpdateIndexerDto } from './dto/indexer.dto';
+import type { RequestUser } from '../../../common/types/request-user';
+import type { MultipartRequest } from '../../../common/types/multipart-request';
+
+/**
+ * Gated on `ManageAppSettings`, not `ManageBookRequests`: moderating a queue and holding tracker
+ * credentials are different levels of trust, and an approver should not get the second by having
+ * the first.
+ */
+@Controller('admin/request-indexers')
+@RequirePermission(Permission.ManageAppSettings)
+export class IndexerController {
+  constructor(
+    private readonly service: IndexerConfigService,
+    private readonly registry: IndexerRegistry,
+    private readonly plugins: PluginLoaderService,
+    private readonly pluginInstaller: PluginInstallService,
+  ) {}
+
+  @Get()
+  findAll() {
+    return this.service.findAll();
+  }
+
+  /**
+   * What this install can offer. Served at runtime rather than compiled into the client, because
+   * an adapter loaded from the plugin directory is not knowable at build time. The failures are
+   * here too: a plugin that simply did not appear is the worst way to learn it has a typo.
+   *
+   * Declared before `:id` so the router does not try to parse "adapters" as a row id.
+   */
+  @Get('adapters')
+  listAdapters(): IndexerAdapterListResult {
+    return { adapters: this.registry.describe(), pluginFailures: [...this.plugins.loadFailures()] };
+  }
+
+  /**
+   * Reads an uploaded plugin without keeping it, so the operator can see what it declares and read
+   * the file before deciding. Nothing is written and nothing is staged.
+   *
+   * Audited even though nothing is kept: reading the plugin means executing it, so this is the
+   * point uploaded code first runs on the server. An install leaves a trail of who introduced the
+   * code; without this, running it stops short of one.
+   */
+  @Post('plugins/inspect')
+  @HttpCode(HttpStatus.OK)
+  @Auditable({
+    action: AuditAction.RequestIndexerPluginInspect,
+    resource: AuditResource.RequestIndexer,
+    description: (_req, res: unknown) => `Inspected indexer plugin '${(res as PluginInspection)?.type ?? 'unknown'}'`,
+  })
+  async inspectPlugin(@CurrentUser() user: RequestUser, @Req() req: MultipartRequest): Promise<PluginInspection> {
+    return this.pluginInstaller.inspect(await readPluginUpload(user, req));
+  }
+
+  /**
+   * The same file again rather than a token for the one just inspected: re-reading it is cheap, and
+   * it means the file that was checked and the file that lands are the same bytes by construction.
+   */
+  @Post('plugins')
+  @HttpCode(HttpStatus.CREATED)
+  @Auditable({
+    action: AuditAction.RequestIndexerPluginInstall,
+    resource: AuditResource.RequestIndexer,
+    description: (_req, res: unknown) =>
+      `${(res as PluginInspection)?.replaces ? 'Replaced' : 'Installed'} indexer plugin '${(res as PluginInspection)?.type ?? 'unknown'}'`,
+  })
+  async installPlugin(@CurrentUser() user: RequestUser, @Req() req: MultipartRequest): Promise<PluginInstallResult> {
+    return this.pluginInstaller.install(await readPluginUpload(user, req), user.email ?? `user:${user.id}`);
+  }
+
+  @Delete('plugins/:type')
+  @HttpCode(HttpStatus.NO_CONTENT)
+  @Auditable({
+    action: AuditAction.RequestIndexerPluginRemove,
+    resource: AuditResource.RequestIndexer,
+    description: (req: unknown) =>
+      `Deleted indexer plugin '${(req as { params?: { type?: string } })?.params?.type ?? 'unknown'}' and its configured sources`,
+  })
+  async removePlugin(@CurrentUser() user: RequestUser, @Param('type') type: string): Promise<void> {
+    assertSuperuser(user);
+    await this.pluginInstaller.remove(type, user.email ?? `user:${user.id}`);
+  }
+
+  @Get(':id')
+  findOne(@Param('id', ParseIntPipe) id: number) {
+    return this.service.findOne(id);
+  }
+
+  @Post()
+  @Auditable({
+    action: AuditAction.RequestIndexerCreate,
+    resource: AuditResource.RequestIndexer,
+    getResourceId: (_req, res: unknown) => (res as { id?: number })?.id,
+    description: (_req, res: unknown) => `Created indexer '${(res as { name?: string })?.name ?? 'unknown'}'`,
+  })
+  create(@Body() dto: CreateIndexerDto) {
+    return this.service.create(dto);
+  }
+
+  @Put(':id')
+  @Auditable({
+    action: AuditAction.RequestIndexerUpdate,
+    resource: AuditResource.RequestIndexer,
+    getResourceId: (req) => Number(req.params.id),
+    description: (req) => `Updated indexer #${req.params.id}`,
+  })
+  update(@Param('id', ParseIntPipe) id: number, @Body() dto: UpdateIndexerDto) {
+    return this.service.update(id, dto);
+  }
+
+  @Delete(':id')
+  @HttpCode(HttpStatus.NO_CONTENT)
+  @Auditable({
+    action: AuditAction.RequestIndexerDelete,
+    resource: AuditResource.RequestIndexer,
+    getResourceId: (req) => Number(req.params.id),
+    description: (req) => `Deleted indexer #${req.params.id}`,
+  })
+  remove(@Param('id', ParseIntPipe) id: number) {
+    return this.service.remove(id);
+  }
+
+  @Post(':id/test')
+  @HttpCode(HttpStatus.OK)
+  test(@Param('id', ParseIntPipe) id: number) {
+    return this.service.test(id);
+  }
+}
+
+/**
+ * Installing a plugin runs its code in this process, with this process's reach. `ManageAppSettings`
+ * is the wrong bar for that: it is a permission an operator hands out for configuration, and this
+ * is not configuration. Enforced here rather than only hidden in the UI, because a hidden button is
+ * not a control.
+ */
+function assertSuperuser(user: RequestUser): void {
+  if (!user.isSuperuser) throw new ForbiddenException('Only administrators can install indexer plugins');
+}
+
+async function readPluginUpload(user: RequestUser, req: MultipartRequest): Promise<string> {
+  assertSuperuser(user);
+
+  const upload = await req.file({ limits: { fileSize: MAX_PLUGIN_BYTES } });
+  if (!upload) throw new BadRequestException('No file provided');
+  if (!upload.filename.endsWith('.mjs')) throw new BadRequestException('A plugin is a single .mjs file');
+
+  const source = await upload.toBuffer();
+  // Fastify truncates rather than throwing once the limit is passed, so a file that hit the cap
+  // would otherwise arrive as a plausible-looking prefix and fail later as a syntax error.
+  if (upload.file.truncated) throw new BadRequestException(`A plugin must be smaller than ${MAX_PLUGIN_BYTES} bytes`);
+  return source.toString('utf8');
+}
diff --git a/server/src/modules/book-request/indexers/indexer.repository.test.ts b/server/src/modules/book-request/indexers/indexer.repository.test.ts
new file mode 100644
index 000000000..b4267db88
--- /dev/null
+++ b/server/src/modules/book-request/indexers/indexer.repository.test.ts
@@ -0,0 +1,87 @@
+import { createCapturingDb } from '../../../common/test-utils/capture-sql-db';
+import { IndexerRepository } from './indexer.repository';
+
+describe('IndexerRepository', () => {
+  it('selects only assigned colors when choosing a default for a new indexer', async () => {
+    const { db, queries } = createCapturingDb();
+    const repository = new IndexerRepository(db);
+
+    await repository.findAssignedColors();
+
+    expect(queries).toHaveLength(1);
+    expect(queries[0].sql).toMatch(/^select "color" from "request_indexers"/);
+  });
+
+  it('deletes every indexer with the requested adapter type in one query', async () => {
+    const { db, queries } = createCapturingDb();
+    const repository = new IndexerRepository(db);
+
+    await repository.deleteByAdapterType('demo-tracker');
+
+    expect(queries).toHaveLength(1);
+    expect(queries[0].sql).toMatch(/delete from "request_indexers" where "request_indexers"\."adapter_type" = \$1/);
+    expect(queries[0].params).toEqual(['demo-tracker']);
+  });
+
+  it('replaces a rotated credential only while the whole config snapshot is current', async () => {
+    const { db, queries } = createCapturingDb();
+    const repository = new IndexerRepository(db);
+    const updatedAt = new Date('2026-08-25T12:00:00Z');
+
+    await repository.updateCredentialIfCurrent(4, 'old-ciphertext', updatedAt, 'new-ciphertext');
+
+    expect(queries).toHaveLength(1);
+    expect(queries[0].sql).toMatch(
+      /update "request_indexers" set "credentials_enc" = \$1, "updated_at" = \$2 where \("request_indexers"\."id" = \$3 and "request_indexers"\."updated_at" = \$4 and "request_indexers"\."credentials_enc" = \$5\)/,
+    );
+    expect(queries[0].params[0]).toBe('new-ciphertext');
+    expect(queries[0].params.slice(2)).toEqual([4, updatedAt.toISOString(), 'old-ciphertext']);
+  });
+
+  /**
+   * One statement for the batch. This runs on the back of every merged search, and a round trip
+   * per enabled indexer on an instance with a dozen of them is a cost the picker would pay for a
+   * badge nobody is looking at yet.
+   */
+  it('records every configured source outcome in one statement', async () => {
+    const { db, queries } = createCapturingDb();
+    const repository = new IndexerRepository(db);
+
+    await repository.recordSearchOutcomes([
+      { indexerId: 1, ok: true, error: null },
+      { indexerId: 2, ok: false, error: 'The tracker answered 429' },
+    ]);
+
+    expect(queries).toHaveLength(1);
+    expect(queries[0].sql).toMatch(/update "request_indexers" set "last_search_at" = \$1, "last_search_ok" = case when/);
+    expect(queries[0].sql).toMatch(/"request_indexers"\."id" in \(\$\d+, \$\d+\)/);
+    expect(queries[0].sql).toMatch(/"request_indexers"\."last_search_at" is null or "request_indexers"\."last_search_at" < \$\d+/);
+    expect(queries[0].params).toContain('The tracker answered 429');
+  });
+
+  /**
+   * The streak is computed in SQL rather than read and written back, so two searches finishing at
+   * once cannot both write the same number. A success resets it outright.
+   */
+  it('increments the failure streak in place and resets it on a success', async () => {
+    const { db, queries } = createCapturingDb();
+    const repository = new IndexerRepository(db);
+
+    await repository.recordSearchOutcomes([
+      { indexerId: 1, ok: false, error: 'timed out' },
+      { indexerId: 2, ok: true, error: null },
+    ]);
+
+    expect(queries[0].sql).toMatch(/"search_failure_streak" = case when .* then "request_indexers"\."search_failure_streak" \+ 1/);
+    expect(queries[0].sql).toMatch(/then 0 end/);
+  });
+
+  /** Nothing was searched, so there is nothing to say about any source. */
+  it('writes nothing when a search reported no outcomes at all', async () => {
+    const { db, queries } = createCapturingDb();
+
+    await new IndexerRepository(db).recordSearchOutcomes([]);
+
+    expect(queries).toHaveLength(0);
+  });
+});
diff --git a/server/src/modules/book-request/indexers/indexer.repository.ts b/server/src/modules/book-request/indexers/indexer.repository.ts
new file mode 100644
index 000000000..8f49547d5
--- /dev/null
+++ b/server/src/modules/book-request/indexers/indexer.repository.ts
@@ -0,0 +1,138 @@
+import { Inject, Injectable } from '@nestjs/common';
+import { and, asc, eq, inArray, isNull, lt, or, sql } from 'drizzle-orm';
+import { NodePgDatabase } from 'drizzle-orm/node-postgres';
+
+import type { BookRequestSourceStatus } from '@bookorbit/types';
+
+import { DB } from '../../../db';
+import * as schema from '../../../db/schema';
+import { requestIndexers, type NewRequestIndexerRow, type RequestIndexerRow } from '../../../db/schema';
+
+type Db = NodePgDatabase<typeof schema>;
+
+@Injectable()
+export class IndexerRepository {
+  constructor(@Inject(DB) private readonly db: Db) {}
+
+  async findAll(): Promise<RequestIndexerRow[]> {
+    return this.db.select().from(requestIndexers).orderBy(asc(requestIndexers.id));
+  }
+
+  async findAssignedColors(): Promise<Array<RequestIndexerRow['color']>> {
+    const rows = await this.db.select({ color: requestIndexers.color }).from(requestIndexers);
+    return rows.map((row) => row.color);
+  }
+
+  async findById(id: number): Promise<RequestIndexerRow | undefined> {
+    const [row] = await this.db.select().from(requestIndexers).where(eq(requestIndexers.id, id)).limit(1);
+    return row;
+  }
+
+  /**
+   * Both counts in one pass. Read on every visit to the requests page by anybody who may file a
+   * request, so it never selects the rows themselves: a count is all that surface is allowed.
+   */
+  async countSources(): Promise<BookRequestSourceStatus> {
+    const [row] = await this.db
+      .select({
+        configured: sql<number>`count(*)::int`,
+        enabled: sql<number>`count(*) filter (where ${requestIndexers.enabled})::int`,
+      })
+      .from(requestIndexers);
+    return { configured: row?.configured ?? 0, enabled: row?.enabled ?? 0 };
+  }
+
+  /** Every enabled row. Order is stable rather than meaningful: all of them are searched. */
+  async findAllEnabled(): Promise<RequestIndexerRow[]> {
+    return this.db.select().from(requestIndexers).where(eq(requestIndexers.enabled, true)).orderBy(asc(requestIndexers.id));
+  }
+
+  async create(data: NewRequestIndexerRow): Promise<RequestIndexerRow> {
+    const [row] = await this.db.insert(requestIndexers).values(data).returning();
+    return row;
+  }
+
+  async update(id: number, data: Partial<NewRequestIndexerRow>): Promise<RequestIndexerRow | undefined> {
+    const [row] = await this.db.update(requestIndexers).set(data).where(eq(requestIndexers.id, id)).returning();
+    return row;
+  }
+
+  async updateCredentialIfCurrent(id: number, current: string | null, updatedAt: Date, replacement: string): Promise<boolean> {
+    const result = await this.db
+      .update(requestIndexers)
+      .set({ credentialsEnc: replacement })
+      .where(
+        and(
+          eq(requestIndexers.id, id),
+          eq(requestIndexers.updatedAt, updatedAt),
+          current === null ? isNull(requestIndexers.credentialsEnc) : eq(requestIndexers.credentialsEnc, current),
+        ),
+      );
+    return (result.rowCount ?? 0) === 1;
+  }
+
+  async delete(id: number): Promise<void> {
+    await this.db.delete(requestIndexers).where(eq(requestIndexers.id, id));
+  }
+
+  /** Asked before an uninstall deletes them, so "no such thing" is not answered by the delete itself. */
+  async countByAdapterType(adapterType: string): Promise<number> {
+    const [row] = await this.db
+      .select({ count: sql<number>`count(*)::int` })
+      .from(requestIndexers)
+      .where(eq(requestIndexers.adapterType, adapterType));
+    return row?.count ?? 0;
+  }
+
+  async deleteByAdapterType(adapterType: string): Promise<number> {
+    const result = await this.db.delete(requestIndexers).where(eq(requestIndexers.adapterType, adapterType));
+    return result.rowCount ?? 0;
+  }
+
+  async recordTestResult(id: number, ok: boolean, errorMessage: string | null): Promise<void> {
+    await this.db
+      .update(requestIndexers)
+      .set({ lastTestedAt: new Date(), lastTestOk: ok, lastErrorMessage: errorMessage })
+      .where(eq(requestIndexers.id, id));
+  }
+
+  /**
+   * How the last real search went, per source, written after every merged search.
+   *
+   * One statement for the batch: this runs on the back of every picker open, and a round trip per
+   * enabled indexer on an instance with a dozen of them is a cost the search does not need to pay.
+   * The streak is `+1` computed in SQL rather than read and written back, so two searches
+   * finishing at once cannot both write the same number.
+   */
+  async recordSearchOutcomes(outcomes: ReadonlyArray<{ indexerId: number; ok: boolean; error: string | null }>): Promise<void> {
+    if (outcomes.length === 0) return;
+
+    const at = new Date();
+    const ids = outcomes.map((outcome) => outcome.indexerId);
+    const okCase = sql.join(
+      outcomes.map((outcome) => sql`when ${requestIndexers.id} = ${outcome.indexerId} then ${outcome.ok}`),
+      sql` `,
+    );
+    const errorCase = sql.join(
+      outcomes.map((outcome) => sql`when ${requestIndexers.id} = ${outcome.indexerId} then ${outcome.error}::text`),
+      sql` `,
+    );
+    const streakCase = sql.join(
+      outcomes.map(
+        (outcome) =>
+          sql`when ${requestIndexers.id} = ${outcome.indexerId} then ${outcome.ok ? sql`0` : sql`${requestIndexers.searchFailureStreak} + 1`}`,
+      ),
+      sql` `,
+    );
+
+    await this.db
+      .update(requestIndexers)
+      .set({
+        lastSearchAt: at,
+        lastSearchOk: sql`case ${okCase} end`,
+        lastSearchError: sql`case ${errorCase} end`,
+        searchFailureStreak: sql`case ${streakCase} end`,
+      })
+      .where(and(inArray(requestIndexers.id, ids), or(isNull(requestIndexers.lastSearchAt), lt(requestIndexers.lastSearchAt, at))));
+  }
+}
diff --git a/server/src/modules/book-request/indexers/plugins/plugin-host.test.ts b/server/src/modules/book-request/indexers/plugins/plugin-host.test.ts
new file mode 100644
index 000000000..553bfb596
--- /dev/null
+++ b/server/src/modules/book-request/indexers/plugins/plugin-host.test.ts
@@ -0,0 +1,537 @@
+import type { IndexerPlugin, PluginHost } from '@bookorbit/plugin-api';
+
+/**
+ * A plugin's URLs are tracker-chosen, so the host pins the connection to the address that passed
+ * policy - and that path goes through undici's fetch rather than the global one. The wrapper is
+ * what is under test, so undici is pointed back at the stub each test installs; what the
+ * dispatcher itself does is proven in `safe-fetch.test.ts`.
+ */
+vi.mock('undici', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('undici')>()),
+  fetch: (...args: Parameters<typeof fetch>) => fetch(...args),
+}));
+
+/** Every name in these tests is a stand-in, so one public answer stands for all of them. */
+vi.mock('dns/promises', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('dns/promises')>()),
+  lookup: vi.fn(() => Promise.resolve([{ address: '93.184.216.34', family: 4 }])),
+}));
+
+import type { IndexerCredentialStore } from '../indexer-credential-store';
+import { IndexerSearchException, type ReleaseQuery, type ResolvedIndexerConfig } from '../indexer-adapter';
+import { PluginIndexerAdapter } from './plugin-host';
+
+function config(overrides: Partial<ResolvedIndexerConfig> = {}): ResolvedIndexerConfig {
+  return {
+    id: 4,
+    name: 'Example Tracker',
+    adapterType: 'torznab',
+    baseUrl: 'https://tracker.example.com',
+    credential: 'a-key',
+    allowPrivateAddress: false,
+    categories: { ebook: [7020], audiobook: [3030], comic: [7030] },
+    settings: null,
+    ...overrides,
+  };
+}
+
+function query(overrides: Partial<ReleaseQuery> = {}): ReleaseQuery {
+  return { title: 'Dune', author: 'Frank Herbert', isbn13: null, isbn13s: [], mediaKind: 'ebook', language: null, limit: 20, ...overrides };
+}
+
+function plugin(overrides: Partial<IndexerPlugin> = {}): IndexerPlugin {
+  return {
+    apiVersion: 1,
+    version: '1.2.3',
+    type: 'example-tracker',
+    label: 'Example Tracker',
+    requiresCredential: true,
+    credentialKind: 'apiKey',
+    mediaKinds: ['ebook'],
+    usesCategories: true,
+    seedsBack: true,
+    search: () => Promise.resolve([]),
+    test: () => Promise.resolve({ success: true }),
+    fetchTorrentFile: () => Promise.resolve(new Uint8Array([1, 2, 3])),
+    ...overrides,
+  };
+}
+
+function makeAdapter(overrides: Partial<IndexerPlugin> = {}) {
+  const credentials = { rotate: vi.fn().mockResolvedValue(true) } as unknown as IndexerCredentialStore;
+  return { adapter: new PluginIndexerAdapter(plugin(overrides), credentials), credentials };
+}
+
+describe('PluginIndexerAdapter', () => {
+  let fetchMock: ReturnType<typeof vi.fn<typeof fetch>>;
+
+  beforeEach(() => {
+    fetchMock = vi.fn<typeof fetch>();
+    vi.stubGlobal('fetch', fetchMock);
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  it('presents a plugin as an ordinary adapter', () => {
+    const { adapter } = makeAdapter();
+
+    expect(adapter.type).toBe('example-tracker');
+    expect(adapter.mediaKinds).toEqual(['ebook']);
+    expect(adapter.requiresCredential).toBe(true);
+  });
+
+  /** The rest of the module keys releases by indexer, and a plugin has no business setting that. */
+  it('stamps the indexer id on what a plugin returns', async () => {
+    const { adapter } = makeAdapter({
+      search: () => Promise.resolve([{ guid: 'g1', title: 'Dune', sizeBytes: null, seeders: null, leechers: null }]),
+    });
+
+    const [release] = await adapter.search(query(), config({ id: 11 }), AbortSignal.timeout(1000));
+
+    expect(release.indexerId).toBe(11);
+  });
+
+  /**
+   * A plugin is hand-written JavaScript with no compile-time contract, and the merge scores every
+   * candidate outside the per-indexer failure accounting: one malformed row used to throw out of
+   * the whole search and 500 the picker for every indexer that answered perfectly well.
+   */
+  describe('what a plugin says it found', () => {
+    async function searched(releases: unknown) {
+      const { adapter } = makeAdapter({ search: () => Promise.resolve(releases as never) });
+      return adapter.search(query(), config(), AbortSignal.timeout(1000));
+    }
+
+    it('drops a row with no usable title or guid rather than failing the search', async () => {
+      const releases = await searched([
+        { guid: 'g1', title: { name: 'Dune' }, sizeBytes: null, seeders: null, leechers: null },
+        { guid: null, title: 'Dune', sizeBytes: null, seeders: null, leechers: null },
+        { guid: 'g3', title: '   ', sizeBytes: null, seeders: null, leechers: null },
+        undefined,
+        { guid: 'g5', title: 'Dune', sizeBytes: null, seeders: null, leechers: null },
+      ]);
+
+      expect(releases.map((r) => r.guid)).toEqual(['g5']);
+    });
+
+    /** "1984" and "2001" are books, and a source that states one as a number still means the title. */
+    it('keeps a title or a guid a source stated as a number', async () => {
+      const [release] = await searched([{ guid: 4471, title: 1984 }]);
+
+      expect(release).toMatchObject({ guid: '4471', title: '1984' });
+    });
+
+    /**
+     * `undefined` is the one that used to leak: the scorer reads "the indexer stated a count" as
+     * anything that is not null, so an absent seeder count scored `NaN` and broke the sort, and an
+     * absent size rendered as "NaN KB" with a penalty attached.
+     */
+    it('turns an unstated number into null rather than undefined', async () => {
+      const [release] = await searched([{ guid: 'g1', title: 'Dune' }]);
+
+      expect(release.seeders).toBeNull();
+      expect(release.sizeBytes).toBeNull();
+      expect(release.leechers).toBeNull();
+    });
+
+    it('coerces numeric strings and rejects values that are not non-negative finite numbers', async () => {
+      const [release] = await searched([{ guid: 'g1', title: 'Dune', sizeBytes: '2000000', seeders: '0', leechers: -1 }]);
+
+      expect(release.sizeBytes).toBe(2_000_000);
+      expect(release.seeders).toBe(0);
+      expect(release.leechers).toBeNull();
+    });
+
+    it('reads a flag as the boolean it is meant to be', async () => {
+      const [release] = await searched([{ guid: 'g1', title: 'Dune', freeleech: 'yes', vipOnly: 1, alreadyGrabbed: null }]);
+
+      expect(release.freeleech).toBe(false);
+      expect(release.vipOnly).toBe(false);
+      expect(release.alreadyGrabbed).toBe(false);
+    });
+
+    it('nulls an unreadable audio figure without losing the release', async () => {
+      const [release] = await searched([{ guid: 'g1', title: 'Dune', audio: { bitrateKbps: 'lots', channels: 2 } }]);
+
+      expect(release.audio).toEqual({
+        bitrateKbps: null,
+        bitrateMode: null,
+        channels: 2,
+        samplingRateHz: null,
+        durationSeconds: null,
+        chapterCount: null,
+      });
+    });
+
+    it('caps how many releases one source can hand back', async () => {
+      const releases = await searched(Array.from({ length: 500 }, (_, index) => ({ guid: `g${index}`, title: 'Dune' })));
+
+      expect(releases).toHaveLength(200);
+    });
+
+    it('reports something that is not a list as an indexer failure', async () => {
+      await expect(searched({ releases: [] })).rejects.toBeInstanceOf(IndexerSearchException);
+    });
+  });
+
+  /** Only `fetchTorrentFile` or `resolveFile` is exposed, matching what the plugin declared. */
+  it('exposes only the grab path the plugin declared', () => {
+    expect(makeAdapter().resolveFile).toBeUndefined();
+    expect(makeAdapter().adapter.fetchTorrentFile).toBeDefined();
+
+    const direct = makeAdapter({
+      fetchTorrentFile: undefined,
+      resolveFile: () => Promise.resolve({ url: 'https://x/y.epub', fileName: 'y.epub', sizeBytes: 1, format: 'epub' }),
+    });
+    expect(direct.adapter.resolveFile).toBeDefined();
+    expect(direct.adapter.fetchTorrentFile).toBeUndefined();
+  });
+
+  describe('containment', () => {
+    /**
+     * The reason the host lends a `fetch` rather than letting a plugin use the global one: this is
+     * where the address policy is applied, and a plugin must not be able to opt out of it.
+     */
+    it('refuses a host fetch to a private address', async () => {
+      let host!: PluginHost;
+      const { adapter } = makeAdapter({
+        search: (_q, _c, given) => {
+          host = given;
+          return Promise.resolve([]);
+        },
+      });
+      await adapter.search(query(), config(), AbortSignal.timeout(1000));
+
+      await expect(host.fetch('http://127.0.0.1:8080/internal')).rejects.toThrow();
+      expect(fetchMock).not.toHaveBeenCalled();
+    });
+
+    it('allows a private address only where the row opted in', async () => {
+      fetchMock.mockResolvedValue(new Response('ok'));
+      let host!: PluginHost;
+      const { adapter } = makeAdapter({
+        search: (_q, _c, given) => {
+          host = given;
+          return Promise.resolve([]);
+        },
+      });
+      await adapter.search(query(), config({ allowPrivateAddress: true }), AbortSignal.timeout(1000));
+
+      await expect(host.fetch('http://127.0.0.1:8080/proxy')).resolves.toBeDefined();
+    });
+
+    /**
+     * A plugin can only check its signal between requests, so the deadline has to reach the
+     * request already in flight. Without this a source that stalls runs the full per-request
+     * ceiling and the shorter per-indexer deadline passes unheard.
+     */
+    it('ends a plugin request when the search deadline expires, not only its own ceiling', async () => {
+      fetchMock.mockImplementation(
+        (_url, init) =>
+          new Promise((_resolve, reject) => {
+            const signal = (init as RequestInit | undefined)?.signal;
+            signal?.addEventListener('abort', () => reject(signal.reason as Error));
+          }),
+      );
+      const { adapter } = makeAdapter({
+        search: (_q, _c, host) => host.fetch('http://127.0.0.1:8080/slow').then(() => []),
+      });
+
+      await expect(adapter.search(query(), config({ allowPrivateAddress: true }), AbortSignal.timeout(20))).rejects.toMatchObject({
+        failure: 'timeout',
+      });
+    });
+
+    /**
+     * The deadline reaches a plugin's fetches and nothing else. One awaiting a promise of its own
+     * that never settles used to hold a search slot for the life of the process, and the
+     * `Promise.all` over the indexers never resolved: a picker spinning with no error on it.
+     */
+    it('ends a search a plugin never returns from', async () => {
+      const { adapter } = makeAdapter({ search: () => new Promise(() => {}) });
+
+      await expect(adapter.search(query(), config(), AbortSignal.timeout(20))).rejects.toMatchObject({ failure: 'timeout' });
+    });
+
+    /** The one value a plugin produces that a download client then opens on its own. */
+    it('checks the URL a plugin resolves before it reaches a download client', async () => {
+      const { adapter } = makeAdapter({
+        fetchTorrentFile: undefined,
+        resolveFile: () => Promise.resolve({ url: 'http://169.254.169.254/latest/meta-data', fileName: 'x.epub', sizeBytes: 1, format: 'epub' }),
+      });
+
+      await expect(
+        adapter.resolveFile!(
+          { indexerId: 4, guid: 'g', title: 't', sizeBytes: null, seeders: null, leechers: null },
+          config(),
+          AbortSignal.timeout(1000),
+        ),
+      ).rejects.toThrow();
+    });
+
+    it('refuses a torrent file too large to be one', async () => {
+      const { adapter } = makeAdapter({ fetchTorrentFile: () => Promise.resolve(new Uint8Array(4 * 1024 * 1024)) });
+
+      await expect(
+        adapter.fetchTorrentFile!({ indexerId: 4, guid: 'g', title: 't', sizeBytes: null, seeders: null, leechers: null }, config()),
+      ).rejects.toThrow(/too large/);
+    });
+
+    /**
+     * `redirect: 'follow'` checks the URL the plugin named and nothing after it, so the hops are
+     * taken here instead: the guarantee the host makes is about every address, not the first one.
+     */
+    it('checks each hop of a redirect rather than only the URL a plugin named', async () => {
+      fetchMock.mockResolvedValueOnce(new Response(null, { status: 302, headers: { location: 'http://169.254.169.254/latest/meta-data' } }));
+      let failure: unknown;
+      const { adapter } = makeAdapter({
+        search: async (_q, _c, host) => {
+          failure = await host.fetch('https://tracker.example.com/grab').catch((error: unknown) => error);
+          return [];
+        },
+      });
+
+      await adapter.search(query(), config(), AbortSignal.timeout(1000));
+
+      expect(failure).toBeInstanceOf(Error);
+      expect((failure as Error).message).toMatch(/private or local/);
+      // The metadata address was never opened: the refusal happened between the hops.
+      expect(fetchMock).toHaveBeenCalledTimes(1);
+    });
+
+    it('follows a redirect to a public address and returns what it answered', async () => {
+      fetchMock
+        .mockResolvedValueOnce(new Response(null, { status: 302, headers: { location: 'https://cdn.example.com/page' } }))
+        .mockResolvedValueOnce(new Response('the page'));
+      let body!: string;
+      const { adapter } = makeAdapter({
+        search: async (_q, _c, host) => {
+          body = await host.fetch('https://tracker.example.com/page').then((response) => response.text());
+          return [];
+        },
+      });
+
+      await adapter.search(query(), config(), AbortSignal.timeout(1000));
+
+      expect(body).toBe('the page');
+      expect(new URL(fetchMock.mock.calls.at(-1)![0] as string).href).toBe('https://cdn.example.com/page');
+    });
+
+    /**
+     * A redirect to the login page is how an expired session announces itself, so a plugin that
+     * asked to see it still gets the 3xx rather than a body fetched from wherever it pointed.
+     */
+    it('hands a plugin the redirect itself where it asked for one', async () => {
+      fetchMock.mockResolvedValue(new Response(null, { status: 302, headers: { location: '/login.php' } }));
+      let status!: number;
+      const { adapter } = makeAdapter({
+        search: async (_q, _c, host) => {
+          status = await host.fetch('https://tracker.example.com/api', { redirect: 'manual' }).then((response) => response.status);
+          return [];
+        },
+      });
+
+      await adapter.search(query(), config(), AbortSignal.timeout(1000));
+
+      expect(status).toBe(302);
+      expect(fetchMock).toHaveBeenCalledTimes(1);
+    });
+
+    /**
+     * A plugin posts a search and authenticates with a session cookie, so replaying the body or
+     * carrying the cookie onward would send a tracker's credential wherever the redirect pointed.
+     * `redirect: 'follow'` applied both rules for us; following by hand has to apply them too.
+     */
+    it('drops the body and the credential when a POST is redirected to another host', async () => {
+      fetchMock
+        .mockResolvedValueOnce(new Response(null, { status: 302, headers: { location: 'https://cdn.example.com/results' } }))
+        .mockResolvedValueOnce(new Response('the results'));
+      const { adapter } = makeAdapter({
+        search: async (_q, _c, host) => {
+          await host.fetch('https://tracker.example.com/search', {
+            method: 'POST',
+            body: 'q=dune',
+            headers: { Cookie: 'session=secret', Accept: 'text/html' },
+          });
+          return [];
+        },
+      });
+
+      await adapter.search(query(), config(), AbortSignal.timeout(1000));
+
+      const second = fetchMock.mock.calls[1][1] as RequestInit;
+      expect(second.method).toBe('GET');
+      expect(second.body).toBeUndefined();
+      expect(second.headers).toEqual({ Accept: 'text/html' });
+    });
+
+    /** Same host, same request: the rules are about crossing an origin, not about redirecting. */
+    it('keeps the credential on a redirect that stays on the same host', async () => {
+      fetchMock
+        .mockResolvedValueOnce(new Response(null, { status: 302, headers: { location: '/results' } }))
+        .mockResolvedValueOnce(new Response('the results'));
+      const { adapter } = makeAdapter({
+        search: async (_q, _c, host) => {
+          await host.fetch('https://tracker.example.com/search', { headers: { Cookie: 'session=secret' } });
+          return [];
+        },
+      });
+
+      await adapter.search(query(), config(), AbortSignal.timeout(1000));
+
+      expect((fetchMock.mock.calls[1][1] as RequestInit).headers).toEqual({ Cookie: 'session=secret' });
+    });
+
+    /** 307 exists precisely to say "same request, new address", so the body survives. */
+    it('replays the body on a 307 that stays on the same host', async () => {
+      fetchMock
+        .mockResolvedValueOnce(new Response(null, { status: 307, headers: { location: '/v2/search' } }))
+        .mockResolvedValueOnce(new Response('the results'));
+      const { adapter } = makeAdapter({
+        search: async (_q, _c, host) => {
+          await host.fetch('https://tracker.example.com/search', { method: 'POST', body: 'q=dune' });
+          return [];
+        },
+      });
+
+      await adapter.search(query(), config(), AbortSignal.timeout(1000));
+
+      const second = fetchMock.mock.calls[1][1] as RequestInit;
+      expect(second.method).toBe('POST');
+      expect(second.body).toBe('q=dune');
+    });
+
+    it('gives up rather than following a redirect loop forever', async () => {
+      fetchMock.mockResolvedValue(new Response(null, { status: 302, headers: { location: 'https://tracker.example.com/again' } }));
+      const { adapter } = makeAdapter({
+        search: (_q, _c, host) => host.fetch('https://tracker.example.com/start').then(() => []),
+      });
+
+      await expect(adapter.search(query(), config(), AbortSignal.timeout(1000))).rejects.toThrow(/redirected more than/);
+    });
+
+    /** What a plugin reads is a page or a feed, and how much of one it reads is not its choice. */
+    it('stops a plugin reading past the response ceiling', async () => {
+      let pulls = 0;
+      const chunk = 256 * 1024;
+      const endless = new ReadableStream<Uint8Array>(
+        {
+          pull(controller) {
+            pulls++;
+            controller.enqueue(new Uint8Array(chunk));
+          },
+        },
+        { highWaterMark: 0 },
+      );
+      fetchMock.mockResolvedValue(new Response(endless));
+      const { adapter } = makeAdapter({
+        search: (_q, _c, host) =>
+          host
+            .fetch('https://tracker.example.com/huge')
+            .then((response) => response.text())
+            .then(() => []),
+      });
+
+      await expect(adapter.search(query(), config(), AbortSignal.timeout(5000))).rejects.toBeInstanceOf(IndexerSearchException);
+      expect(pulls).toBe((16 * 1024 * 1024) / chunk + 1);
+    });
+
+    it('refuses a response that declares itself past the ceiling before it is read', async () => {
+      fetchMock.mockResolvedValue(new Response('x', { headers: { 'content-length': String(64 * 1024 * 1024) } }));
+      const { adapter } = makeAdapter({
+        search: (_q, _c, host) => host.fetch('https://tracker.example.com/huge').then(() => []),
+      });
+
+      await expect(adapter.search(query(), config(), AbortSignal.timeout(1000))).rejects.toThrow(/larger than/);
+    });
+
+    /** A plugin holding our own object could otherwise mutate the config every adapter shares. */
+    it('hands the plugin a copy of the config rather than the original', async () => {
+      const original = config();
+      let seen!: { categories: { ebook: number[] } };
+      const { adapter } = makeAdapter({
+        search: (_q, given) => {
+          seen = given;
+          given.categories.ebook.push(9999);
+          return Promise.resolve([]);
+        },
+      });
+
+      await adapter.search(query(), original, AbortSignal.timeout(1000));
+
+      expect(seen.categories.ebook).toContain(9999);
+      expect(original.categories.ebook).toEqual([7020]);
+    });
+  });
+
+  describe('failures', () => {
+    /**
+     * A plugin is imported at runtime and so holds its own copy of any class it imports. Its
+     * errors are normalised here, or a bare throw would reach the picker as an empty result.
+     */
+    it('turns anything a plugin throws into a failure the picker can act on', async () => {
+      const { adapter } = makeAdapter({
+        search: () => {
+          throw new TypeError('cannot read properties of undefined');
+        },
+      });
+
+      await expect(adapter.search(query(), config(), AbortSignal.timeout(1000))).rejects.toBeInstanceOf(IndexerSearchException);
+      await expect(adapter.search(query(), config(), AbortSignal.timeout(1000))).rejects.toMatchObject({ failure: 'error' });
+    });
+
+    it('keeps the failure code a plugin chose through host.fail', async () => {
+      const { adapter } = makeAdapter({
+        search: (_q, _c, host) => {
+          throw host.fail('unauthorized', 'the key was rejected');
+        },
+      });
+
+      await expect(adapter.search(query(), config(), AbortSignal.timeout(1000))).rejects.toMatchObject({ failure: 'unauthorized' });
+    });
+
+    it('reports a plugin that hangs as a timeout rather than an error', async () => {
+      const { adapter } = makeAdapter({
+        search: () => {
+          const error = new Error('aborted');
+          error.name = 'TimeoutError';
+          throw error;
+        },
+      });
+
+      await expect(adapter.search(query(), config(), AbortSignal.timeout(1000))).rejects.toMatchObject({ failure: 'timeout' });
+    });
+  });
+
+  it('writes a rotated credential through the store rather than the database', async () => {
+    const { adapter, credentials } = makeAdapter({
+      search: async (_q, _c, host) => {
+        await host.saveCredential('a-rotated-session');
+        return [];
+      },
+    });
+
+    await adapter.search(query(), config({ id: 12 }), AbortSignal.timeout(1000));
+
+    // The credential the search ran with travels with the rotation, so the store can refuse one
+    // that follows on from a session an operator has since replaced.
+    expect(credentials.rotate).toHaveBeenCalledWith(12, 'a-rotated-session', 'a-key');
+  });
+
+  it('chains multiple credential rotations from the last accepted session', async () => {
+    const { adapter, credentials } = makeAdapter({
+      search: vi.fn(async (_query, _config, host) => {
+        await host.saveCredential('session-2');
+        await host.saveCredential('session-3');
+        return [];
+      }),
+    });
+
+    await adapter.search(query(), config({ credential: 'session-1' }), AbortSignal.timeout(1_000));
+
+    expect(credentials.rotate).toHaveBeenNthCalledWith(1, 4, 'session-2', 'session-1');
+    expect(credentials.rotate).toHaveBeenNthCalledWith(2, 4, 'session-3', 'session-2');
+  });
+});
diff --git a/server/src/modules/book-request/indexers/plugins/plugin-host.ts b/server/src/modules/book-request/indexers/plugins/plugin-host.ts
new file mode 100644
index 000000000..7dc5be8ac
--- /dev/null
+++ b/server/src/modules/book-request/indexers/plugins/plugin-host.ts
@@ -0,0 +1,397 @@
+import { Logger } from '@nestjs/common';
+import type {
+  IndexerPlugin,
+  PluginHost,
+  PluginIndexerConfig,
+  PluginReleaseCandidate,
+  PluginReleaseQuery,
+  PluginRequestInit,
+  PluginSearchFailure,
+} from '@bookorbit/plugin-api';
+import type { BookRequestMediaKind, IndexerAdapterType, IndexerSettingsField, ReleaseAudioInfo } from '@bookorbit/types';
+
+import { boundedResponse } from '../../../../common/utils/bounded-response';
+import { sanitizeLogValue } from '../../../../common/utils/log-sanitize.utils';
+import { safeFetch } from '../../../../common/utils/safe-fetch';
+import { withDeadline } from '../../../../common/utils/with-deadline.utils';
+import { ensureSafeUrl } from '../../../../common/utils/ssrf.utils';
+import { buildSearchText } from '../search-text';
+import { MAX_TORRENT_FILE_BYTES } from '../../fulfillment/torrent.utils';
+import type { IndexerCredentialStore } from '../indexer-credential-store';
+import {
+  IndexerSearchException,
+  type IndexerAdapter,
+  type ReleaseCandidate,
+  type ReleaseFile,
+  type ReleaseQuery,
+  type ResolvedIndexerConfig,
+} from '../indexer-adapter';
+
+/**
+ * A ceiling on any one request a plugin makes, and one it cannot opt out of.
+ *
+ * A ceiling per request is not a deadline for the work, though: a plugin that reads four pages
+ * can sit behind this one four times over while the per-indexer deadline expires unheard. Where a
+ * caller has a deadline of its own, `deadlineFor` combines the two.
+ */
+const REQUEST_TIMEOUT_MS = 25_000;
+/**
+ * A ceiling on the body of any one request too, and likewise one a plugin cannot opt out of.
+ *
+ * What a plugin reads is a page, a feed or a JSON document, never a book: a file a download client
+ * will open is resolved as a URL rather than fetched here. Generous enough that no real source
+ * reaches it, low enough that a body which never ends is bounded rather than fatal.
+ */
+const MAX_RESPONSE_BYTES = 16 * 1024 * 1024;
+/** A redirect chain, not a loop. Matches the other outbound fetchers. */
+const MAX_REDIRECTS = 5;
+
+/**
+ * Bounds on what one search may hand back. A plugin is hand-written JavaScript with no
+ * compile-time contract, so these are the numbers a merged result set is allowed to cost rather
+ * than a statement about any real source: the merge keeps a hundred releases across every indexer,
+ * and a source returning four times its own page size is malfunctioning either way.
+ */
+const MAX_PLUGIN_RELEASES = 200;
+/** Long enough for the most decorated scene name, short enough that a row cannot become a payload. */
+const MAX_PLUGIN_TEXT_LENGTH = 1_000;
+/** A URL, a magnet or a guid. Generous, because a tracker's one-shot links carry a lot of query. */
+const MAX_PLUGIN_URL_LENGTH = 4_000;
+
+/**
+ * Wraps a plugin so the rest of the module sees an ordinary `IndexerAdapter` and never learns
+ * that this one came off disk.
+ *
+ * The wrapper is what a well-behaved plugin is held to, not a sandbox: a plugin runs in this
+ * process with this process's reach, and `plugin-loader.service.ts` states that trade openly.
+ * What the wrapper does hold is every path through it. `host.fetch` applies the address policy
+ * and the deadline; `host.saveCredential` is the only credential write it offers; and whatever a
+ * plugin throws is normalised here, because an error thrown across a dynamic import boundary is
+ * not an `instanceof` anything we own.
+ */
+export class PluginIndexerAdapter implements IndexerAdapter {
+  readonly type: IndexerAdapterType;
+  readonly label: string;
+  readonly requiresCredential: boolean;
+  readonly mediaKinds: readonly BookRequestMediaKind[];
+  readonly supportsIsbnSearch: boolean;
+  readonly settingsFields: readonly IndexerSettingsField[];
+
+  private readonly logger: Logger;
+
+  constructor(
+    readonly plugin: IndexerPlugin,
+    private readonly credentials: IndexerCredentialStore,
+  ) {
+    this.type = plugin.type as IndexerAdapterType;
+    this.label = plugin.label;
+    this.requiresCredential = plugin.requiresCredential;
+    this.mediaKinds = plugin.mediaKinds as readonly BookRequestMediaKind[];
+    this.supportsIsbnSearch = plugin.supportsIsbnSearch === true;
+    this.settingsFields = plugin.settingsFields ?? [];
+    this.logger = new Logger(`plugin:${plugin.type}`);
+  }
+
+  async search(query: ReleaseQuery, config: ResolvedIndexerConfig, signal: AbortSignal): Promise<ReleaseCandidate[]> {
+    const found = await this.guard(config, () =>
+      // Raced rather than handed the signal and trusted with it. A plugin can only check a signal
+      // between its own requests, so one awaiting a promise that never settles holds its slot in
+      // the search pool for as long as the process lives and `Promise.all` over the indexers never
+      // resolves - the deadline reaches the fetches inside it and nothing else. The signal's own
+      // `TimeoutError` is what rejects, which `guard` already reports as an indexer timeout.
+      withDeadline(this.plugin.search(toPluginQuery(query), toPluginConfig(config), this.host(config, signal), signal), signal),
+    );
+    return sanitizeCandidates(found, config);
+  }
+
+  async test(config: ResolvedIndexerConfig) {
+    return this.guard(config, () => this.plugin.test(toPluginConfig(config), this.host(config)));
+  }
+
+  get fetchTorrentFile() {
+    if (!this.plugin.fetchTorrentFile) return undefined;
+    return async (release: ReleaseCandidate, config: ResolvedIndexerConfig): Promise<Buffer> => {
+      const bytes = await this.guard(config, () =>
+        this.plugin.fetchTorrentFile!(toPluginRelease(release), toPluginConfig(config), this.host(config)),
+      );
+      // A plugin has no reason to be trusted about size, and this lands in memory.
+      if (bytes.byteLength > MAX_TORRENT_FILE_BYTES) {
+        throw new IndexerSearchException('error', `${config.name} returned something too large to be a .torrent file`);
+      }
+      return Buffer.from(bytes);
+    };
+  }
+
+  get resolveFile() {
+    if (!this.plugin.resolveFile) return undefined;
+    return async (release: ReleaseCandidate, config: ResolvedIndexerConfig, signal: AbortSignal): Promise<ReleaseFile> => {
+      const file = await this.guard(config, () =>
+        this.plugin.resolveFile!(toPluginRelease(release), toPluginConfig(config), this.host(config, signal), signal),
+      );
+      // The URL is about to be handed to a download client, so it is checked here rather than
+      // trusted: this is the one value a plugin produces that reaches the network on its own.
+      await ensureSafeUrl(file.url, { allowPrivate: config.allowPrivateAddress });
+      return file;
+    };
+  }
+
+  get keepalive() {
+    if (!this.plugin.keepalive) return undefined;
+    return async (config: ResolvedIndexerConfig): Promise<void> => {
+      await this.guard(config, () => this.plugin.keepalive!(toPluginConfig(config), this.host(config)));
+    };
+  }
+
+  /**
+   * `deadline` is the caller's, where the caller has one. It is applied here rather than handed to
+   * the plugin because a plugin can only check a signal between requests, and the request that
+   * overruns is the one already in flight.
+   */
+  private host(config: ResolvedIndexerConfig, deadline?: AbortSignal): PluginHost {
+    let currentCredential = config.credential;
+    return {
+      fetch: (url: string, init?: PluginRequestInit) => this.fetchForPlugin(config, url, init, deadline),
+      logger: {
+        log: (message: string) => this.logger.log(sanitizeLogValue(message)),
+        warn: (message: string) => this.logger.warn(sanitizeLogValue(message)),
+      },
+      buildSearchText: (query: PluginReleaseQuery) => buildSearchText(query as ReleaseQuery),
+      // The credential this call was resolved with, so the store can tell a rotation of the live
+      // session apart from one of a session an operator has since replaced.
+      saveCredential: async (credential: string) => {
+        if (await this.credentials.rotate(config.id, credential, currentCredential)) currentCredential = credential;
+      },
+      fail: (failure: PluginSearchFailure, message: string) => new IndexerSearchException(failure, `${config.name}: ${message}`),
+    };
+  }
+
+  /**
+   * The one way a plugin reaches the network, and therefore where every guarantee about that
+   * traffic is made rather than hoped for.
+   *
+   * Redirects are followed here rather than by the fetch, because `redirect: 'follow'` checks the
+   * first URL and nothing after it: a hop to loopback or to a link-local metadata address would
+   * be taken without ever being seen. A plugin that asks for `'manual'` gets the 3xx itself,
+   * which is how an expired session is told apart from a real answer, and never a body fetched
+   * from an address that was not checked.
+   */
+  private async fetchForPlugin(
+    config: ResolvedIndexerConfig,
+    rawUrl: string,
+    init: PluginRequestInit | undefined,
+    deadline: AbortSignal | undefined,
+  ): Promise<Response> {
+    const signal = deadlineFor(deadline);
+    // Pinned, unlike most callers: these URLs are tracker-chosen rather than operator-chosen, so
+    // the resolve-twice window `safeFetch` leaves open on the default path is one a hostile source
+    // could aim at a private address. The hop loop below checks every URL; this makes the address
+    // that passed the check the address the connection uses.
+    const options = { allowPrivate: config.allowPrivateAddress, profile: config.networkProfile, pinResolvedAddress: true };
+
+    let current = rawUrl;
+    let method = init?.method ?? 'GET';
+    let headers = { ...(init?.headers ?? {}) };
+    let body = init?.body;
+
+    for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
+      const response = await safeFetch(current, { method, headers, ...(body !== undefined ? { body } : {}), redirect: 'manual', signal }, options);
+
+      const location = response.status >= 300 && response.status < 400 ? response.headers.get('location') : null;
+      if (init?.redirect === 'manual' || !location) return boundedResponse(response, MAX_RESPONSE_BYTES);
+
+      void response.body?.cancel().catch(() => undefined);
+      const next = await ensureSafeUrl(new URL(location, current).href, options);
+
+      // The two rules `redirect: 'follow'` would have applied for us, and both matter here: a
+      // plugin posts a search and authenticates with a session cookie, so replaying the body or
+      // carrying the cookie onward would send a tracker's credential wherever it pointed.
+      if (downgradesToGet(response.status, method)) {
+        method = 'GET';
+        body = undefined;
+      }
+      if (new URL(current).origin !== next.origin) headers = withoutCredentialHeaders(headers);
+
+      current = next.href;
+    }
+
+    throw new IndexerSearchException('error', `${config.name} redirected more than ${MAX_REDIRECTS} times`);
+  }
+
+  /**
+   * Anything a plugin throws becomes a failure the picker can act on. Without this a plugin that
+   * throws a bare `TypeError` would surface as an unexplained empty result, which is the failure
+   * mode this module exists to avoid.
+   */
+  private async guard<T>(config: ResolvedIndexerConfig, run: () => Promise<T>): Promise<T> {
+    try {
+      return await run();
+    } catch (error) {
+      if (error instanceof IndexerSearchException) throw error;
+      if (error instanceof Error && (error.name === 'AbortError' || error.name === 'TimeoutError')) {
+        throw new IndexerSearchException('timeout', `${config.name} did not answer in time`);
+      }
+      const message = error instanceof Error ? error.message : String(error);
+      this.logger.warn(
+        `[request_indexer.plugin] [fail] indexerId=${config.id} type=${this.type} error="${sanitizeLogValue(message)}" - the plugin threw`,
+      );
+      throw new IndexerSearchException('error', `${config.name}: ${message}`);
+    }
+  }
+}
+
+/** 303 always, and 301 or 302 for anything that was not already a GET or a HEAD. */
+function downgradesToGet(status: number, method: string): boolean {
+  const safeMethod = method.toUpperCase() === 'GET' || method.toUpperCase() === 'HEAD';
+  return status === 303 || ((status === 301 || status === 302) && !safeMethod);
+}
+
+const CREDENTIAL_HEADERS = new Set(['authorization', 'cookie', 'cookie2', 'proxy-authorization']);
+
+function withoutCredentialHeaders(headers: Record<string, string>): Record<string, string> {
+  return Object.fromEntries(Object.entries(headers).filter(([name]) => !CREDENTIAL_HEADERS.has(name.toLowerCase())));
+}
+
+/**
+ * Whichever expires first ends the request: the per-request ceiling, or the deadline the search
+ * itself is working to. Without the second one a stalled source runs the full ceiling and blows
+ * past the per-indexer deadline, which is measurably what happens - libgen.li answers the same
+ * query in under a second and, occasionally, not at all.
+ */
+function deadlineFor(deadline?: AbortSignal): AbortSignal {
+  const ceiling = AbortSignal.timeout(REQUEST_TIMEOUT_MS);
+  return deadline ? AbortSignal.any([deadline, ceiling]) : ceiling;
+}
+
+/**
+ * What a plugin says it found, reduced to what the rest of the module is willing to believe.
+ *
+ * Scoring runs outside the per-indexer failure accounting, so one malformed row does not fail one
+ * source: a non-string title throws out of the whole merge and 500s a search across every indexer,
+ * `seeders: undefined` scores `NaN` and breaks the sort, and an absent `sizeBytes` renders as
+ * "NaN KB". None of that is a plugin bug worth propagating, so a row that cannot be read is
+ * dropped here and its source keeps the rest of its results.
+ */
+function sanitizeCandidates(found: readonly PluginReleaseCandidate[], config: ResolvedIndexerConfig): ReleaseCandidate[] {
+  if (!Array.isArray(found)) {
+    throw new IndexerSearchException('error', `${config.name} returned something that is not a list of releases`);
+  }
+
+  const releases: ReleaseCandidate[] = [];
+  for (const raw of found.slice(0, MAX_PLUGIN_RELEASES)) {
+    const candidate = sanitizeCandidate(raw, config.id);
+    if (candidate) releases.push(candidate);
+  }
+  return releases;
+}
+
+/** Null for a row with no usable identity: without a title and a guid there is nothing to grab. */
+function sanitizeCandidate(raw: PluginReleaseCandidate, indexerId: number): ReleaseCandidate | null {
+  const title = text(raw?.title, MAX_PLUGIN_TEXT_LENGTH);
+  const guid = text(raw?.guid, MAX_PLUGIN_URL_LENGTH);
+  if (!title || !guid) return null;
+
+  return {
+    indexerId,
+    guid,
+    title,
+    ...optional('bookTitle', text(raw.bookTitle, MAX_PLUGIN_TEXT_LENGTH)),
+    ...optional('downloadUrl', text(raw.downloadUrl, MAX_PLUGIN_URL_LENGTH)),
+    ...optional('magnet', text(raw.magnet, MAX_PLUGIN_URL_LENGTH)),
+    ...optional('infoHash', text(raw.infoHash, MAX_PLUGIN_TEXT_LENGTH)),
+    // Null rather than undefined for both, which is the difference the scorer reads: undefined
+    // takes the "the indexer stated a count" branch and scores it, null says nothing was stated.
+    sizeBytes: finite(raw.sizeBytes),
+    seeders: finite(raw.seeders),
+    leechers: finite(raw.leechers),
+    ...optional('format', text(raw.format, MAX_PLUGIN_TEXT_LENGTH)),
+    ...optional('language', text(raw.language, MAX_PLUGIN_TEXT_LENGTH)),
+    ...optional('author', text(raw.author, MAX_PLUGIN_TEXT_LENGTH)),
+    ...optional('isbn', text(raw.isbn, MAX_PLUGIN_TEXT_LENGTH)),
+    ...optional('publishedAt', text(raw.publishedAt, MAX_PLUGIN_TEXT_LENGTH)),
+    freeleech: raw.freeleech === true,
+    alreadyGrabbed: raw.alreadyGrabbed === true,
+    vipOnly: raw.vipOnly === true,
+    ...optionalNumber('primaryFileCount', raw.primaryFileCount),
+    ...optionalNumber('fileCount', raw.fileCount),
+    ...optionalNumber('seedRatioGoal', raw.seedRatioGoal),
+    ...optionalNumber('seedTimeMinutes', raw.seedTimeMinutes),
+    ...(raw.audio && typeof raw.audio === 'object' ? { audio: sanitizeAudio(raw.audio) } : {}),
+  };
+}
+
+/**
+ * Shown and sorted on rather than scored, so every field is nulled independently: an unreadable
+ * bitrate loses the bitrate, not the release.
+ */
+function sanitizeAudio(audio: NonNullable<PluginReleaseCandidate['audio']>): ReleaseAudioInfo {
+  return {
+    bitrateKbps: finite(audio.bitrateKbps),
+    bitrateMode: text(audio.bitrateMode, MAX_PLUGIN_TEXT_LENGTH),
+    channels: finite(audio.channels),
+    samplingRateHz: finite(audio.samplingRateHz),
+    durationSeconds: finite(audio.durationSeconds),
+    chapterCount: finite(audio.chapterCount),
+  };
+}
+
+function text(value: unknown, maxLength: number): string | null {
+  if (typeof value === 'number' && Number.isFinite(value)) return String(value);
+  if (typeof value !== 'string') return null;
+  const trimmed = value.trim().slice(0, maxLength);
+  return trimmed === '' ? null : trimmed;
+}
+
+/** A non-negative number the scorer can do arithmetic with, or null. */
+function finite(value: unknown): number | null {
+  const parsed = typeof value === 'number' ? value : typeof value === 'string' && value.trim() !== '' ? Number(value) : Number.NaN;
+  return Number.isFinite(parsed) && parsed >= 0 ? parsed : null;
+}
+
+function optional<K extends string>(key: K, value: string | null): Record<K, string> | Record<string, never> {
+  return value === null ? {} : ({ [key]: value } as Record<K, string>);
+}
+
+function optionalNumber<K extends string>(key: K, value: unknown): Record<K, number> | Record<string, never> {
+  const parsed = finite(value);
+  return parsed === null ? {} : ({ [key]: parsed } as Record<K, number>);
+}
+
+function toPluginQuery(query: ReleaseQuery): PluginReleaseQuery {
+  return {
+    title: query.title,
+    author: query.author,
+    isbn13: query.isbn13,
+    isbn13s: query.isbn13s,
+    mediaKind: query.mediaKind,
+    language: query.language,
+    limit: query.limit,
+  };
+}
+
+/**
+ * Deliberately a deep copy. A shallow one still shares the category arrays and the settings
+ * object, so a plugin that pushed onto `categories.ebook` would be editing the config every other
+ * adapter in this search is reading from.
+ */
+function toPluginConfig(config: ResolvedIndexerConfig): PluginIndexerConfig {
+  return {
+    id: config.id,
+    name: config.name,
+    baseUrl: config.baseUrl,
+    credential: config.credential,
+    allowPrivateAddress: config.allowPrivateAddress,
+    categories: {
+      ebook: [...config.categories.ebook],
+      audiobook: [...config.categories.audiobook],
+      comic: [...config.categories.comic],
+    },
+    settings: config.settings ? structuredClone(config.settings as Record<string, unknown>) : null,
+  };
+}
+
+/** `indexerId` is ours to set, not a plugin's to see echoed back. */
+function toPluginRelease(release: ReleaseCandidate): PluginReleaseCandidate {
+  const rest: Partial<ReleaseCandidate> = { ...release };
+  delete rest.indexerId;
+  return rest as PluginReleaseCandidate;
+}
diff --git a/server/src/modules/book-request/indexers/plugins/plugin-install.service.test.ts b/server/src/modules/book-request/indexers/plugins/plugin-install.service.test.ts
new file mode 100644
index 000000000..84c7b92a3
--- /dev/null
+++ b/server/src/modules/book-request/indexers/plugins/plugin-install.service.test.ts
@@ -0,0 +1,375 @@
+import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { INDEXER_ADAPTER_TYPES } from '@bookorbit/types';
+
+import { PluginInstallService, MAX_PLUGIN_BYTES } from './plugin-install.service';
+import { PluginLoaderService } from './plugin-loader.service';
+import type { IndexerRegistry } from '../indexer-registry';
+
+/** A plugin that satisfies the contract, with individual fields overridable. */
+function pluginSource(overrides: Record<string, string> = {}): string {
+  const fields: Record<string, string> = {
+    apiVersion: '1',
+    version: "'1.2.3'",
+    type: "'example-tracker'",
+    label: "'Example Tracker'",
+    requiresCredential: 'true',
+    credentialKind: "'apiKey'",
+    mediaKinds: "['ebook']",
+    usesCategories: 'true',
+    seedsBack: 'true',
+    search: 'async () => []',
+    test: 'async () => ({ success: true })',
+    fetchTorrentFile: 'async () => new Uint8Array([1, 2, 3])',
+    ...overrides,
+  };
+  const body = Object.entries(fields)
+    .filter(([, value]) => value !== 'OMIT')
+    .map(([key, value]) => `  ${key}: ${value},`)
+    .join('\n');
+  return `export default {\n${body}\n};\n`;
+}
+
+describe('PluginInstallService', () => {
+  let appDataPath: string;
+  let service: PluginInstallService;
+  let loader: PluginLoaderService;
+  let registry: { register: ReturnType<typeof vi.fn>; unregister: ReturnType<typeof vi.fn> };
+  let indexers: { countByAdapterType: ReturnType<typeof vi.fn>; deleteByAdapterType: ReturnType<typeof vi.fn> };
+
+  beforeEach(async () => {
+    appDataPath = await mkdtemp(join(tmpdir(), 'bookorbit-install-'));
+    // The real loader, because installing has to produce something it can actually read back.
+    loader = new PluginLoaderService({ appDataPath } as never, { rotate: vi.fn() } as never);
+    registry = { register: vi.fn(), unregister: vi.fn() };
+    indexers = { countByAdapterType: vi.fn().mockResolvedValue(0), deleteByAdapterType: vi.fn().mockResolvedValue(0) };
+    service = new PluginInstallService({ appDataPath } as never, registry as unknown as IndexerRegistry, loader, indexers as never);
+  });
+
+  afterEach(async () => {
+    await rm(appDataPath, { recursive: true, force: true });
+  });
+
+  const installed = (type: string) => join(appDataPath, 'plugins', 'indexers', type, 'index.mjs');
+
+  describe('inspect', () => {
+    it('reports what a plugin declares about itself', async () => {
+      await expect(service.inspect(pluginSource())).resolves.toMatchObject({
+        type: 'example-tracker',
+        label: 'Example Tracker',
+        version: '1.2.3',
+        requiresCredential: true,
+        credentialKind: 'apiKey',
+        mediaKinds: ['ebook'],
+        usesCategories: true,
+        seedsBack: true,
+        replaces: false,
+      });
+    });
+
+    /** One dependency-free file is what makes reading it before trusting it realistic. */
+    it('hands the source back so it can be read before it is run', async () => {
+      const source = pluginSource();
+
+      await expect(service.inspect(source)).resolves.toMatchObject({ source });
+    });
+
+    it('reads the optional fields the settings form needs', async () => {
+      const source = pluginSource({
+        defaultBaseUrl: "'https://tracker.example'",
+        baseUrlHint: "'The tracker address'",
+        settingsFields:
+          "[{ key: 'formats', type: 'string', format: 'list', label: 'Formats', default: 'epub', options: ['epub', 'pdf'], minItems: 1 }]",
+      });
+
+      await expect(service.inspect(source)).resolves.toMatchObject({
+        defaultBaseUrl: 'https://tracker.example',
+        baseUrlHint: 'The tracker address',
+        settingsFields: [
+          {
+            key: 'formats',
+            type: 'string',
+            format: 'list',
+            label: 'Formats',
+            default: 'epub',
+            options: ['epub', 'pdf'],
+            minItems: 1,
+          },
+        ],
+      });
+    });
+
+    /** Nothing is kept, so an operator can look at a file without committing to it. */
+    it('writes nothing while inspecting', async () => {
+      await service.inspect(pluginSource());
+
+      await expect(readFile(installed('example-tracker'), 'utf8')).rejects.toThrow();
+    });
+
+    it('says when an install would replace one already there', async () => {
+      await service.install(pluginSource(), 'someone');
+
+      await expect(service.inspect(pluginSource())).resolves.toMatchObject({ replaces: true });
+    });
+
+    it.each([
+      ['a different contract version', { apiVersion: '99' }, /version/i],
+      ['an invalid plugin version', { version: "'next'" }, /semantic version/i],
+      ['no label', { label: "''" }, /label/i],
+      ['no search function', { search: 'OMIT' }, /search/i],
+      ['no test function', { test: 'OMIT' }, /test/i],
+      ['no media kinds', { mediaKinds: '[]' }, /media kinds/i],
+      ['a media kind that is not one', { mediaKinds: "['newspaper']" }, /newspaper/i],
+      ['a type that is not a slug', { type: "'SHOUTY'" }, /slug/i],
+      ['both grab methods', { resolveFile: 'async () => ({})' }, /both/i],
+      ['neither grab method', { fetchTorrentFile: 'OMIT' }, /neither/i],
+      ['an unusable settings field', { settingsFields: "[{ type: 'boolean', label: 'x' }]" }, /settings field/i],
+    ])('refuses a plugin with %s', async (_case, overrides, message) => {
+      await expect(service.inspect(pluginSource(overrides))).rejects.toThrow(message);
+    });
+
+    it('accepts a legacy plugin that does not declare its own version', async () => {
+      await expect(service.inspect(pluginSource({ version: 'OMIT' }))).resolves.not.toHaveProperty('version');
+    });
+
+    /** It would be refused at the next boot and simply not appear, which is a worse way to learn. */
+    it('refuses a plugin claiming a built-in name', async () => {
+      await expect(service.inspect(pluginSource({ type: "'torznab'" }))).rejects.toThrow(/already provides/i);
+    });
+
+    it('refuses a file that is not a module at all', async () => {
+      await expect(service.inspect('this is not javascript {{{')).rejects.toThrow(/could not be read/i);
+    });
+
+    it('refuses a module with no default export', async () => {
+      await expect(service.inspect('export const nope = 1;\n')).rejects.toThrow(/not a usable plugin/i);
+    });
+
+    it('refuses an empty file', async () => {
+      await expect(service.inspect('')).rejects.toThrow(/empty/i);
+    });
+
+    it('refuses a file past the size cap', async () => {
+      const huge = `// ${'x'.repeat(MAX_PLUGIN_BYTES)}\n${pluginSource()}`;
+
+      await expect(service.inspect(huge)).rejects.toThrow(/limit/i);
+    });
+
+    /**
+     * Evaluating a module runs its top-level code. Reading it in a child process is what keeps a
+     * plugin that never finishes loading from taking this one with it.
+     */
+    it('gives up on a file that never finishes loading', async () => {
+      const wedged = `await new Promise(() => {});\n${pluginSource()}`;
+
+      await expect(service.inspect(wedged)).rejects.toThrow(/did not finish loading/i);
+    }, 20000);
+
+    it('repeats why a plugin threw on import rather than saying it failed', async () => {
+      await expect(service.inspect("throw new Error('deliberate failure inside the plugin');\n")).rejects.toThrow(/deliberate failure/i);
+    });
+
+    /** A plugin should not be able to read this process's environment while being looked at. */
+    it('inspects with none of the environment this process holds', async () => {
+      process.env.BOOKORBIT_TEST_SECRET = 'must-not-leak';
+      try {
+        const nosy = pluginSource({ label: 'process.env.BOOKORBIT_TEST_SECRET ?? "saw nothing"' });
+
+        await expect(service.inspect(nosy)).resolves.toMatchObject({ label: 'saw nothing' });
+      } finally {
+        delete process.env.BOOKORBIT_TEST_SECRET;
+      }
+    });
+
+    /** A module that blocks the event loop is killed; one that simply never settles exits at once. */
+    it('gives up on a file that blocks rather than resolving', async () => {
+      const blocked = `await new Promise((resolve) => setTimeout(resolve, 60_000));\n${pluginSource()}`;
+
+      await expect(service.inspect(blocked)).rejects.toThrow(/did not finish loading/i);
+    }, 20000);
+  });
+
+  describe('install', () => {
+    it('writes the plugin where the loader will find it', async () => {
+      const source = pluginSource();
+
+      await service.install(source, 'someone');
+
+      await expect(readFile(installed('example-tracker'), 'utf8')).resolves.toBe(source);
+    });
+
+    it('names the directory after the type the plugin declares, not the upload', async () => {
+      await service.install(pluginSource({ type: "'chosen-name'" }), 'someone');
+
+      await expect(readFile(installed('chosen-name'), 'utf8')).resolves.toContain('chosen-name');
+    });
+
+    /** Checked again on install, so what was reviewed and what lands cannot differ. */
+    it('refuses on install what it would refuse on inspection', async () => {
+      await expect(service.install(pluginSource({ apiVersion: '99' }), 'someone')).rejects.toThrow(/version/i);
+      await expect(readFile(installed('example-tracker'), 'utf8')).rejects.toThrow();
+    });
+
+    it('replaces a plugin of the same type rather than adding a second', async () => {
+      await service.install(pluginSource(), 'someone');
+      await service.install(pluginSource({ label: "'Renamed'" }), 'someone');
+
+      await expect(readFile(installed('example-tracker'), 'utf8')).resolves.toContain('Renamed');
+    });
+  });
+
+  describe('remove', () => {
+    it('deletes an installed plugin', async () => {
+      await service.install(pluginSource(), 'someone');
+
+      await service.remove('example-tracker', 'someone');
+
+      await expect(readFile(installed('example-tracker'), 'utf8')).rejects.toThrow();
+    });
+
+    it('deletes every source configured for the plugin', async () => {
+      await service.install(pluginSource(), 'someone');
+      indexers.deleteByAdapterType.mockResolvedValue(3);
+
+      await service.remove('example-tracker', 'someone');
+
+      expect(indexers.deleteByAdapterType).toHaveBeenCalledWith('example-tracker');
+    });
+
+    it('deletes a disk-installed plugin whose directory differs from its declared type', async () => {
+      const directory = join(appDataPath, 'plugins', 'indexers', 'manual-install');
+      await mkdir(directory, { recursive: true });
+      await writeFile(join(directory, 'index.js'), pluginSource(), 'utf8');
+      await loader.load();
+
+      await service.remove('example-tracker', 'someone');
+
+      await expect(readFile(join(directory, 'index.js'), 'utf8')).rejects.toThrow();
+      expect(indexers.deleteByAdapterType).toHaveBeenCalledWith('example-tracker');
+    });
+
+    it('deletes a broken plugin directory whose name is not an adapter slug', async () => {
+      const directory = join(appDataPath, 'plugins', 'indexers', 'Broken Plugin');
+      await mkdir(directory, { recursive: true });
+      await writeFile(join(directory, 'index.mjs'), 'export default {};\n', 'utf8');
+      await loader.load();
+
+      await service.remove('Broken Plugin', 'someone');
+
+      await expect(readFile(join(directory, 'index.mjs'), 'utf8')).rejects.toThrow();
+      expect(indexers.deleteByAdapterType).not.toHaveBeenCalled();
+      expect(loader.loadFailures()).toEqual([]);
+    });
+
+    it('deletes sources left behind by an earlier plugin removal', async () => {
+      indexers.countByAdapterType.mockResolvedValue(2);
+      indexers.deleteByAdapterType.mockResolvedValue(2);
+
+      await service.remove('example-tracker', 'someone');
+
+      expect(indexers.deleteByAdapterType).toHaveBeenCalledWith('example-tracker');
+      expect(registry.unregister).toHaveBeenCalledWith('example-tracker');
+    });
+
+    it('keeps the plugin installed when its sources could not be deleted', async () => {
+      await service.install(pluginSource(), 'someone');
+      indexers.countByAdapterType.mockResolvedValue(1);
+      indexers.deleteByAdapterType.mockRejectedValue(new Error('database unavailable'));
+
+      await expect(service.remove('example-tracker', 'someone')).rejects.toThrow('database unavailable');
+
+      await expect(readFile(installed('example-tracker'), 'utf8')).resolves.toContain('example-tracker');
+      expect(registry.unregister).not.toHaveBeenCalled();
+    });
+
+    /** The count answers "does this exist", so nothing is deleted on the way to finding out it does not. */
+    it('refuses when neither a plugin nor one of its sources exists, without deleting anything', async () => {
+      await expect(service.remove('never-installed', 'someone')).rejects.toThrow(/no plugin/i);
+      expect(indexers.countByAdapterType).toHaveBeenCalledWith('never-installed');
+      expect(indexers.deleteByAdapterType).not.toHaveBeenCalled();
+    });
+
+    /**
+     * A built-in adapter name is a valid plugin slug on shape alone, so nothing else in `remove`
+     * would have stopped this: the delete runs first, existing rows make the call succeed, and
+     * every torznab source on the instance is gone along with its encrypted credential.
+     */
+    it.each([...INDEXER_ADAPTER_TYPES])('refuses to uninstall the built-in %s adapter', async (type) => {
+      await expect(service.remove(type, 'someone')).rejects.toThrow(/built into this install/i);
+      expect(indexers.countByAdapterType).not.toHaveBeenCalled();
+      expect(indexers.deleteByAdapterType).not.toHaveBeenCalled();
+      expect(registry.unregister).not.toHaveBeenCalled();
+    });
+
+    /** The type is a slug by the time it gets here, but the cost of being wrong is a write outside. */
+    it.each(['../../../etc', 'a/b', '..'])('refuses %s as a plugin name', async (type) => {
+      await expect(service.remove(type, 'someone')).rejects.toThrow();
+      expect(indexers.deleteByAdapterType).not.toHaveBeenCalled();
+    });
+
+    it('leaves a neighbouring plugin alone', async () => {
+      await service.install(pluginSource(), 'someone');
+      await service.install(pluginSource({ type: "'other-one'" }), 'someone');
+
+      await service.remove('example-tracker', 'someone');
+
+      await expect(readFile(installed('other-one'), 'utf8')).resolves.toContain('other-one');
+    });
+  });
+
+  /**
+   * A plugin has to be usable the moment it is installed. Without this the settings page keeps
+   * listing what was just removed and hides what was just added, and the only cure is a restart.
+   */
+  describe('taking effect without a restart', () => {
+    it('registers the adapter it just wrote', async () => {
+      const result = await service.install(pluginSource(), 'someone');
+
+      expect(result.active).toBe(true);
+      expect(registry.register).toHaveBeenCalledWith(expect.objectContaining({ type: 'example-tracker' }));
+    });
+
+    it('drops the adapter it just deleted', async () => {
+      await service.install(pluginSource(), 'someone');
+
+      await service.remove('example-tracker', 'someone');
+
+      expect(registry.unregister).toHaveBeenCalledWith('example-tracker');
+    });
+
+    /** Node caches a module by URL, so a replacement has to come back as the new code, not the old. */
+    it('registers the replacement rather than the code it replaced', async () => {
+      await service.install(pluginSource(), 'someone');
+      registry.register.mockClear();
+
+      await service.install(pluginSource({ label: "'Renamed'" }), 'someone');
+
+      const registered = registry.register.mock.calls.at(-1)?.[0] as { plugin: { label: string } };
+      expect(registered.plugin.label).toBe('Renamed');
+    });
+
+    /**
+     * The file is written before it is loaded here, so a module that will not load in this process
+     * still landed. Saying so beats failing an install that did happen.
+     */
+    it('reports a plugin that landed but would not load', async () => {
+      vi.spyOn(loader, 'loadDirectory').mockRejectedValueOnce(new Error('nope'));
+
+      const result = await service.install(pluginSource(), 'someone');
+
+      expect(result.active).toBe(false);
+      await expect(readFile(installed('example-tracker'), 'utf8')).resolves.toContain('example-tracker');
+    });
+  });
+
+  /** What the installer writes has to be what the loader reads, or the two rule sets have drifted. */
+  it('installs something the loader then loads', async () => {
+    await service.install(pluginSource(), 'someone');
+
+    const adapters = await loader.load();
+
+    expect(adapters.map((adapter) => adapter.type)).toEqual(['example-tracker']);
+    expect(loader.loadFailures()).toEqual([]);
+  });
+});
diff --git a/server/src/modules/book-request/indexers/plugins/plugin-install.service.ts b/server/src/modules/book-request/indexers/plugins/plugin-install.service.ts
new file mode 100644
index 000000000..92d059271
--- /dev/null
+++ b/server/src/modules/book-request/indexers/plugins/plugin-install.service.ts
@@ -0,0 +1,292 @@
+import { execFile } from 'node:child_process';
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { promisify } from 'node:util';
+import { BadRequestException, Inject, Injectable, Logger } from '@nestjs/common';
+import type { ConfigType } from '@nestjs/config';
+import { INDEXER_ADAPTER_TYPES, type PluginInspection, type PluginInstallResult } from '@bookorbit/types';
+
+import { sanitizeLogValue } from '../../../../common/utils/log-sanitize.utils';
+import { storageConfig } from '../../../../config/config';
+import { IndexerRegistry } from '../indexer-registry';
+import { IndexerRepository } from '../indexer.repository';
+import { PluginLoaderService } from './plugin-loader.service';
+import { assertPluginShape, isPluginTypeSlug, type DeclaredPluginShape } from './plugin-shape';
+
+/**
+ * What the child process reports back: the shape rules judge it, and the rest is what the
+ * settings form needs in order to render an adapter it has never heard of.
+ */
+type InspectedPlugin = DeclaredPluginShape & {
+  credentialKind: 'apiKey' | 'sessionId' | null;
+  defaultBaseUrl: string | null;
+  baseUrlHint: string | null;
+};
+
+const execFileAsync = promisify(execFile);
+
+/** The largest plugin in existence is under 40 KB. This is room to grow, not a target. */
+export const MAX_PLUGIN_BYTES = 512 * 1024;
+
+/** Long enough for a module to evaluate, short enough that a hang is not a hang. */
+const INSPECT_TIMEOUT_MS = 5_000;
+/** A plugin that answers with a novel is not answering with a descriptor. */
+const MAX_INSPECT_OUTPUT_BYTES = 64 * 1024;
+
+/**
+ * Imports the file and reports only what it declares about itself. Runs as its own process, so the
+ * code inside never touches this one.
+ */
+const INSPECT_SCRIPT = `
+const { pathToFileURL } = await import('node:url');
+const module = await import(pathToFileURL(process.argv[1]).href);
+const plugin = module.default ?? {};
+process.stdout.write(
+  JSON.stringify({
+    apiVersion: plugin.apiVersion,
+    version: plugin.version,
+    type: plugin.type,
+    label: plugin.label,
+    requiresCredential: plugin.requiresCredential,
+    credentialKind: plugin.credentialKind ?? null,
+    mediaKinds: plugin.mediaKinds,
+    usesCategories: plugin.usesCategories,
+    seedsBack: plugin.seedsBack,
+    defaultBaseUrl: plugin.defaultBaseUrl ?? null,
+    baseUrlHint: plugin.baseUrlHint ?? null,
+    settingsFields: plugin.settingsFields ?? [],
+    hasSearch: typeof plugin.search === 'function',
+    hasTest: typeof plugin.test === 'function',
+    hasResolveFile: typeof plugin.resolveFile === 'function',
+    hasFetchTorrentFile: typeof plugin.fetchTorrentFile === 'function',
+  }),
+);
+`;
+
+/**
+ * Installing a plugin from the browser instead of from a shell.
+ *
+ * **This is remote code execution behind a permission check, and it is that by design.** A plugin
+ * runs in the BookOrbit process with that process's reach, so anyone who can install one can reach
+ * the database, the library and the encryption key. Before this existed, doing that required
+ * filesystem access to the host; now it requires a superuser session. That is a real reduction in
+ * the distance between a web request and arbitrary code, and it is why the controller enforces
+ * superuser server-side rather than hiding a button.
+ *
+ * What can be done about it is done. A plugin is read in a child process before it is written
+ * anywhere, so an upload that hangs, crashes or throws on import does none of that here. That is
+ * not a sandbox: evaluating a module runs its top-level code, and in the child that code can do
+ * whatever the process can. It buys three things, which is the honest claim: no handle to this
+ * process's state, a deadline that ends a hang, and a shape known before the file is kept.
+ */
+@Injectable()
+export class PluginInstallService {
+  private readonly logger = new Logger(PluginInstallService.name);
+
+  constructor(
+    @Inject(storageConfig.KEY) private readonly storage: ConfigType<typeof storageConfig>,
+    private readonly registry: IndexerRegistry,
+    private readonly loader: PluginLoaderService,
+    private readonly indexers: IndexerRepository,
+  ) {}
+
+  private get root(): string {
+    return join(this.storage.appDataPath, 'plugins', 'indexers');
+  }
+
+  /**
+   * What the file says it is, without keeping it. The source comes back with it so the operator can
+   * read what they are about to run: one file with no dependencies is what makes that realistic,
+   * and the install documentation asks them to do exactly this.
+   */
+  async inspect(source: string): Promise<PluginInspection> {
+    assertSize(source);
+    const declared = await this.declare(source);
+
+    try {
+      assertPluginShape(declared);
+    } catch (error) {
+      throw new BadRequestException(`That file is not a usable plugin: ${error instanceof Error ? error.message : String(error)}`);
+    }
+
+    const type = declared.type as string;
+    // A plugin that claims a built-in name would be refused at the next boot and simply not appear.
+    if ((INDEXER_ADAPTER_TYPES as readonly string[]).includes(type)) {
+      throw new BadRequestException(`This install already provides an indexer called "${type}"`);
+    }
+
+    return {
+      type,
+      label: declared.label as string,
+      ...(declared.version ? { version: declared.version as string } : {}),
+      requiresCredential: declared.requiresCredential as boolean,
+      credentialKind: declared.credentialKind,
+      mediaKinds: declared.mediaKinds as PluginInspection['mediaKinds'],
+      usesCategories: declared.usesCategories as boolean,
+      seedsBack: declared.seedsBack as boolean,
+      ...(declared.defaultBaseUrl ? { defaultBaseUrl: declared.defaultBaseUrl } : {}),
+      ...(declared.baseUrlHint ? { baseUrlHint: declared.baseUrlHint } : {}),
+      settingsFields: [...(declared.settingsFields ?? [])],
+      source,
+      replaces: await this.alreadyInstalled(type),
+    };
+  }
+
+  /**
+   * Inspected again rather than trusting what the browser was shown. The client sends the file a
+   * second time to confirm, so nothing is staged between the two calls and there is no window in
+   * which a checked file and an installed file could differ.
+   */
+  async install(source: string, installedBy: string): Promise<PluginInstallResult> {
+    const inspection = await this.inspect(source);
+    const directoryName = this.loader.directoryForType(inspection.type) ?? inspection.type;
+    const directory = this.directoryFor(directoryName);
+
+    await mkdir(directory, { recursive: true });
+    await writeFile(join(directory, 'index.mjs'), source, 'utf8');
+    const active = await this.activate(inspection.type, directoryName);
+
+    this.logger.log(
+      `[request_indexer.plugin_install] [end] type=${inspection.type} bytes=${Buffer.byteLength(source)} replaced=${inspection.replaces} ` +
+        `active=${active} user="${sanitizeLogValue(installedBy)}" - plugin installed`,
+    );
+    return { ...inspection, active };
+  }
+
+  /**
+   * Uninstalls a plugin and every source configured against it.
+   *
+   * Two refusals come before anything is deleted, and both matter because this deletes rows that
+   * hold encrypted credentials and nothing brings them back. A built-in adapter name passes the
+   * slug check on shape alone, so without the first one `DELETE .../plugins/torznab` would delete
+   * every torznab source on the instance and report success. And the existence check runs against
+   * a count rather than against the delete's own row count, so "does this exist" is answered
+   * before, not by, the destructive write.
+   */
+  async remove(identifier: string, removedBy: string): Promise<void> {
+    if ((INDEXER_ADAPTER_TYPES as readonly string[]).includes(identifier)) {
+      throw new BadRequestException(`"${identifier}" is built into this install rather than a plugin, so it cannot be uninstalled`);
+    }
+
+    const mappedDirectory = this.loader.directoryForType(identifier);
+    const directoryName = mappedDirectory ?? identifier;
+    const installed = await this.directoryExists(directoryName);
+    const adapterType = mappedDirectory !== undefined || isPluginTypeSlug(identifier) ? identifier : null;
+
+    const configured = adapterType === null ? 0 : await this.indexers.countByAdapterType(adapterType);
+    if (!installed && configured === 0) throw new BadRequestException(`No plugin or configured source called "${identifier}" exists`);
+
+    const sourceCount = adapterType === null ? 0 : await this.indexers.deleteByAdapterType(adapterType);
+    await rm(this.directoryFor(directoryName), { recursive: true, force: true });
+    if (adapterType !== null) {
+      this.registry.unregister(adapterType);
+      this.loader.forgetPlugin(adapterType);
+    }
+    this.loader.forgetFailure(directoryName);
+    this.logger.log(
+      `[request_indexer.plugin_install] [end] identifier="${sanitizeLogValue(identifier)}" directory="${sanitizeLogValue(directoryName)}" ` +
+        `sources=${sourceCount} user="${sanitizeLogValue(removedBy)}" - plugin and sources removed`,
+    );
+  }
+
+  /**
+   * Puts a freshly written plugin to work in this process. It has already been imported once in a
+   * child, so the usual reason to fail is a module that behaves differently the second time; that
+   * leaves the file installed and the operator with a restart to fall back on, which is worth
+   * saying rather than failing the install that did in fact write the file.
+   */
+  private async activate(type: string, directory: string): Promise<boolean> {
+    try {
+      this.registry.register(await this.loader.loadDirectory(directory));
+      this.loader.forgetFailure(directory);
+      return true;
+    } catch (error) {
+      const reason = error instanceof Error ? error.message : String(error);
+      this.logger.warn(
+        `[request_indexer.plugin_install] [fail] type=${type} error="${sanitizeLogValue(reason)}" - plugin written but not loaded, a restart will retry`,
+      );
+      return false;
+    }
+  }
+
+  /** A failed disk-installed plugin can have any directory name, so containment is enforced here. */
+  private directoryFor(name: string): string {
+    if (name.includes('/') || name.includes('\0')) throw new BadRequestException('That plugin name is not usable as a directory');
+    const directory = resolve(this.root, name);
+    if (!directory.startsWith(resolve(this.root) + '/')) throw new BadRequestException('That plugin name is not usable as a directory');
+    return directory;
+  }
+
+  private async alreadyInstalled(type: string): Promise<boolean> {
+    return this.directoryExists(this.loader.directoryForType(type) ?? type);
+  }
+
+  private async directoryExists(name: string): Promise<boolean> {
+    try {
+      const { stat } = await import('node:fs/promises');
+      return (await stat(this.directoryFor(name))).isDirectory();
+    } catch {
+      return false;
+    }
+  }
+
+  /** Runs the upload in a process of its own and reads back only what it declares. */
+  private async declare(source: string): Promise<InspectedPlugin> {
+    const staging = await mkdtemp(join(tmpdir(), 'bookorbit-plugin-'));
+    const candidate = join(staging, 'index.mjs');
+
+    try {
+      await writeFile(candidate, source, 'utf8');
+      const { stdout } = await execFileAsync(process.execPath, ['--input-type=module', '-e', INSPECT_SCRIPT, candidate], {
+        timeout: INSPECT_TIMEOUT_MS,
+        maxBuffer: MAX_INSPECT_OUTPUT_BYTES,
+        // Nothing of this process's environment, so a plugin cannot read a secret out of it while
+        // being inspected. It gets the environment it will actually run with at load time instead.
+        env: { PATH: process.env.PATH ?? '' },
+      });
+      return JSON.parse(stdout) as InspectedPlugin;
+    } catch (error) {
+      throw new BadRequestException(`That file could not be read as a plugin: ${describe(error)}`);
+    } finally {
+      await rm(staging, { recursive: true, force: true });
+    }
+  }
+}
+
+function assertSize(source: string): void {
+  const bytes = Buffer.byteLength(source);
+  if (bytes === 0) throw new BadRequestException('That file is empty');
+  if (bytes > MAX_PLUGIN_BYTES) throw new BadRequestException(`That file is ${bytes} bytes, past the ${MAX_PLUGIN_BYTES} byte limit`);
+}
+
+/**
+ * Node's exit code 13 is an unsettled top-level await: the module simply never finished, and the
+ * process ends at once rather than being killed. A module that blocks the event loop instead runs
+ * out the deadline and is killed. Both mean the same thing to an operator.
+ */
+const UNFINISHED_TOP_LEVEL_AWAIT = 13;
+
+/**
+ * The reason a module refused to load, in the words it used.
+ *
+ * Read out of the middle of stderr rather than off the end of it: Node prints the offending source
+ * line, then the error, then a stack and its own version banner, so the last line is "Node.js
+ * v24.14.0" and the useful one is above it.
+ */
+const NODE_ERROR_LINE = /^[A-Za-z]*Error(?: \[[^\]]+\])?:\s*(.+)$/m;
+
+function describe(error: unknown): string {
+  const failure = error as { killed?: boolean; code?: number | string; stderr?: string } | null;
+
+  if (failure?.killed || failure?.code === UNFINISHED_TOP_LEVEL_AWAIT) {
+    return `it did not finish loading within ${INSPECT_TIMEOUT_MS}ms`;
+  }
+
+  const stderr = String(failure?.stderr ?? '');
+  const stated = NODE_ERROR_LINE.exec(stderr)?.[1]?.trim();
+  if (stated) return stated.slice(0, 200);
+
+  const fallback = stderr.trim().split('\n').filter(Boolean)[0];
+  return fallback ? fallback.slice(0, 200) : error instanceof Error ? error.message : String(error);
+}
diff --git a/server/src/modules/book-request/indexers/plugins/plugin-loader.service.test.ts b/server/src/modules/book-request/indexers/plugins/plugin-loader.service.test.ts
new file mode 100644
index 000000000..c1d88594c
--- /dev/null
+++ b/server/src/modules/book-request/indexers/plugins/plugin-loader.service.test.ts
@@ -0,0 +1,227 @@
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import type { IndexerCredentialStore } from '../indexer-credential-store';
+import { PluginLoaderService } from './plugin-loader.service';
+
+/**
+ * A minimal well-formed plugin. Written to disk and imported for real rather than mocked: the
+ * whole point of the loader is what happens at the dynamic-import boundary, and a mock of
+ * `import()` would test nothing that boundary actually does.
+ */
+function pluginSource(overrides: Record<string, string> = {}): string {
+  const fields: Record<string, string> = {
+    apiVersion: '1',
+    version: "'1.2.3'",
+    type: "'example-tracker'",
+    label: "'Example Tracker'",
+    requiresCredential: 'true',
+    credentialKind: "'apiKey'",
+    mediaKinds: "['ebook']",
+    usesCategories: 'true',
+    seedsBack: 'true',
+    search: 'async () => []',
+    test: 'async () => ({ success: true })',
+    fetchTorrentFile: 'async () => new Uint8Array([1, 2, 3])',
+    ...overrides,
+  };
+  const body = Object.entries(fields)
+    .filter(([, value]) => value !== 'OMIT')
+    .map(([key, value]) => `  ${key}: ${value},`)
+    .join('\n');
+  return `export default {\n${body}\n};\n`;
+}
+
+describe('PluginLoaderService', () => {
+  let appDataPath: string;
+  let loader: PluginLoaderService;
+  let credentials: IndexerCredentialStore;
+
+  beforeEach(async () => {
+    appDataPath = await mkdtemp(join(tmpdir(), 'bookorbit-plugins-'));
+    credentials = { rotate: vi.fn() } as unknown as IndexerCredentialStore;
+    loader = new PluginLoaderService({ appDataPath } as never, credentials);
+  });
+
+  afterEach(async () => {
+    await rm(appDataPath, { recursive: true, force: true });
+  });
+
+  async function writePlugin(directory: string, source: string, entry = 'index.mjs') {
+    const base = join(appDataPath, 'plugins', 'indexers', directory);
+    await mkdir(base, { recursive: true });
+    // A unique query on the import keeps Node's module cache from serving an earlier test's copy.
+    await writeFile(join(base, entry), source, 'utf8');
+    return base;
+  }
+
+  /** The overwhelmingly common case, and it must not look like an error. */
+  it('loads nothing and says nothing when there is no plugin directory', async () => {
+    expect(await loader.load()).toEqual([]);
+    expect(loader.loadFailures()).toEqual([]);
+  });
+
+  it('loads a well-formed plugin and exposes it as an ordinary adapter', async () => {
+    await writePlugin('example', pluginSource());
+
+    const [adapter] = await loader.load();
+
+    expect(adapter.type).toBe('example-tracker');
+    expect(adapter.label).toBe('Example Tracker');
+    expect(adapter.plugin.version).toBe('1.2.3');
+    expect(adapter.requiresCredential).toBe(true);
+    expect(adapter.mediaKinds).toEqual(['ebook']);
+    expect(loader.loadFailures()).toEqual([]);
+    expect(loader.directoryForType('example-tracker')).toBe('example');
+  });
+
+  it('accepts index.js as well as index.mjs', async () => {
+    await writePlugin('example', pluginSource({ type: "'cjs-named'" }), 'index.js');
+
+    expect((await loader.load()).map((adapter) => adapter.type)).toEqual(['cjs-named']);
+  });
+
+  /**
+   * The failure mode this exists to prevent: a plugin with a typo that simply does not appear,
+   * leaving the operator with no way to tell whether it was even seen.
+   */
+  it('records why a plugin did not load rather than dropping it silently', async () => {
+    await writePlugin('broken', 'export default { apiVersion: 1 };\n');
+
+    expect(await loader.load()).toEqual([]);
+    expect(loader.loadFailures()).toEqual([{ directory: 'broken', reason: expect.stringContaining('slug') }]);
+  });
+
+  it('refuses a plugin built against a different contract version', async () => {
+    await writePlugin('old', pluginSource({ apiVersion: '99' }));
+
+    await loader.load();
+
+    expect(loader.loadFailures()[0].reason).toContain('version 99');
+  });
+
+  it('keeps loading a legacy plugin that does not declare its own version', async () => {
+    await writePlugin('legacy', pluginSource({ version: 'OMIT' }));
+
+    expect(await loader.load()).toHaveLength(1);
+    expect(loader.loadFailures()).toEqual([]);
+  });
+
+  /** Otherwise a plugin could quietly replace a built-in source with one of its own. */
+  it('refuses a plugin that claims a built-in adapter name', async () => {
+    await writePlugin('shadow', pluginSource({ type: "'torznab'" }));
+
+    expect(await loader.load()).toEqual([]);
+    expect(loader.loadFailures()[0].reason).toContain('already provides');
+  });
+
+  it('refuses two plugins claiming the same name', async () => {
+    await writePlugin('first', pluginSource({ type: "'duplicated'" }));
+    await writePlugin('second', pluginSource({ type: "'duplicated'" }));
+
+    expect(await loader.load()).toHaveLength(1);
+    expect(loader.loadFailures()).toHaveLength(1);
+  });
+
+  it('refuses a type that is not a slug the adapter_type constraint would accept', async () => {
+    await writePlugin('shouty', pluginSource({ type: "'NotASlug'" }));
+
+    expect(loader.loadFailures.length).toBeDefined();
+    await loader.load();
+    expect(loader.loadFailures()[0].reason).toContain('slug');
+  });
+
+  it('refuses a plugin declaring a media kind that does not exist', async () => {
+    await writePlugin('odd', pluginSource({ mediaKinds: "['newspaper']" }));
+
+    await loader.load();
+
+    expect(loader.loadFailures()[0].reason).toContain('newspaper');
+  });
+
+  /** A release is a torrent or a file. Declaring both leaves the grab path guessing. */
+  it('refuses a plugin that declares both a torrent fetch and a file resolve', async () => {
+    await writePlugin('both', pluginSource({ resolveFile: 'async () => ({})' }));
+
+    await loader.load();
+
+    expect(loader.loadFailures()[0].reason).toContain('both');
+  });
+
+  it('refuses a plugin that declares neither, since nothing it finds could be grabbed', async () => {
+    await writePlugin('neither', pluginSource({ fetchTorrentFile: 'OMIT' }));
+
+    await loader.load();
+
+    expect(loader.loadFailures()[0].reason).toContain('neither');
+  });
+
+  it('refuses a settings field with no usable key', async () => {
+    await writePlugin('fields', pluginSource({ settingsFields: "[{ key: '', type: 'boolean', label: 'x' }]" }));
+
+    await loader.load();
+
+    expect(loader.loadFailures()[0].reason).toContain('settings field');
+  });
+
+  it('loads a constrained list settings field', async () => {
+    await writePlugin(
+      'fields',
+      pluginSource({
+        settingsFields:
+          "[{ key: 'formats', type: 'string', format: 'list', label: 'Formats', default: 'epub,mobi', options: ['epub', 'mobi', 'pdf'], minItems: 1 }]",
+      }),
+    );
+
+    const [adapter] = await loader.load();
+
+    expect(adapter.settingsFields).toEqual([
+      {
+        key: 'formats',
+        type: 'string',
+        format: 'list',
+        label: 'Formats',
+        default: 'epub,mobi',
+        options: ['epub', 'mobi', 'pdf'],
+        minItems: 1,
+      },
+    ]);
+  });
+
+  it.each([
+    ["[{ key: 'formats', type: 'string', format: 'list', label: 'Formats', options: [] }]", 'non-empty list'],
+    ["[{ key: 'formats', type: 'string', format: 'list', label: 'Formats', options: ['epub', 'EPUB'] }]", 'duplicate options'],
+    [
+      "[{ key: 'formats', type: 'string', format: 'list', label: 'Formats', default: 'wrong', options: ['epub'], minItems: 1 }]",
+      'outside its options',
+    ],
+  ])('refuses an unsafe constrained list declaration', async (settingsFields, reason) => {
+    await writePlugin('fields', pluginSource({ settingsFields }));
+
+    await loader.load();
+
+    expect(loader.loadFailures()[0].reason).toContain(reason);
+  });
+
+  it('keeps loading the rest after one plugin fails', async () => {
+    await writePlugin('broken', 'throw new Error("boom");\n');
+    await writePlugin('working', pluginSource({ type: "'still-fine'" }));
+
+    const adapters = await loader.load();
+
+    expect(adapters.map((adapter) => adapter.type)).toEqual(['still-fine']);
+    expect(loader.loadFailures().map((failure) => failure.directory)).toEqual(['broken']);
+  });
+
+  it('clears stale failures when reloaded', async () => {
+    await writePlugin('broken', 'export default {};\n');
+    await loader.load();
+    expect(loader.loadFailures()).toHaveLength(1);
+
+    await rm(join(appDataPath, 'plugins', 'indexers', 'broken'), { recursive: true, force: true });
+    await loader.load();
+
+    expect(loader.loadFailures()).toEqual([]);
+  });
+});
diff --git a/server/src/modules/book-request/indexers/plugins/plugin-loader.service.ts b/server/src/modules/book-request/indexers/plugins/plugin-loader.service.ts
new file mode 100644
index 000000000..a6fa48c5e
--- /dev/null
+++ b/server/src/modules/book-request/indexers/plugins/plugin-loader.service.ts
@@ -0,0 +1,184 @@
+import { readdir, stat } from 'node:fs/promises';
+import { join, resolve } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { Inject, Injectable, Logger } from '@nestjs/common';
+import type { ConfigType } from '@nestjs/config';
+import type { IndexerPlugin } from '@bookorbit/plugin-api';
+import { INDEXER_ADAPTER_TYPES } from '@bookorbit/types';
+
+import { sanitizeLogValue } from '../../../../common/utils/log-sanitize.utils';
+import { storageConfig } from '../../../../config/config';
+import { IndexerCredentialStore } from '../indexer-credential-store';
+import { PluginIndexerAdapter } from './plugin-host';
+import { assertPluginShape } from './plugin-shape';
+
+/** Where an operator drops a plugin. Writable in the container, and survives an upgrade. */
+const PLUGIN_SUBDIRECTORY = join('plugins', 'indexers');
+const ENTRYPOINTS = ['index.mjs', 'index.js'];
+
+/** A plugin that would not load, kept so the settings page can say which file and why. */
+export interface PluginLoadFailure {
+  directory: string;
+  reason: string;
+}
+
+/**
+ * Imports an ES module from an absolute `file://` URL, in both of the environments this runs in.
+ *
+ * The server is built as CommonJS by swc, which rewrites a plain `import()` into `require()` -
+ * and `require()` cannot load an ES module, so every plugin fails with "Cannot find module"
+ * naming a `file://` URL. That only happens in a built server: Vitest runs the source as ESM,
+ * where the plain import is exactly right and the `Function` form fails instead, because its
+ * compiled code has no import callback.
+ *
+ * So try the real thing first and keep the indirection as the fallback. Whichever environment
+ * this is, one of the two works, and neither needs a build-config flag that a running watcher
+ * would have to be restarted to notice.
+ */
+// eslint-disable-next-line @typescript-eslint/no-implied-eval -- needed to preserve runtime dynamic import in CJS output
+const importViaFunction = new Function('specifier', 'return import(specifier);') as (specifier: string) => Promise<unknown>;
+
+async function importModule(specifier: string): Promise<unknown> {
+  try {
+    return await (import(specifier) as Promise<unknown>);
+  } catch {
+    return await importViaFunction(specifier);
+  }
+}
+
+/**
+ * Loads indexer plugins from disk at boot.
+ *
+ * BookOrbit ships no plugins. This is the seam that lets a tracker adapter live in somebody
+ * else's repository instead of this one, which is the whole point of the exercise: the code that
+ * knows about a particular tracker is not code this project distributes.
+ *
+ * A plugin runs in this process with this process's reach. That is the accepted trade for a
+ * self-hosted application, the same one Jellyfin and Home Assistant make, and it is stated in the
+ * install documentation rather than left to be discovered. What the loader can do it does: it
+ * refuses a plugin that would shadow a built-in adapter, refuses one built against a different
+ * contract version, and records a failure instead of letting a broken plugin vanish silently.
+ */
+@Injectable()
+export class PluginLoaderService {
+  private readonly logger = new Logger(PluginLoaderService.name);
+  private readonly failures: PluginLoadFailure[] = [];
+  private readonly directoriesByType = new Map<string, string>();
+
+  constructor(
+    @Inject(storageConfig.KEY) private readonly storage: ConfigType<typeof storageConfig>,
+    private readonly credentials: IndexerCredentialStore,
+  ) {}
+
+  get root(): string {
+    return join(this.storage.appDataPath, PLUGIN_SUBDIRECTORY);
+  }
+
+  /** Everything that failed to load, so the settings page can explain a plugin that is missing. */
+  loadFailures(): readonly PluginLoadFailure[] {
+    return this.failures;
+  }
+
+  /** Dropped when a directory is removed or reinstalled, so a fixed plugin stops being reported. */
+  forgetFailure(directory: string): void {
+    const at = this.failures.findIndex((failure) => failure.directory === directory);
+    if (at !== -1) this.failures.splice(at, 1);
+  }
+
+  directoryForType(type: string): string | undefined {
+    return this.directoriesByType.get(type);
+  }
+
+  forgetPlugin(type: string): void {
+    this.directoriesByType.delete(type);
+  }
+
+  async load(): Promise<PluginIndexerAdapter[]> {
+    this.failures.length = 0;
+    this.directoriesByType.clear();
+
+    let directories: string[];
+    try {
+      const entries = await readdir(this.root, { withFileTypes: true });
+      directories = entries.filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+    } catch {
+      // No plugin directory at all is the normal case, not a problem worth logging.
+      return [];
+    }
+
+    const started = Date.now();
+    const adapters: PluginIndexerAdapter[] = [];
+    const claimed = new Set<string>(INDEXER_ADAPTER_TYPES);
+
+    for (const directory of directories.sort()) {
+      try {
+        const adapter = new PluginIndexerAdapter(await this.loadOne(directory), this.credentials);
+        if (claimed.has(adapter.type)) {
+          throw new Error(`another adapter already provides "${adapter.type}"`);
+        }
+        claimed.add(adapter.type);
+        this.directoriesByType.set(adapter.type, directory);
+        adapters.push(adapter);
+      } catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        this.failures.push({ directory, reason });
+        this.logger.warn(
+          `[request_indexer.plugin_load] [fail] directory="${sanitizeLogValue(directory)}" error="${sanitizeLogValue(reason)}" - plugin not loaded`,
+        );
+      }
+    }
+
+    this.logger.log(
+      `[request_indexer.plugin_load] [end] loaded=${adapters.length} failed=${this.failures.length} durationMs=${Date.now() - started} - scanned the plugin directory`,
+    );
+    return adapters;
+  }
+
+  /**
+   * Loads one directory, so installing a plugin can put it to work without a restart rather than
+   * only writing it to disk and asking the operator to come back later.
+   */
+  async loadDirectory(directory: string): Promise<PluginIndexerAdapter> {
+    const plugin = await this.loadOne(directory);
+    this.directoriesByType.set(plugin.type, directory);
+    this.logger.log(`[request_indexer.plugin_load] [end] directory="${sanitizeLogValue(directory)}" type=${plugin.type} - plugin loaded`);
+    return new PluginIndexerAdapter(plugin, this.credentials);
+  }
+
+  private async loadOne(directory: string): Promise<IndexerPlugin> {
+    const base = resolve(this.root, directory);
+    // A plugin directory is named, never traversed into from outside its own root.
+    if (!base.startsWith(resolve(this.root) + '/')) throw new Error('that plugin path escapes the plugin directory');
+
+    const entry = await this.findEntrypoint(base);
+    if (!entry) throw new Error(`no ${ENTRYPOINTS.join(' or ')} in that directory`);
+
+    // Node caches a module by URL for the life of the process, so a plugin reinstalled over its own
+    // path would keep serving the code that was just replaced. The query makes each load a new URL.
+    const url = `${pathToFileURL(entry).href}?loaded=${Date.now()}`;
+    const module = (await importModule(url)) as { default?: unknown };
+    const plugin = module.default;
+    if (!plugin || typeof plugin !== 'object') throw new Error('the module has no default export');
+
+    assertPluginShape({
+      ...(plugin as Partial<IndexerPlugin>),
+      hasSearch: typeof (plugin as Partial<IndexerPlugin>).search === 'function',
+      hasTest: typeof (plugin as Partial<IndexerPlugin>).test === 'function',
+      hasResolveFile: typeof (plugin as Partial<IndexerPlugin>).resolveFile === 'function',
+      hasFetchTorrentFile: typeof (plugin as Partial<IndexerPlugin>).fetchTorrentFile === 'function',
+    });
+    return plugin as IndexerPlugin;
+  }
+
+  private async findEntrypoint(base: string): Promise<string | null> {
+    for (const name of ENTRYPOINTS) {
+      const candidate = join(base, name);
+      try {
+        if ((await stat(candidate)).isFile()) return candidate;
+      } catch {
+        continue;
+      }
+    }
+    return null;
+  }
+}
diff --git a/server/src/modules/book-request/indexers/plugins/plugin-shape.ts b/server/src/modules/book-request/indexers/plugins/plugin-shape.ts
new file mode 100644
index 000000000..1d23501ef
--- /dev/null
+++ b/server/src/modules/book-request/indexers/plugins/plugin-shape.ts
@@ -0,0 +1,144 @@
+import { BOOK_REQUEST_MEDIA_KINDS } from '@bookorbit/types';
+import type { PluginSettingsField } from '@bookorbit/plugin-api';
+
+/** Bumped when a change to the contract would break a plugin written against the old one. */
+export const PLUGIN_API_VERSION = 1;
+
+/** Never a path segment with a `.` or a `/` in it, which is what makes it safe as a directory name. */
+const TYPE_SLUG = /^[a-z0-9][a-z0-9-]{0,29}$/;
+
+export function isPluginTypeSlug(value: string): boolean {
+  return TYPE_SLUG.test(value);
+}
+
+/**
+ * What a plugin declares about itself, with the four functions reduced to whether they are there.
+ *
+ * Shaped this way so the same rules can judge a plugin the loader imported into this process and a
+ * plugin the installer only ever ran in a child process. Two rule sets would drift, and the way
+ * they would drift is that something installable stops being loadable.
+ */
+export interface DeclaredPluginShape {
+  apiVersion?: unknown;
+  version?: unknown;
+  type?: unknown;
+  label?: unknown;
+  requiresCredential?: unknown;
+  usesCategories?: unknown;
+  seedsBack?: unknown;
+  mediaKinds?: unknown;
+  settingsFields?: readonly PluginSettingsField[];
+  hasSearch: boolean;
+  hasTest: boolean;
+  hasResolveFile: boolean;
+  hasFetchTorrentFile: boolean;
+}
+
+/**
+ * Checked before a plugin is ever called rather than when a search fails, so a malformed plugin is
+ * a message on the settings page and not a broken picker.
+ */
+export function assertPluginShape(plugin: DeclaredPluginShape): void {
+  if (plugin.apiVersion !== PLUGIN_API_VERSION) {
+    throw new Error(`it targets plugin API version ${String(plugin.apiVersion)}, and this build speaks version ${PLUGIN_API_VERSION}`);
+  }
+  if (typeof plugin.type !== 'string' || !isPluginTypeSlug(plugin.type)) {
+    throw new Error('its type must be a lowercase slug of at most 30 characters');
+  }
+  if (plugin.version !== undefined && (typeof plugin.version !== 'string' || !isPluginVersion(plugin.version))) {
+    throw new Error('its version must be a semantic version such as 1.2.3, without a leading "v"');
+  }
+  if (typeof plugin.label !== 'string' || plugin.label.trim() === '') throw new Error('it declares no label');
+  if (!plugin.hasSearch) throw new Error('it exports no search function');
+  if (!plugin.hasTest) throw new Error('it exports no test function');
+  if (typeof plugin.requiresCredential !== 'boolean') throw new Error('it does not say whether it requires a credential');
+  if (typeof plugin.usesCategories !== 'boolean') throw new Error('it does not say whether it uses categories');
+  if (typeof plugin.seedsBack !== 'boolean') throw new Error('it does not say whether it seeds back');
+
+  if (!Array.isArray(plugin.mediaKinds) || plugin.mediaKinds.length === 0) {
+    throw new Error('it declares no media kinds');
+  }
+  for (const kind of plugin.mediaKinds) {
+    if (!(BOOK_REQUEST_MEDIA_KINDS as readonly string[]).includes(kind as string)) throw new Error(`"${String(kind)}" is not a media kind`);
+  }
+
+  // Declaring both would leave the grab path guessing which one a release meant.
+  if (plugin.hasFetchTorrentFile && plugin.hasResolveFile) {
+    throw new Error('it declares both fetchTorrentFile and resolveFile, and a release can only be one of those');
+  }
+  if (!plugin.hasFetchTorrentFile && !plugin.hasResolveFile) {
+    throw new Error('it declares neither fetchTorrentFile nor resolveFile, so nothing it finds could be grabbed');
+  }
+
+  for (const field of plugin.settingsFields ?? []) assertField(field);
+}
+
+function isPluginVersion(version: string): boolean {
+  return (
+    version.length <= 64 &&
+    /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/.test(version)
+  );
+}
+
+function assertField(field: PluginSettingsField): void {
+  if (typeof field?.key !== 'string' || !/^[a-zA-Z][a-zA-Z0-9]{0,39}$/.test(field.key)) {
+    throw new Error('a settings field has no usable key');
+  }
+  if (!['boolean', 'string', 'number'].includes(field.type)) throw new Error(`settings field "${field.key}" has an unknown type`);
+  if (typeof field.label !== 'string' || field.label.trim() === '') throw new Error(`settings field "${field.key}" has no label`);
+
+  if (field.format !== undefined && field.format !== 'list') {
+    throw new Error(`settings field "${field.key}" has an unknown format`);
+  }
+  if (field.format === 'list' && field.type !== 'string') {
+    throw new Error(`settings field "${field.key}" can only use list format with a string value`);
+  }
+  if (field.options !== undefined) assertFieldOptions(field);
+  if (field.minItems !== undefined) assertFieldMinimum(field);
+}
+
+function assertFieldOptions(field: PluginSettingsField): void {
+  if (field.format !== 'list' || !Array.isArray(field.options) || field.options.length === 0) {
+    throw new Error(`settings field "${field.key}" can only declare options for a non-empty list`);
+  }
+
+  const normalized = new Set<string>();
+  for (const option of field.options) {
+    if (typeof option !== 'string' || option.trim() === '' || option.length > 40) {
+      throw new Error(`settings field "${field.key}" has an unusable option`);
+    }
+    const canonical = option.trim().toLowerCase();
+    if (normalized.has(canonical)) throw new Error(`settings field "${field.key}" has duplicate options`);
+    normalized.add(canonical);
+  }
+
+  if (field.default !== undefined) {
+    if (typeof field.default !== 'string') throw new Error(`settings field "${field.key}" has a non-string default`);
+    const defaults = parseList(field.default);
+    if (defaults.some((entry) => !normalized.has(entry.toLowerCase()))) {
+      throw new Error(`settings field "${field.key}" has a default outside its options`);
+    }
+  }
+}
+
+function assertFieldMinimum(field: PluginSettingsField): void {
+  const minItems = field.minItems;
+  if (minItems === undefined || !Number.isInteger(minItems) || minItems < 0 || !field.options || minItems > field.options.length) {
+    throw new Error(`settings field "${field.key}" has an unusable minimum item count`);
+  }
+  if (minItems > 0) {
+    if (typeof field.default !== 'string' || parseList(field.default).length < minItems) {
+      throw new Error(`settings field "${field.key}" needs a default that meets its minimum item count`);
+    }
+  }
+}
+
+function parseList(value: string): string[] {
+  const entries = new Map<string, string>();
+  for (const entry of value
+    .split(',')
+    .map((item) => item.trim())
+    .filter(Boolean))
+    entries.set(entry.toLowerCase(), entry);
+  return [...entries.values()];
+}
diff --git a/server/src/modules/book-request/indexers/release-profile.test.ts b/server/src/modules/book-request/indexers/release-profile.test.ts
new file mode 100644
index 000000000..ffd9ed42e
--- /dev/null
+++ b/server/src/modules/book-request/indexers/release-profile.test.ts
@@ -0,0 +1,194 @@
+import { describe, expect, it } from 'vitest';
+
+import {
+  classifyFileLayout,
+  compareByTier,
+  matchReleaseTier,
+  releaseMatchesTier,
+  releaseProfileIsActive,
+  SINGLE_FILE_MAX_ENTRIES,
+  type ReleaseTier,
+  type ReleaseTierInput,
+} from '@bookorbit/types';
+
+function release(overrides: Partial<ReleaseTierInput> = {}): ReleaseTierInput {
+  return {
+    formats: ['m4b'],
+    fileCount: 1,
+    audio: { bitrateKbps: 128, channels: 2 },
+    language: 'ENG',
+    indexerId: 14,
+    freeleech: false,
+    vipOnly: false,
+    seeders: 20,
+    sizeBytes: 400 * 1024 * 1024,
+    ...overrides,
+  };
+}
+
+function tier(id: string, conditions: ReleaseTier['conditions']): ReleaseTier {
+  return { id, name: id, conditions };
+}
+
+describe('releaseMatchesTier', () => {
+  it('matches when the tier states nothing at all', () => {
+    expect(releaseMatchesTier(release(), {})).toBe(true);
+  });
+
+  it('matches any one of the formats a tier lists, not all of them', () => {
+    expect(releaseMatchesTier(release({ formats: ['mp3'] }), { formats: ['m4b', 'mp3'] })).toBe(true);
+    expect(releaseMatchesTier(release({ formats: ['epub'] }), { formats: ['m4b', 'mp3'] })).toBe(false);
+  });
+
+  it('compares formats case insensitively, since indexers disagree on case', () => {
+    expect(releaseMatchesTier(release({ formats: ['M4B'] }), { formats: ['m4b'] })).toBe(true);
+  });
+
+  it('separates a single file from several', () => {
+    expect(releaseMatchesTier(release({ fileCount: 1 }), { fileLayout: 'single' })).toBe(true);
+    expect(releaseMatchesTier(release({ fileCount: 32 }), { fileLayout: 'single' })).toBe(false);
+    expect(releaseMatchesTier(release({ fileCount: 32 }), { fileLayout: 'multi' })).toBe(true);
+    expect(releaseMatchesTier(release({ fileCount: 1 }), { fileLayout: 'multi' })).toBe(false);
+  });
+
+  /**
+   * The count a tracker states includes sidecars, so an exact test for one file matched nothing.
+   * Both of these are one m4b: `Alien Clay.m4b` beside an nfo, and `Shroud.m4b` beside a cue, a
+   * jpg and an nfo.
+   */
+  it('reads a book shipped with its sidecars as one book file', () => {
+    expect(releaseMatchesTier(release({ fileCount: 2 }), { fileLayout: 'single' })).toBe(true);
+    expect(releaseMatchesTier(release({ fileCount: 4 }), { fileLayout: 'single' })).toBe(true);
+    expect(releaseMatchesTier(release({ fileCount: 2 }), { fileLayout: 'multi' })).toBe(false);
+  });
+
+  it('still reads a real set of tracks as several files', () => {
+    expect(releaseMatchesTier(release({ fileCount: 40 }), { fileLayout: 'single' })).toBe(false);
+    expect(releaseMatchesTier(release({ fileCount: 40 }), { fileLayout: 'multi' })).toBe(true);
+  });
+
+  it('classifies a layout the same way the picker facet does', () => {
+    expect(classifyFileLayout(null)).toBeNull();
+    expect(classifyFileLayout(1)).toBe('single');
+    expect(classifyFileLayout(SINGLE_FILE_MAX_ENTRIES)).toBe('single');
+    expect(classifyFileLayout(SINGLE_FILE_MAX_ENTRIES + 1)).toBe('multi');
+  });
+
+  it('treats an unstated file count as unknown rather than as one file', () => {
+    expect(releaseMatchesTier(release({ fileCount: null }), { fileLayout: 'single' })).toBe(false);
+    expect(releaseMatchesTier(release({ fileCount: null }), { fileLayout: 'multi' })).toBe(false);
+  });
+
+  it('rejects a bitrate that was stated and fell short of the floor', () => {
+    expect(releaseMatchesTier(release(), { minBitrateKbps: 96 })).toBe(true);
+    expect(releaseMatchesTier(release({ audio: { bitrateKbps: 64, channels: 2 } }), { minBitrateKbps: 96 })).toBe(false);
+  });
+
+  /**
+   * MediaInfo is optional per torrent and mostly absent: MyAnonaMouse returned `{}` for every
+   * release of three separate books. A floor that excluded unmeasured releases excluded all of
+   * them, which made a profile unusable on that tracker rather than selective.
+   */
+  it('lets a release with no published bitrate through a bitrate floor', () => {
+    expect(releaseMatchesTier(release({ audio: null }), { minBitrateKbps: 96 })).toBe(true);
+    expect(releaseMatchesTier(release({ audio: { bitrateKbps: null, channels: 2 } }), { minBitrateKbps: 96 })).toBe(true);
+  });
+
+  it('matches channels exactly where they were stated, and ignores the condition where they were not', () => {
+    expect(releaseMatchesTier(release(), { channels: 2 })).toBe(true);
+    expect(releaseMatchesTier(release({ audio: { bitrateKbps: 87, channels: 1 } }), { channels: 2 })).toBe(false);
+    expect(releaseMatchesTier(release({ audio: null }), { channels: 2 })).toBe(true);
+  });
+
+  it('never lets an unstated language satisfy a language condition', () => {
+    expect(releaseMatchesTier(release({ language: null }), { languages: ['ENG'] })).toBe(false);
+    expect(releaseMatchesTier(release({ language: 'eng' }), { languages: ['ENG'] })).toBe(true);
+  });
+
+  /**
+   * A tier can only ever store the two-letter code the settings form offers, while a source states
+   * whatever it states: MyAnonaMouse reports "ENG". Comparing the two as strings put every one of
+   * that tracker's releases outside every tier that named a language, which is a whole source
+   * silently falling out of a profile rather than a single release being judged.
+   */
+  it('agrees on a language across the code forms different sources state it in', () => {
+    expect(releaseMatchesTier(release({ language: 'ENG' }), { languages: ['en'] })).toBe(true);
+    expect(releaseMatchesTier(release({ language: 'en' }), { languages: ['en'] })).toBe(true);
+    expect(releaseMatchesTier(release({ language: 'en-GB' }), { languages: ['en'] })).toBe(true);
+    expect(releaseMatchesTier(release({ language: 'ger' }), { languages: ['en', 'de'] })).toBe(true);
+    expect(releaseMatchesTier(release({ language: 'FRE' }), { languages: ['en'] })).toBe(false);
+  });
+
+  it('restricts to named sources', () => {
+    expect(releaseMatchesTier(release({ indexerId: 14 }), { indexerIds: [14, 17] })).toBe(true);
+    expect(releaseMatchesTier(release({ indexerId: 18 }), { indexerIds: [14, 17] })).toBe(false);
+  });
+
+  /**
+   * The one place silence passes. A source with no swarm at all reports null, and holding that
+   * against it would exclude every direct download from every tier that wants a healthy swarm.
+   */
+  it('lets a source that publishes no swarm through a seeder floor', () => {
+    expect(releaseMatchesTier(release({ seeders: null }), { minSeeders: 10 })).toBe(true);
+    expect(releaseMatchesTier(release({ seeders: 3 }), { minSeeders: 10 })).toBe(false);
+  });
+
+  it('applies the freeleech and VIP switches only when they are turned on', () => {
+    expect(releaseMatchesTier(release({ freeleech: false }), { freeleechOnly: true })).toBe(false);
+    expect(releaseMatchesTier(release({ freeleech: false }), { freeleechOnly: false })).toBe(true);
+    expect(releaseMatchesTier(release({ vipOnly: true }), { excludeVipOnly: true })).toBe(false);
+    expect(releaseMatchesTier(release({ vipOnly: true }), {})).toBe(true);
+  });
+
+  it('requires every stated condition, not any of them', () => {
+    const conditions = { formats: ['m4b'], fileLayout: 'single' as const, minBitrateKbps: 96 };
+    expect(releaseMatchesTier(release(), conditions)).toBe(true);
+    expect(releaseMatchesTier(release({ fileCount: 32 }), conditions)).toBe(false);
+    expect(releaseMatchesTier(release({ formats: ['mp3'] }), conditions)).toBe(false);
+  });
+});
+
+describe('matchReleaseTier', () => {
+  const tiers = [
+    tier('best', { formats: ['m4b'], fileLayout: 'single', minBitrateKbps: 96 }),
+    tier('good', { formats: ['m4b'] }),
+    tier('ok', { formats: ['mp3'], minBitrateKbps: 128 }),
+  ];
+
+  it('returns the first tier that matches, not the best-fitting one', () => {
+    expect(matchReleaseTier(release(), tiers)).toBe(0);
+    // A real set of tracks fails the first tier's layout and falls to the plain m4b tier below it.
+    expect(matchReleaseTier(release({ fileCount: 32 }), tiers)).toBe(1);
+  });
+
+  it('returns null for a release no tier accepts', () => {
+    expect(matchReleaseTier(release({ formats: ['epub'] }), tiers)).toBeNull();
+    // Stated 64k against a 128k tier still fails; only silence is forgiven.
+    expect(matchReleaseTier(release({ formats: ['mp3'], audio: { bitrateKbps: 64, channels: 1 } }), tiers)).toBeNull();
+  });
+
+  /** The property that makes adopting profiles safe: no profile means the tier axis does nothing. */
+  it('returns null for every release when no tier is configured', () => {
+    expect(matchReleaseTier(release(), [])).toBeNull();
+    expect(releaseProfileIsActive([])).toBe(false);
+    expect(releaseProfileIsActive(undefined)).toBe(false);
+    expect(releaseProfileIsActive(tiers)).toBe(true);
+  });
+});
+
+describe('compareByTier', () => {
+  it('orders better tiers first and sorts untiered last', () => {
+    expect(compareByTier(0, 1)).toBeLessThan(0);
+    expect(compareByTier(2, 1)).toBeGreaterThan(0);
+    expect(compareByTier(1, 1)).toBe(0);
+    expect(compareByTier(null, 3)).toBeGreaterThan(0);
+    expect(compareByTier(3, null)).toBeLessThan(0);
+    expect(compareByTier(null, null)).toBe(0);
+  });
+
+  it('puts every tiered release ahead of every untiered one when sorting', () => {
+    const rows = [{ tier: null }, { tier: 2 }, { tier: 0 }, { tier: null }, { tier: 1 }];
+    rows.sort((a, b) => compareByTier(a.tier, b.tier));
+    expect(rows.map((row) => row.tier)).toEqual([0, 1, 2, null, null]);
+  });
+});
diff --git a/server/src/modules/book-request/indexers/release-scoring.test.ts b/server/src/modules/book-request/indexers/release-scoring.test.ts
new file mode 100644
index 000000000..a8dd54caa
--- /dev/null
+++ b/server/src/modules/book-request/indexers/release-scoring.test.ts
@@ -0,0 +1,346 @@
+import type { ReleaseCandidate } from './indexer-adapter';
+import { rejectRelease, scoreRelease, toReleaseItem, type ScoringRequest } from './release-scoring';
+
+function request(overrides: Partial<ScoringRequest> = {}): ScoringRequest {
+  return {
+    title: 'Dune',
+    authors: ['Frank Herbert'],
+    isbn13: null,
+    isbn10: null,
+    isbns: [],
+    mediaKind: 'ebook',
+    preferredFormats: [],
+    language: null,
+    tiers: [],
+    ...overrides,
+  };
+}
+
+function release(overrides: Partial<ReleaseCandidate> = {}): ReleaseCandidate {
+  return {
+    indexerId: 1,
+    guid: 'g1',
+    title: 'Frank Herbert - Dune (2005) [EPUB]',
+    sizeBytes: 2 * 1024 * 1024,
+    seeders: 20,
+    leechers: 3,
+    ...overrides,
+  };
+}
+
+function pointsFor(scored: ReturnType<typeof scoreRelease>, code: string): number | undefined {
+  return scored.reasons.find((reason) => reason.code === code)?.points;
+}
+
+describe('rejectRelease', () => {
+  it('drops a release nobody is seeding', () => {
+    expect(rejectRelease(release({ seeders: 0 }), request())).toBe('no seeders');
+  });
+
+  it('drops a release whose format belongs to a different medium', () => {
+    expect(rejectRelease(release({ format: 'mp3' }), request({ mediaKind: 'ebook' }))).toContain('not a ebook format');
+    expect(rejectRelease(release({ format: 'epub' }), request({ mediaKind: 'audiobook' }))).toContain('not a audiobook format');
+  });
+
+  it('accepts pdf for both ebooks and comics', () => {
+    expect(rejectRelease(release({ format: 'pdf' }), request({ mediaKind: 'ebook' }))).toBeNull();
+    expect(rejectRelease(release({ format: 'pdf' }), request({ mediaKind: 'comic' }))).toBeNull();
+  });
+
+  it('compares only the language subtag, so eng and en agree', () => {
+    expect(rejectRelease(release({ language: 'ENG' }), request({ language: 'en' }))).toBeNull();
+    expect(rejectRelease(release({ language: 'de' }), request({ language: 'en' }))).toContain('not en');
+  });
+
+  /**
+   * A tracker states ISO 639-2 while a request states ISO 639-1, and most of the pairs that do not
+   * share a prefix are major languages. Truncating "spa" to "sp" would drop every Spanish release.
+   */
+  it('maps a three-letter code that does not truncate to its two-letter form', () => {
+    for (const [released, requested] of [
+      ['spa', 'es'],
+      ['ger', 'de'],
+      ['deu', 'de'],
+      ['swe', 'sv'],
+      ['jpn', 'ja'],
+      ['dut', 'nl'],
+      ['zho', 'zh'],
+    ]) {
+      expect(rejectRelease(release({ language: released }), request({ language: requested }))).toBeNull();
+    }
+
+    expect(rejectRelease(release({ language: 'spa' }), request({ language: 'de' }))).toContain('not de');
+  });
+
+  /**
+   * A torznab proxy publishes the language in the release title rather than as an attribute, so
+   * without this fallback the filter above silently stops running for every torznab indexer.
+   * Titles are real Prowlarr output.
+   */
+  it('reads the language from a title flag when the indexer stated no attribute', () => {
+    const audiobook = (title: string) => release({ title, sizeBytes: 900 * 1024 * 1024, language: undefined });
+    const asked = (language: string) => request({ title: 'Project Hail Mary', mediaKind: 'audiobook', language });
+
+    const dutch = audiobook('Project Hail Mary by Andy Weir [DUT / M4B]');
+    expect(rejectRelease(dutch, asked('en'))).toContain('not en');
+    expect(rejectRelease(dutch, asked('nl'))).toBeNull();
+
+    expect(rejectRelease(audiobook('Project Hail Mary by Andy Weir [ENG / MP3]'), asked('en'))).toBeNull();
+    expect(rejectRelease(audiobook('Project Hail Mary by Andy Weir [DAN / MP3]'), asked('en'))).toContain('not en');
+  });
+
+  it('prefers a stated language attribute over the title flag', () => {
+    const candidate = release({ title: 'Dune [DUT / EPUB]', language: 'eng' });
+    expect(rejectRelease(candidate, request({ language: 'en' }))).toBeNull();
+  });
+
+  /**
+   * The filter must stay skipped rather than reject on a language it invented. `normalizeLanguage`
+   * truncates an unknown token to two letters, which would otherwise read "[VIP]" as Vietnamese.
+   */
+  it('leaves the language unstated when no bracketed flag is a known code', () => {
+    for (const title of [
+      'Frank Herbert - Dune (2005) [EPUB]',
+      'Dune [VIP]',
+      'Dune [HQ / EPUB]',
+      'Dune Messiah',
+      '[1818] Mary Shelley - Frankenstein',
+    ]) {
+      expect(rejectRelease(release({ title, format: undefined, language: undefined }), request({ language: 'en' }))).toBeNull();
+    }
+  });
+
+  /** "lit" is Lithuanian and also the Microsoft Reader format; on a book tracker it is the format. */
+  it('does not read a format token in brackets as a language', () => {
+    const candidate = release({ title: 'Dune [EPUB / LIT]', format: undefined, language: undefined });
+    expect(rejectRelease(candidate, request({ language: 'en' }))).toBeNull();
+  });
+
+  it('keeps a release whose indexer reported no seeder count at all', () => {
+    expect(rejectRelease(release({ seeders: null }), request())).toBeNull();
+  });
+
+  it('keeps a release stating several formats when one of them fits the medium', () => {
+    expect(rejectRelease(release({ format: 'm4a mp3' }), request({ mediaKind: 'audiobook' }))).toBeNull();
+    expect(rejectRelease(release({ format: 'm4a mp3' }), request({ mediaKind: 'ebook' }))).toContain('not a ebook format');
+  });
+
+  /**
+   * This used to be a hard filter, back when the dock was one row per file and a thirty-track
+   * release imported track one and reported success. The dock holds units now, so hiding these
+   * would hide the multi-format releases that are the best thing a tracker can offer.
+   */
+  it('keeps a release the indexer says holds more than one primary file', () => {
+    expect(rejectRelease(release({ primaryFileCount: 30 }), request())).toBeNull();
+    expect(rejectRelease(release({ primaryFileCount: 1 }), request())).toBeNull();
+  });
+
+  it('keeps a release whose only file signal is a bare count, which scoring penalises instead', () => {
+    expect(rejectRelease(release({ fileCount: 30 }), request())).toBeNull();
+  });
+});
+
+describe('scoreRelease', () => {
+  it('scores a clean title and author match well above a title-only one', () => {
+    const matched = scoreRelease(release(), request());
+    const wrongAuthor = scoreRelease(release({ title: 'Dune - Someone Else [EPUB]' }), request());
+
+    expect(matched.score).toBeGreaterThan(wrongAuthor.score);
+  });
+
+  it('treats an ISBN in the release name as decisive', () => {
+    const scored = scoreRelease(release({ title: 'Dune 9780441013593 [EPUB]' }), request({ isbn13: '978-0-441-01359-3' }));
+
+    expect(pointsFor(scored, 'isbnMatch')).toBe(61);
+  });
+
+  /**
+   * Library Genesis prints every ISBN it holds against a row, and it holds some against the wrong
+   * one. Such a row used to take a full match and lead the picker ahead of the right book.
+   */
+  it('refuses to let a matching ISBN carry a release about a different book', () => {
+    const scored = scoreRelease(
+      release({ title: 'Cooking for Beginners', bookTitle: 'Cooking for Beginners', author: 'Someone Else', isbn: '9780441013593' }),
+      request({ isbn13: '978-0-441-01359-3' }),
+    );
+
+    expect(pointsFor(scored, 'isbnMatch')).toBeUndefined();
+    expect(pointsFor(scored, 'titleMatch')).toBe(0);
+  });
+
+  it('still takes an ISBN stated beside a title that agrees at all', () => {
+    const scored = scoreRelease(
+      release({ title: 'Dune Messiah', bookTitle: 'Dune Messiah', author: 'Frank Herbert', isbn: '9780441013593' }),
+      request({ isbn13: '978-0-441-01359-3' }),
+    );
+
+    expect(pointsFor(scored, 'isbnMatch')).toBe(61);
+  });
+
+  /**
+   * A request holds the canonical ISBN-13, while catalogues that predate it print the 10 the book
+   * was published under. Without converting the printed one, the two never compare equal and the
+   * decisive sixty-one points were missed on exactly the sources most likely to state an ISBN.
+   */
+  it('matches an ISBN-10 a release prints against the canonical ISBN-13 requested', () => {
+    const scored = scoreRelease(
+      release({ title: 'Dune', bookTitle: 'Dune', author: 'Frank Herbert', isbn: '0441013597' }),
+      request({ isbn13: '9780441013593' }),
+    );
+
+    expect(pointsFor(scored, 'isbnMatch')).toBe(61);
+  });
+
+  /**
+   * Checksum-gated: an unvalidated ten-digit run is as likely to be an ASIN or a catalogue number,
+   * and converting one would manufacture a 13 that matches a different book outright.
+   */
+  it('does not convert a ten-digit run that is not a valid ISBN-10', () => {
+    const scored = scoreRelease(
+      release({ title: 'Dune', bookTitle: 'Dune', author: 'Frank Herbert', isbn: '0441013590' }),
+      request({ isbn13: '9780441013593' }),
+    );
+
+    expect(pointsFor(scored, 'isbnMatch')).toBeUndefined();
+  });
+
+  it('rewards a preferred format over a merely acceptable one', () => {
+    const preferred = scoreRelease(release({ format: 'epub' }), request({ preferredFormats: ['epub'] }));
+    const acceptable = scoreRelease(release({ format: 'epub' }), request({ preferredFormats: ['azw3'] }));
+
+    expect(pointsFor(preferred, 'preferredFormat')).toBeGreaterThan(pointsFor(acceptable, 'knownFormat')!);
+  });
+
+  it('reads the format out of the scene name when the indexer states none', () => {
+    const scored = scoreRelease(release({ title: 'Dune - Frank Herbert [AZW3]' }), request({ preferredFormats: ['azw3'] }));
+
+    expect(scored.reasons.find((reason) => reason.code === 'preferredFormat')?.detail).toBe('azw3');
+  });
+
+  /** MyAnonaMouse states file types as "m4a mp3"; scoring that as unknown throws away the signal. */
+  it('reads a preferred format out of a multi-format field', () => {
+    const scored = scoreRelease(release({ title: 'Dune', format: 'm4a mp3' }), request({ mediaKind: 'audiobook', preferredFormats: ['mp3'] }));
+
+    expect(scored.reasons.find((reason) => reason.code === 'preferredFormat')?.detail).toBe('mp3');
+  });
+
+  it('scores no seeder bonus when the indexer reported no count, rather than a zero-seeder one', () => {
+    const scored = scoreRelease(release({ seeders: null }), request());
+
+    expect(scored.reasons.some((reason) => reason.code === 'seeders')).toBe(false);
+  });
+
+  it('penalises a size that cannot be the requested medium', () => {
+    const sample = scoreRelease(release({ sizeBytes: 4 * 1024 }), request());
+
+    expect(pointsFor(sample, 'suspiciousSize')).toBeLessThan(0);
+    expect(sample.score).toBeLessThan(scoreRelease(release(), request()).score);
+  });
+
+  it('saturates the seeder bonus, so 200 against 400 barely differs but 1 against 20 does', () => {
+    const one = pointsFor(scoreRelease(release({ seeders: 1 }), request()), 'seeders')!;
+    const twenty = pointsFor(scoreRelease(release({ seeders: 20 }), request()), 'seeders')!;
+    const twoHundred = pointsFor(scoreRelease(release({ seeders: 200 }), request()), 'seeders')!;
+    const fourHundred = pointsFor(scoreRelease(release({ seeders: 400 }), request()), 'seeders')!;
+
+    expect(twenty - one).toBeGreaterThan(5);
+    expect(fourHundred - twoHundred).toBe(0);
+  });
+
+  it('penalises a release carrying far more files than one book in several formats', () => {
+    const scored = scoreRelease(release({ fileCount: 30 }), request());
+
+    expect(pointsFor(scored, 'likelySeveralBooks')).toBeLessThan(0);
+  });
+
+  /**
+   * Three formats plus a cover and an `.opf` is five files and one perfectly ordinary book. It
+   * used to lose twenty points for that, which was enough to drop it under an 80 auto-grab floor.
+   */
+  it('does not penalise one book carried in several formats', () => {
+    const scored = scoreRelease(release({ fileCount: 5 }), request());
+
+    expect(pointsFor(scored, 'likelySeveralBooks')).toBeUndefined();
+  });
+
+  /** A release holding several book files is ordinary now, and must not be hidden from the list. */
+  it('keeps a multi-file release in the results rather than filtering it out', () => {
+    const scored = scoreRelease(release({ fileCount: 5, primaryFileCount: 3 }), request());
+
+    expect(scored.score).toBeGreaterThan(0);
+  });
+
+  /**
+   * The ceiling is the point of the weight table, not an incidental bound: every reason is rounded
+   * on its own, so a fractional weight would land this on 99 or 101 and quietly stop the score
+   * reading as a percentage. Asserting the exact number is what catches that.
+   */
+  it('reaches exactly 100 when everything goes right, and never drops below 0', () => {
+    const best = scoreRelease(
+      release({ title: 'Dune - Frank Herbert 9780441013593 [EPUB]', seeders: 900, freeleech: true, format: 'epub' }),
+      request({ isbn13: '9780441013593', preferredFormats: ['epub'] }),
+    );
+    const worst = scoreRelease(release({ title: 'Unrelated', sizeBytes: 1, seeders: 1, fileCount: 40 }), request());
+
+    expect(best.score).toBe(100);
+    expect(worst.score).toBeGreaterThanOrEqual(0);
+  });
+
+  /** Freeleech is five of the hundred, so the same release without it tops out five short. */
+  it('caps an otherwise perfect release at 95 when it is not freeleech', () => {
+    const scored = scoreRelease(
+      release({ title: 'Dune - Frank Herbert 9780441013593 [EPUB]', seeders: 900, freeleech: false, format: 'epub' }),
+      request({ isbn13: '9780441013593', preferredFormats: ['epub'] }),
+    );
+
+    expect(scored.score).toBe(95);
+  });
+});
+
+describe('toReleaseItem', () => {
+  /**
+   * MyAnonaMouse publishes `filetypes` alphabetically, so leading with the indexer's first token
+   * labelled a release holding the requested epub as an AZW3, and faceting on that one value hid
+   * it from a filter on EPUB entirely.
+   */
+  it('carries every format the release claims, the requested ones first', () => {
+    const candidate = release({ title: 'Frank Herbert - Dune', format: 'azw3 epub mobi' });
+    const scored = scoreRelease(candidate, request({ preferredFormats: ['epub'] }));
+
+    const item = toReleaseItem(scored, 'myanonamouse', request({ preferredFormats: ['epub'] }));
+
+    expect(item.formats).toEqual(['epub', 'azw3', 'mobi']);
+    expect(item.format).toBe('epub');
+  });
+
+  /** With nothing preferred there is nothing to promote, so the indexer's order stands. */
+  it('keeps the indexer order where the request prefers no format', () => {
+    const candidate = release({ title: 'Frank Herbert - Dune', format: 'azw3 epub mobi' });
+    const scored = scoreRelease(candidate, request());
+
+    expect(toReleaseItem(scored, 'myanonamouse', request()).formats).toEqual(['azw3', 'epub', 'mobi']);
+  });
+
+  /** Several preferred formats rank against each other in the order the request asked for them. */
+  it('orders the preferred formats by preference', () => {
+    const candidate = release({ title: 'Frank Herbert - Dune', format: 'azw3 epub mobi' });
+    const scoringRequest = request({ preferredFormats: ['mobi', 'epub'] });
+    const scored = scoreRelease(candidate, scoringRequest);
+
+    expect(toReleaseItem(scored, 'myanonamouse', scoringRequest).formats).toEqual(['mobi', 'epub', 'azw3']);
+  });
+
+  it('falls back to the formats named in the release title', () => {
+    const scored = scoreRelease(release(), request({ preferredFormats: ['epub'] }));
+
+    expect(toReleaseItem(scored, 'jackett', request({ preferredFormats: ['epub'] })).formats).toEqual(['epub']);
+  });
+
+  it('states no format where neither the field nor the title names one', () => {
+    const scored = scoreRelease(release({ title: 'Frank Herbert - Dune' }), request());
+    const item = toReleaseItem(scored, 'jackett', request());
+
+    expect(item.formats).toEqual([]);
+    expect(item.format).toBeNull();
+  });
+});
diff --git a/server/src/modules/book-request/indexers/release-scoring.ts b/server/src/modules/book-request/indexers/release-scoring.ts
new file mode 100644
index 000000000..71b3ce339
--- /dev/null
+++ b/server/src/modules/book-request/indexers/release-scoring.ts
@@ -0,0 +1,408 @@
+import {
+  AUDIO_FORMAT_LIST,
+  bookRequestIsbn10To13,
+  COMIC_FORMAT_LIST,
+  EBOOK_FORMAT_LIST,
+  ISO_639_2_TO_1,
+  isAudioFormat,
+  isComicFormat,
+  isValidBookRequestIsbn10,
+  languagesAgree,
+  matchReleaseTier,
+} from '@bookorbit/types';
+import type { BookRequestMediaKind, ReleaseCandidateItem, ReleaseScoreReason, ReleaseTier } from '@bookorbit/types';
+
+import { normalizeIsbn, normalizeMetadataIsbn } from '../../../common/text-match/isbn-normalize';
+import { TITLE_MATCH_SCORES, scoreTitleMatch } from '../../../common/text-match/title-match';
+import type { ReleaseCandidate } from './indexer-adapter';
+
+/**
+ * Weights, and the reason each one is what it is. They sum to 100 at their maximum, so a score is
+ * readable as a percentage without a normalisation pass that would hide the breakdown. Each reason
+ * is rounded on its own, so the weights have to be integers for that sum to land exactly.
+ *
+ * Freeleech is five of those hundred, so an ordinary release caps at 95: reaching 100 needs a
+ * perfect match, the preferred format, a plausible size, a saturated swarm and freeleech together.
+ */
+const WEIGHTS = {
+  /**
+   * Does this release describe the requested work at all. Everything else is a tie-breaker.
+   *
+   * Carries the six points that belonged to per-source priority until that setting was removed.
+   * They went here rather than being spread across the tie-breakers because only a good match
+   * gains from it: a wrong-book release scores about 0.9 more, a right-book one a full 6, so the
+   * gap between them widens rather than narrows.
+   */
+  match: 61,
+  preferredFormat: 12,
+  acceptableFormat: 6,
+  unknownFormat: 2,
+  expectedSize: 10,
+  /** A 40 MB "audiobook" is a sample or the wrong medium, and no seeder count redeems it. */
+  suspiciousSize: -25,
+  seeders: 12,
+  freeleech: 5,
+  /**
+   * A release with this many files is more likely a pack of several books than one book in several
+   * formats, and a pack costs an approver a choice after the download - which is exactly the human
+   * step unattended grabbing exists to avoid. Small, because being wrong is now a prompt rather
+   * than a broken import: the dock holds multi-file units, so ordinary packaging imports whole.
+   */
+  likelySeveralBooks: -5,
+} as const;
+
+const TITLE_WEIGHT = 0.7;
+const AUTHOR_WEIGHT = 0.3;
+
+/** Seeders past this add nothing: 200 against 400 is noise, 1 against 20 is not. */
+const SEEDER_SATURATION = 60;
+
+/**
+ * Three formats plus a cover and an `.opf` is five files and an entirely ordinary single book, so
+ * the threshold sits well above that. Past a dozen, a book release is usually a pack.
+ */
+const SEVERAL_BOOKS_SUSPICION_THRESHOLD = 12;
+
+const MEGABYTE = 1024 * 1024;
+
+/**
+ * Plausible sizes per medium. Wide on purpose: an illustrated ebook and a bare text one differ by
+ * two orders of magnitude, and the point is to catch a sample or a mislabelled medium, not to
+ * express a preference.
+ */
+const SIZE_RANGES: Record<BookRequestMediaKind, { min: number; max: number }> = {
+  ebook: { min: 20 * 1024, max: 400 * MEGABYTE },
+  audiobook: { min: 20 * MEGABYTE, max: 8 * 1024 * MEGABYTE },
+  comic: { min: 1 * MEGABYTE, max: 4 * 1024 * MEGABYTE },
+};
+
+/** Whether a format is a usable one for the requested medium. */
+const FORMATS_BY_MEDIA_KIND: Record<BookRequestMediaKind, (format: string) => boolean> = {
+  ebook: (format) => (EBOOK_FORMAT_LIST as readonly string[]).includes(format),
+  audiobook: (format) => isAudioFormat(format),
+  comic: (format) => isComicFormat(format) || format === 'pdf',
+};
+
+/**
+ * Formats a scene name spells out, so a release with no format field still classifies. Derived
+ * from the three shared lists rather than restated: written out by hand it had already lost `cbx`,
+ * so a comic release naming that format read as having no format at all.
+ */
+const FORMAT_TOKENS: readonly string[] = [...EBOOK_FORMAT_LIST, ...AUDIO_FORMAT_LIST, ...COMIC_FORMAT_LIST];
+
+/** The work a release is scored against: the request snapshot, never the library. */
+export interface ScoringRequest {
+  title: string;
+  authors: string[];
+  isbn13: string | null;
+  isbn10: string | null;
+  isbns: string[];
+  mediaKind: BookRequestMediaKind;
+  preferredFormats: string[];
+  language: string | null;
+  /**
+   * The profile for this medium, best tier first. Empty means no profile is configured, and every
+   * release comes back untiered, which is what keeps the score the only axis it ever was.
+   */
+  tiers: readonly ReleaseTier[];
+}
+
+/**
+ * Hard filters, applied before scoring. A release that fails one of these is not a worse choice,
+ * it is not a choice: no weighting should be able to float it back up the list.
+ */
+export function rejectRelease(candidate: ReleaseCandidate, request: ScoringRequest): string | null {
+  // Only where the indexer actually stated a count. Some report no swarm data at all, and
+  // reading that as zero would reject everything they return.
+  if (candidate.seeders !== null && candidate.seeders <= 0) return 'no seeders';
+
+  // A release may state several, as MyAnonaMouse does with "m4a mp3". One usable format is enough.
+  const formats = resolveFormats(candidate);
+  if (formats.length > 0 && !formats.some((format) => FORMATS_BY_MEDIA_KIND[request.mediaKind](format))) {
+    return `${formats.join('/')} is not a ${request.mediaKind} format`;
+  }
+
+  const language = resolveLanguage(candidate);
+  if (request.language && language && !languagesAgree(request.language, language)) {
+    return `in ${language}, not ${request.language}`;
+  }
+
+  // No file-count filter. A release carrying several book files is ordinary - three formats of one
+  // title, an audiobook in parts - and the dock imports it whole. Where it really is several
+  // books, that is a choice an approver makes after the download, not a reason to hide the release.
+  return null;
+}
+
+export interface ScoredRelease {
+  candidate: ReleaseCandidate;
+  score: number;
+  reasons: ReleaseScoreReason[];
+}
+
+export function scoreRelease(candidate: ReleaseCandidate, request: ScoringRequest): ScoredRelease {
+  const reasons: ReleaseScoreReason[] = [];
+
+  reasons.push(matchReason(candidate, request));
+  reasons.push(formatReason(resolveFormats(candidate), request));
+
+  const sizeReason = sizeReasonFor(candidate, request);
+  if (sizeReason) reasons.push(sizeReason);
+
+  if (candidate.seeders !== null) {
+    reasons.push({ code: 'seeders', points: round(seederScore(candidate.seeders)), detail: String(candidate.seeders) });
+  }
+
+  if (candidate.freeleech) reasons.push({ code: 'freeleech', points: WEIGHTS.freeleech });
+  if (candidate.fileCount !== undefined && candidate.fileCount > SEVERAL_BOOKS_SUSPICION_THRESHOLD) {
+    reasons.push({ code: 'likelySeveralBooks', points: WEIGHTS.likelySeveralBooks, detail: String(candidate.fileCount) });
+  }
+
+  const total = reasons.reduce((sum, reason) => sum + reason.points, 0);
+  return { candidate, score: Math.max(0, Math.min(100, round(total))), reasons };
+}
+
+export function toReleaseItem(scored: ScoredRelease, indexerName: string, request: ScoringRequest): ReleaseCandidateItem {
+  const { candidate } = scored;
+  const formats = orderByPreference(resolveFormats(candidate), request.preferredFormats);
+  const fileCount = candidate.primaryFileCount ?? candidate.fileCount ?? null;
+  const base = {
+    indexerId: candidate.indexerId,
+    indexerName,
+    guid: candidate.guid,
+    title: candidate.title,
+    sizeBytes: candidate.sizeBytes,
+    seeders: candidate.seeders,
+    leechers: candidate.leechers,
+    format: formats[0] ?? null,
+    formats,
+    language: resolveLanguage(candidate),
+    fileCount,
+    freeleech: candidate.freeleech ?? false,
+    vipOnly: candidate.vipOnly ?? false,
+    alreadyGrabbed: candidate.alreadyGrabbed ?? false,
+    publishedAt: candidate.publishedAt ?? null,
+    audio: candidate.audio ?? null,
+  };
+
+  // Matched on the shape the picker will show rather than on the raw candidate, so the tier an
+  // approver reads on a row is the one the automation used to choose it.
+  const tier = matchReleaseTier(base, request.tiers);
+  return {
+    ...base,
+    score: scored.score,
+    tier,
+    tierName: tier === null ? null : (request.tiers[tier]?.name ?? null),
+    reasons: scored.reasons,
+  };
+}
+
+/**
+ * A matching ISBN is decisive, but only for a release that also looks like the requested work at
+ * all. It is decisive because nothing puts an ISBN in a release name by accident; the qualifier is
+ * there because a catalogue puts one in an identifier column on purpose, and a catalogue can be
+ * wrong. Library Genesis prints every ISBN it holds against a row, so one recorded against the
+ * wrong book used to score a full match and lead the picker ahead of the right one, with no other
+ * signal able to outweigh it.
+ *
+ * Title and author agreement is the qualifier because `scoreTitleMatch` already answers exactly
+ * the question being asked: it returns zero for two unrelated titles rather than a small number,
+ * so this only rejects a release that describes some other book. Anything that agrees even loosely
+ * still takes the full points.
+ *
+ * `scoreTitleMatch` is deliberately generous about a candidate that extends the query, which is
+ * right here (a release name carries the author, the year and the format) and is why a sequel can
+ * still rank well. Import verification, which compares symmetrically, is the gate that catches it.
+ */
+function matchReason(candidate: ReleaseCandidate, request: ScoringRequest): ReleaseScoreReason {
+  // The bare work title where the indexer published one, since the release name carries the
+  // author, the year and the format flags and only dilutes the comparison.
+  const titleText = candidate.bookTitle ?? candidate.title;
+  const titleScore = scoreTitleMatch(request.title, titleText) / TITLE_MATCH_SCORES.exact;
+  const authorText = candidate.author ?? candidate.title;
+  const authors = request.authors.filter(Boolean);
+  const authorScore =
+    authors.length > 0 ? Math.max(...authors.map((author) => scoreTitleMatch(author, authorText) / TITLE_MATCH_SCORES.exact)) : null;
+
+  const requestedIsbns = [...request.isbns, normalizeMetadataIsbn(request.isbn13), normalizeMetadataIsbn(request.isbn10)].filter(Boolean);
+  if (requestedIsbns.length > 0 && (titleScore > 0 || (authorScore ?? 0) > 0)) {
+    // The stated field first, then the release name. Both go through `extractIsbns`, which is what
+    // makes the stated one safe to read: MyAnonaMouse puts `ASIN:B08G9PRS1K` in the same field, and
+    // an ASIN carries no ten- or thirteen-digit run for the pattern to find.
+    const releaseIsbns = [...extractIsbns(candidate.isbn ?? ''), ...extractIsbns(candidate.title)];
+    if (releaseIsbns.some((isbn) => requestedIsbns.includes(isbn))) {
+      return { code: 'isbnMatch', points: WEIGHTS.match };
+    }
+  }
+
+  const combined = authorScore === null ? titleScore : titleScore * TITLE_WEIGHT + authorScore * AUTHOR_WEIGHT;
+  return {
+    code: authorScore !== null && authorScore > 0 && titleScore > 0 ? 'authorMatch' : 'titleMatch',
+    points: round(combined * WEIGHTS.match),
+  };
+}
+
+function formatReason(formats: string[], request: ScoringRequest): ReleaseScoreReason {
+  if (formats.length === 0) return { code: 'unknownFormat', points: WEIGHTS.unknownFormat };
+
+  const preferred = request.preferredFormats.map((value) => value.toLowerCase());
+  // A release carrying both a preferred format and an acceptable one is a preferred release.
+  const match = formats.find((format) => preferred.includes(format));
+  if (match) return { code: 'preferredFormat', points: WEIGHTS.preferredFormat, detail: match };
+  return { code: 'knownFormat', points: WEIGHTS.acceptableFormat, detail: formats[0] };
+}
+
+function sizeReasonFor(candidate: ReleaseCandidate, request: ScoringRequest): ReleaseScoreReason | null {
+  if (candidate.sizeBytes === null || candidate.sizeBytes <= 0) return null;
+
+  const range = SIZE_RANGES[request.mediaKind];
+  const withinRange = candidate.sizeBytes >= range.min && candidate.sizeBytes <= range.max;
+  return withinRange
+    ? { code: 'expectedSize', points: WEIGHTS.expectedSize }
+    : { code: 'suspiciousSize', points: WEIGHTS.suspiciousSize, detail: formatBytes(candidate.sizeBytes) };
+}
+
+/** Log-scaled: the gap between 1 and 20 seeders matters, the gap between 200 and 400 does not. */
+function seederScore(seeders: number): number {
+  if (seeders <= 0) return 0;
+  return WEIGHTS.seeders * Math.min(1, Math.log10(seeders + 1) / Math.log10(SEEDER_SATURATION + 1));
+}
+
+/**
+ * The first format the indexer stated, in its own order. What the grab records, and deliberately
+ * not what the picker leads with: see `orderByPreference` for why those differ.
+ */
+export function resolveFormat(candidate: ReleaseCandidate): string | null {
+  return resolveFormats(candidate)[0] ?? null;
+}
+
+/**
+ * Preferred formats first, in the order the request prefers them, with everything else keeping
+ * the indexer's order behind them.
+ *
+ * The indexer's own order is not a ranking. MyAnonaMouse publishes `filetypes` alphabetically, so
+ * a release holding an epub, a mobi and an azw3 led with "azw3" and was labelled and faceted as
+ * an AZW3 release, which then hid it from a filter on the very format the approver asked for.
+ */
+function orderByPreference(formats: string[], preferredFormats: string[]): string[] {
+  const preferred = preferredFormats.map((value) => value.toLowerCase());
+  const rank = (format: string): number => {
+    const index = preferred.indexOf(format);
+    return index === -1 ? preferred.length : index;
+  };
+  // Stable, so formats of equal rank keep the order the indexer stated them in.
+  return [...formats].sort((a, b) => rank(a) - rank(b));
+}
+
+/**
+ * Every format the release claims. The stated field wins where it names any known format, since a
+ * tracker that lists file types is more reliable than a scene name; some list several at once.
+ */
+function resolveFormats(candidate: ReleaseCandidate): string[] {
+  const stated = tokenize(candidate.format?.replace(/^\./, '') ?? '');
+  if (stated.length > 0) return stated;
+  return tokenize(candidate.title);
+}
+
+/** Source order, so the format a release names first is the one shown and recorded. */
+function tokenize(text: string): string[] {
+  const formats: string[] = [];
+  for (const token of text.toLowerCase().split(/[^a-z0-9]+/)) {
+    if (FORMAT_TOKENS.includes(token) && !formats.includes(token)) formats.push(token);
+  }
+  return formats;
+}
+
+/**
+ * Codes recognised inside a release title's bracketed flags. Deliberately a strict allowlist of
+ * three-letter codes rather than anything `normalizeLanguage` would accept: it truncates an
+ * unknown token to two letters, which would read "[VIP]" as Vietnamese and "[HQ]" as nothing at
+ * all. A token we do not recognise must leave the language unstated, because the filter then
+ * skips rather than rejecting a release for a language it invented.
+ *
+ * `lit` is excluded despite being Lithuanian: it is also the Microsoft Reader format, and
+ * "[EPUB / LIT]" is far more common on a book tracker than a Lithuanian release. It used to be
+ * excluded by being in `FORMAT_TOKENS`; BookOrbit does not import Microsoft Reader files, so it is
+ * no longer a format we recognise, and the exclusion has to be stated outright or the same title
+ * starts reading as Lithuanian.
+ */
+const NON_LANGUAGE_TITLE_TOKENS: ReadonlySet<string> = new Set(['lit']);
+
+const TITLE_LANGUAGE_TOKENS: ReadonlySet<string> = new Set(
+  [
+    ...Object.keys(ISO_639_2_TO_1),
+    // Codes that truncate to the right two letters on their own, so they never needed a mapping.
+    'eng',
+    'fre',
+    'fra',
+    'afr',
+    'bos',
+    'epo',
+    'gle',
+    'glg',
+    'lat',
+    'ltz',
+    'mlt',
+    'nno',
+    'nob',
+    'swa',
+    'tam',
+    'tel',
+    'urd',
+  ].filter((code) => !FORMAT_TOKENS.includes(code) && !NON_LANGUAGE_TITLE_TOKENS.has(code)),
+);
+
+/**
+ * What language the release claims. The stated field wins; otherwise the title's bracketed flags
+ * are read, because a torznab proxy publishes the language there and not as an attribute at all.
+ * Measured against Prowlarr, which titles a release "... by Andy Weir [DUT / M4B]": without this
+ * fallback `candidate.language` is undefined for every release it returns, and the hard filter in
+ * `rejectRelease` silently stops running rather than failing.
+ *
+ * Only bracketed segments are considered. A bare three-letter word in a title is far more likely
+ * to be part of the title.
+ */
+export function resolveLanguage(candidate: ReleaseCandidate): string | null {
+  if (candidate.language) return candidate.language;
+
+  for (const bracketed of candidate.title.matchAll(/\[([^\]]*)\]/g)) {
+    for (const part of bracketed[1].split('/')) {
+      const token = part.trim();
+      if (TITLE_LANGUAGE_TOKENS.has(token.toLowerCase())) return token;
+    }
+  }
+  return null;
+}
+
+/**
+ * Every ISBN a release names, in both spellings where a printed one has two.
+ *
+ * A request holds the canonical ISBN-13 - `canonicalizeBookRequestIsbn` converts a 10 on the way
+ * in - while catalogues that predate the 13 print the 10 the book was published under. Without the
+ * conversion the two never compare equal, so the decisive sixty-one-point `isbnMatch` was missed
+ * on exactly the sources most likely to state an ISBN at all. Checksum-gated: an unvalidated
+ * ten-digit run is as likely to be an ASIN or a catalogue number, and converting one would
+ * manufacture a 13 that matches a different book.
+ */
+function extractIsbns(text: string): string[] {
+  const matches = text.match(/\b(?:97[89][- ]?)?(?:\d[- ]?){9}[\dxX]\b/g) ?? [];
+  const found = new Set<string>();
+
+  for (const match of matches) {
+    const isbn = normalizeIsbn(match);
+    if (isbn.length !== 10 && isbn.length !== 13) continue;
+    found.add(isbn);
+    if (isbn.length === 10 && isValidBookRequestIsbn10(isbn)) found.add(bookRequestIsbn10To13(isbn));
+  }
+
+  return [...found];
+}
+
+function formatBytes(bytes: number): string {
+  if (bytes >= 1024 * MEGABYTE) return `${(bytes / (1024 * MEGABYTE)).toFixed(1)} GB`;
+  if (bytes >= MEGABYTE) return `${Math.round(bytes / MEGABYTE)} MB`;
+  return `${Math.round(bytes / 1024)} KB`;
+}
+
+function round(value: number): number {
+  return Math.round(value);
+}
diff --git a/server/src/modules/book-request/indexers/search-text.test.ts b/server/src/modules/book-request/indexers/search-text.test.ts
new file mode 100644
index 000000000..b7c48998f
--- /dev/null
+++ b/server/src/modules/book-request/indexers/search-text.test.ts
@@ -0,0 +1,30 @@
+import type { ReleaseQuery } from './indexer-adapter';
+import { buildSearchText } from './search-text';
+
+function query(overrides: Partial<ReleaseQuery> = {}): ReleaseQuery {
+  return { title: 'Dune', author: 'Frank Herbert', isbn13: null, isbn13s: [], mediaKind: 'ebook', language: null, limit: 25, ...overrides };
+}
+
+describe('buildSearchText', () => {
+  it('joins the title and the author', () => {
+    expect(buildSearchText(query())).toBe('Dune Frank Herbert');
+  });
+
+  it('searches without an author when the request names none', () => {
+    expect(buildSearchText(query({ author: null }))).toBe('Dune');
+  });
+
+  /**
+   * Measured against MyAnonaMouse: dropping "(Unabridged)" is the difference between six releases
+   * and none, and a metadata provider puts it on nearly every audiobook.
+   */
+  it('drops the edition qualifier a metadata provider appends', () => {
+    expect(buildSearchText(query({ title: 'Project Hail Mary (Unabridged)', author: 'Andy Weir' }))).toBe('Project Hail Mary Andy Weir');
+    expect(buildSearchText(query({ title: 'Dune [Deluxe Edition]', author: null }))).toBe('Dune');
+    expect(buildSearchText(query({ title: 'Dune (2005) (Retail)', author: null }))).toBe('Dune');
+  });
+
+  it('keeps the original title when it is nothing but a qualifier', () => {
+    expect(buildSearchText(query({ title: '(Unabridged)', author: null }))).toBe('(Unabridged)');
+  });
+});
diff --git a/server/src/modules/book-request/indexers/search-text.ts b/server/src/modules/book-request/indexers/search-text.ts
new file mode 100644
index 000000000..0ca58d41c
--- /dev/null
+++ b/server/src/modules/book-request/indexers/search-text.ts
@@ -0,0 +1,26 @@
+import type { ReleaseQuery } from './indexer-adapter';
+
+/**
+ * The text handed to an indexer's keyword search.
+ *
+ * A request's title comes from a metadata provider, which routinely appends an edition qualifier
+ * in brackets: "Project Hail Mary (Unabridged)", "Dune (Deluxe Edition)". Release names on a
+ * tracker carry no such thing, and a tracker that ANDs its terms answers with nothing at all
+ * rather than a worse match. Measured against MyAnonaMouse: "Project Hail Mary Andy Weir" finds
+ * six releases, and the same query with "(Unabridged)" finds zero.
+ *
+ * The author is included because scene names carry it and it narrows hard; a tracker that
+ * tokenizes loosely simply ranks it lower rather than dropping it.
+ */
+export function buildSearchText(query: ReleaseQuery): string {
+  return [stripEditionQualifiers(query.title), query.author].filter(Boolean).join(' ').replace(/\s+/g, ' ').trim();
+}
+
+/** Falls back to the original title, so a wholly bracketed one does not search for nothing. */
+function stripEditionQualifiers(title: string): string {
+  const stripped = title
+    .replace(/[([{][^)\]}]*[)\]}]/g, ' ')
+    .replace(/\s+/g, ' ')
+    .trim();
+  return stripped.length > 0 ? stripped : title.trim();
+}
diff --git a/server/src/modules/book-request/request-credential.service.test.ts b/server/src/modules/book-request/request-credential.service.test.ts
new file mode 100644
index 000000000..e035780d4
--- /dev/null
+++ b/server/src/modules/book-request/request-credential.service.test.ts
@@ -0,0 +1,53 @@
+import { BadRequestException } from '@nestjs/common';
+import { randomBytes } from 'crypto';
+
+import { RequestCredentialService } from './request-credential.service';
+
+function makeService(key: string | undefined) {
+  return new RequestCredentialService({ get: () => key } as never);
+}
+
+const VALID_KEY = randomBytes(32).toString('hex');
+
+describe('RequestCredentialService', () => {
+  it('round-trips a secret when the key is configured', () => {
+    const service = makeService(VALID_KEY);
+    const ciphertext = service.encrypt('hunter2');
+
+    expect(service.isConfigured()).toBe(true);
+    expect(ciphertext).not.toContain('hunter2');
+    expect(service.decrypt(ciphertext)).toBe('hunter2');
+  });
+
+  it('produces a different ciphertext each time, so equal passwords are not visibly equal', () => {
+    const service = makeService(VALID_KEY);
+    expect(service.encrypt('hunter2')).not.toBe(service.encrypt('hunter2'));
+  });
+
+  /**
+   * The email and migration services return plaintext when their key is unset. Copying that here
+   * would store tracker and seedbox passwords in the clear, so this refuses instead.
+   */
+  it('refuses to encrypt without a key rather than storing plaintext', () => {
+    const service = makeService(undefined);
+    expect(service.isConfigured()).toBe(false);
+    expect(() => service.encrypt('hunter2')).toThrow(BadRequestException);
+  });
+
+  it('treats a malformed key as no key at all', () => {
+    const service = makeService('too-short');
+    expect(service.isConfigured()).toBe(false);
+    expect(() => service.encrypt('hunter2')).toThrow(BadRequestException);
+  });
+
+  it('refuses to decrypt without a key', () => {
+    expect(() => makeService(undefined).decrypt('anything')).toThrow(BadRequestException);
+  });
+
+  it('surfaces a rotated key as a clear refusal rather than a decode crash', () => {
+    const ciphertext = makeService(VALID_KEY).encrypt('hunter2');
+    const rotated = makeService(randomBytes(32).toString('hex'));
+
+    expect(() => rotated.decrypt(ciphertext)).toThrow(BadRequestException);
+  });
+});
diff --git a/server/src/modules/book-request/request-credential.service.ts b/server/src/modules/book-request/request-credential.service.ts
new file mode 100644
index 000000000..373c6e6be
--- /dev/null
+++ b/server/src/modules/book-request/request-credential.service.ts
@@ -0,0 +1,83 @@
+import { BadRequestException, Injectable, Logger } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { createCipheriv, createDecipheriv, randomBytes } from 'crypto';
+
+const ALGORITHM = 'aes-256-gcm';
+const IV_LENGTH = 12;
+const TAG_LENGTH = 16;
+const KEY_HEX_LENGTH = 64;
+
+/**
+ * Shared by every part of this feature that holds a third-party secret, so the "refuse without a
+ * key" rule lives in exactly one place.
+ *
+ * `EmailEncryptionService` and `MigrationEncryptionService` both return plaintext when their key
+ * is unset. That is deliberately not copied here: a tracker or seedbox password stored in the
+ * clear is a worse outcome than a settings page that will not save.
+ */
+@Injectable()
+export class RequestCredentialService {
+  private readonly logger = new Logger(RequestCredentialService.name);
+  private readonly key: Buffer | null;
+
+  constructor(config: ConfigService) {
+    const raw = config.get<string>('bookRequest.encryptionKey') ?? '';
+    if (raw.length === KEY_HEX_LENGTH && /^[0-9a-f]+$/i.test(raw)) {
+      this.key = Buffer.from(raw, 'hex');
+    } else {
+      if (raw.length > 0) {
+        this.logger.warn('BOOK_REQUEST_ENCRYPTION_KEY must be a 64-char hex string (32 bytes). Credentials cannot be stored.');
+      }
+      this.key = null;
+    }
+  }
+
+  isConfigured(): boolean {
+    return this.key !== null;
+  }
+
+  encrypt(plaintext: string): string {
+    if (!this.key) {
+      throw new BadRequestException({
+        message: 'Set BOOK_REQUEST_ENCRYPTION_KEY before saving credentials. Generate one with: openssl rand -hex 32',
+        errorCode: 'REQUEST_ENCRYPTION_KEY_MISSING',
+      });
+    }
+
+    const iv = randomBytes(IV_LENGTH);
+    const cipher = createCipheriv(ALGORITHM, this.key, iv);
+    const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
+    const tag = cipher.getAuthTag();
+
+    return Buffer.concat([iv, tag, encrypted]).toString('base64');
+  }
+
+  /**
+   * A key that has been rotated or removed leaves rows nobody can read. That surfaces as a
+   * refusal to use the client rather than a decode crash halfway through a download tick.
+   */
+  decrypt(ciphertext: string): string {
+    if (!this.key) {
+      throw new BadRequestException({
+        message: 'BOOK_REQUEST_ENCRYPTION_KEY is not set, so stored credentials cannot be read',
+        errorCode: 'REQUEST_ENCRYPTION_KEY_MISSING',
+      });
+    }
+
+    const buf = Buffer.from(ciphertext, 'base64');
+    const iv = buf.subarray(0, IV_LENGTH);
+    const tag = buf.subarray(IV_LENGTH, IV_LENGTH + TAG_LENGTH);
+    const encrypted = buf.subarray(IV_LENGTH + TAG_LENGTH);
+
+    try {
+      const decipher = createDecipheriv(ALGORITHM, this.key, iv);
+      decipher.setAuthTag(tag);
+      return Buffer.concat([decipher.update(encrypted), decipher.final()]).toString('utf8');
+    } catch {
+      throw new BadRequestException({
+        message: 'Stored credentials could not be decrypted. BOOK_REQUEST_ENCRYPTION_KEY may have changed.',
+        errorCode: 'REQUEST_ENCRYPTION_KEY_CHANGED',
+      });
+    }
+  }
+}
diff --git a/server/src/modules/file-write/formats/cbx/cb7-format-writer.test.ts b/server/src/modules/file-write/formats/cbx/cb7-format-writer.test.ts
index 0789c4c6f..ce7c9d82e 100644
--- a/server/src/modules/file-write/formats/cbx/cb7-format-writer.test.ts
+++ b/server/src/modules/file-write/formats/cbx/cb7-format-writer.test.ts
@@ -27,6 +27,7 @@ vi.mock('crypto', async () => {
 
 vi.mock('../../../../common/sevenzip', () => ({
   getSevenZip: vi.fn(),
+  createSevenZipTempId: (prefix: string) => `${prefix}_test`,
 }));
 
 vi.mock('./comic-info-builder', () => ({
diff --git a/server/src/modules/library/library.repository.ts b/server/src/modules/library/library.repository.ts
index b53c2886b..a13175032 100644
--- a/server/src/modules/library/library.repository.ts
+++ b/server/src/modules/library/library.repository.ts
@@ -1,5 +1,5 @@
 import { Inject, Injectable } from '@nestjs/common';
-import { and, eq, getTableColumns, inArray, isNotNull, sql } from 'drizzle-orm';
+import { and, eq, getTableColumns, inArray, isNotNull, or, sql } from 'drizzle-orm';
 import { NodePgDatabase } from 'drizzle-orm/node-postgres';
 import type { AccessLevel, ContentFilterRules, LibraryStats } from '@bookorbit/types';
 
@@ -227,6 +227,24 @@ export class LibraryRepository {
     return stats;
   }
 
+  /**
+   * Which of these users can open this library, answered in one query rather than one per user.
+   *
+   * A superuser holds no row in the access table and reaches every library anyway, so the flag is
+   * read alongside the grants: filtering on grants alone would report an administrator as having
+   * access to nothing.
+   */
+  findUserIdsWithAccess(libraryId: number, userIds: number[]) {
+    return this.db
+      .select({ id: schema.users.id })
+      .from(schema.users)
+      .leftJoin(
+        schema.userLibraryAccess,
+        and(eq(schema.userLibraryAccess.userId, schema.users.id), eq(schema.userLibraryAccess.libraryId, libraryId)),
+      )
+      .where(and(inArray(schema.users.id, userIds), or(eq(schema.users.isSuperuser, true), isNotNull(schema.userLibraryAccess.userId))));
+  }
+
   async hasUserAccess(userId: number, libraryId: number): Promise<boolean> {
     const row = await this.db.query.userLibraryAccess.findFirst({
       where: and(eq(schema.userLibraryAccess.userId, userId), eq(schema.userLibraryAccess.libraryId, libraryId)),
diff --git a/server/src/modules/library/library.service.ts b/server/src/modules/library/library.service.ts
index f54d0ffc3..ee3f814ff 100644
--- a/server/src/modules/library/library.service.ts
+++ b/server/src/modules/library/library.service.ts
@@ -92,6 +92,17 @@ export class LibraryService {
     }));
   }
 
+  /**
+   * Which of these users can open this library. Callers that hold user ids rather than whole
+   * users - a notifier resolving one link per recipient, for instance - cannot ask
+   * `verifyUserAccess`, which needs the superuser flag handed to it.
+   */
+  async findUserIdsWithAccess(libraryId: number, userIds: number[]): Promise<Set<number>> {
+    if (userIds.length === 0) return new Set();
+    const rows = await this.libraryRepo.findUserIdsWithAccess(libraryId, userIds);
+    return new Set(rows.map(({ id }) => id));
+  }
+
   async findAccessibleLibraryIds(user: RequestUser): Promise<number[]> {
     const ids = user.isSuperuser ? await this.libraryRepo.findAllIds() : await this.libraryRepo.findAccessibleIdsForUser(user.id);
     return ids.map(({ id }) => id);
diff --git a/server/src/modules/metadata-fetch/candidate-agreement.ts b/server/src/modules/metadata-fetch/candidate-agreement.ts
index 2b7a67617..75cfbb4f8 100644
--- a/server/src/modules/metadata-fetch/candidate-agreement.ts
+++ b/server/src/modules/metadata-fetch/candidate-agreement.ts
@@ -3,7 +3,7 @@ import { MetadataCandidate } from '@bookorbit/types';
 import { matchableTitle, scoreCandidate } from './candidate-relevance';
 import { candidateHasNormalizedIsbn, candidatesShareIsbn, normalizeMetadataIsbn } from './isbn-match';
 import { MetadataSearchParams } from './providers/metadata-search-params';
-import { scoreTitleMatch, shareSignificantToken } from './title-match';
+import { scoreTitleMatch, shareSignificantToken } from '../../common/text-match/title-match';
 
 /**
  * How closely two providers' titles must match before their records are treated as the same book.
diff --git a/server/src/modules/metadata-fetch/candidate-relevance.test.ts b/server/src/modules/metadata-fetch/candidate-relevance.test.ts
index 2b6b52137..14c00eda7 100644
--- a/server/src/modules/metadata-fetch/candidate-relevance.test.ts
+++ b/server/src/modules/metadata-fetch/candidate-relevance.test.ts
@@ -92,6 +92,14 @@ describe('candidate-relevance', () => {
       expect(result[0].authors).toContain('Andy Weir');
     });
 
+    it('keeps only matching authors for an author-only search', () => {
+      const candidates = [candidate('Dune', 'Frank Herbert'), candidate('The Hobbit', 'J.R.R. Tolkien')];
+
+      const result = filterAndRank(candidates, { author: 'Frank Herbert' });
+
+      expect(result.map((entry) => entry.title)).toEqual(['Dune']);
+    });
+
     it('drops candidates with zero score', () => {
       const candidates = [candidate('Unrelated Book')];
       const params: MetadataSearchParams = { title: 'Different Title' };
diff --git a/server/src/modules/metadata-fetch/candidate-relevance.ts b/server/src/modules/metadata-fetch/candidate-relevance.ts
index 100c5eda5..450275a05 100644
--- a/server/src/modules/metadata-fetch/candidate-relevance.ts
+++ b/server/src/modules/metadata-fetch/candidate-relevance.ts
@@ -2,7 +2,7 @@ import { MetadataCandidate } from '@bookorbit/types';
 
 import { candidateHasNormalizedIsbn, normalizeMetadataIsbn } from './isbn-match';
 import { MetadataSearchParams } from './providers/metadata-search-params';
-import { normalizeTitleText, scoreTitleMatch, shareSignificantToken } from './title-match';
+import { normalizeTitleText, scoreTitleMatch, shareSignificantToken } from '../../common/text-match/title-match';
 
 const DEFAULT_LIMIT = 5;
 
@@ -60,9 +60,9 @@ export function scoreCandidate(candidate: MetadataCandidate, params: MetadataSea
     score += scoreTitleMatch(params.title, matchable);
   }
 
-  // Author only boosts when there is already a positive title signal.
-  // A matching author alone (e.g. a different book by the same author) is not enough to keep a result.
-  if (score > 0 && params.author && candidate.authors?.length) {
+  // When a title was supplied, author remains a boost and cannot rescue an unrelated title.
+  // Without a title, an exact or containing author match is strong enough to stand on its own.
+  if ((!params.title || score > 0) && params.author && candidate.authors?.length) {
     score += scoreAuthor(params.author, candidate.authors);
   }
 
diff --git a/server/src/modules/metadata-fetch/dto/metadata-search.dto.test.ts b/server/src/modules/metadata-fetch/dto/metadata-search.dto.test.ts
index a809b1dbf..e4fda64d9 100644
--- a/server/src/modules/metadata-fetch/dto/metadata-search.dto.test.ts
+++ b/server/src/modules/metadata-fetch/dto/metadata-search.dto.test.ts
@@ -13,18 +13,10 @@ async function validateInput(input: Record<string, unknown>) {
 }
 
 describe('MetadataSearchDto', () => {
-  it('requires at least one of bookId, title, or isbn', async () => {
+  it('accepts an author-only search', async () => {
     const { errors } = await validateInput({ author: 'Frank Herbert' });
 
-    expect(errors).toEqual(
-      expect.arrayContaining([
-        expect.objectContaining({
-          constraints: expect.objectContaining({
-            atLeastOneSearchTerm: 'At least one of bookId, title, or isbn must be provided',
-          }),
-        }),
-      ]),
-    );
+    expect(errors).toHaveLength(0);
   });
 
   it('accepts title-only searches but rejects blank title values', async () => {
@@ -36,7 +28,7 @@ describe('MetadataSearchDto', () => {
       expect.arrayContaining([
         expect.objectContaining({
           constraints: expect.objectContaining({
-            atLeastOneSearchTerm: 'At least one of bookId, title, or isbn must be provided',
+            atLeastOneSearchTerm: 'At least one of bookId, title, author, or isbn must be provided',
           }),
         }),
       ]),
diff --git a/server/src/modules/metadata-fetch/dto/metadata-search.dto.ts b/server/src/modules/metadata-fetch/dto/metadata-search.dto.ts
index f4e55614d..f1224269e 100644
--- a/server/src/modules/metadata-fetch/dto/metadata-search.dto.ts
+++ b/server/src/modules/metadata-fetch/dto/metadata-search.dto.ts
@@ -2,6 +2,7 @@ import { Transform, Type } from 'class-transformer';
 import {
   IsBoolean,
   IsEnum,
+  IsIn,
   IsInt,
   Min,
   IsOptional,
@@ -14,17 +15,18 @@ import {
   ValidatorConstraintInterface,
 } from 'class-validator';
 
-import { MetadataProviderKey } from '@bookorbit/types';
+import { CONCRETE_BOOK_MEDIA_KINDS, MetadataProviderKey } from '@bookorbit/types';
+import type { ConcreteBookMediaKind } from '@bookorbit/types';
 
 @ValidatorConstraint({ name: 'atLeastOneSearchTerm', async: false })
 class AtLeastOneSearchTermConstraint implements ValidatorConstraintInterface {
   validate(_: unknown, args: ValidationArguments): boolean {
     const obj = args.object as MetadataSearchDto;
-    return !!(obj.bookId || obj.title?.trim() || obj.isbn?.trim());
+    return !!(obj.bookId || obj.title?.trim() || obj.author?.trim() || obj.isbn?.trim());
   }
 
   defaultMessage(): string {
-    return 'At least one of bookId, title, or isbn must be provided';
+    return 'At least one of bookId, title, author, or isbn must be provided';
   }
 }
 
@@ -76,6 +78,14 @@ export class MetadataSearchDto {
   @IsBoolean()
   isAudiobook?: boolean;
 
+  /**
+   * The medium being searched for. Narrows the provider set to the ones that serve it, so an
+   * e-book search is not answered with comic issues. `isAudiobook` follows from it when unset.
+   */
+  @IsOptional()
+  @IsIn(CONCRETE_BOOK_MEDIA_KINDS)
+  mediaKind?: ConcreteBookMediaKind;
+
   @IsOptional()
   @Transform(({ value }: { value: unknown }) => {
     if (typeof value === 'string') {
diff --git a/server/src/modules/metadata-fetch/isbn-match.ts b/server/src/modules/metadata-fetch/isbn-match.ts
index 1597cc4f2..b469c3fd6 100644
--- a/server/src/modules/metadata-fetch/isbn-match.ts
+++ b/server/src/modules/metadata-fetch/isbn-match.ts
@@ -1,10 +1,8 @@
 import { MetadataCandidate } from '@bookorbit/types';
 
-import { normalizeIsbn } from '../metadata/lib/isbn-detect';
+import { normalizeMetadataIsbn } from '../../common/text-match/isbn-normalize';
 
-export function normalizeMetadataIsbn(value: string | null | undefined): string {
-  return value ? normalizeIsbn(value) : '';
-}
+export { normalizeMetadataIsbn };
 
 export function candidateHasNormalizedIsbn(candidate: MetadataCandidate, normalizedIsbn: string): boolean {
   return (
diff --git a/server/src/modules/metadata-fetch/metadata-fetch.controller.test.ts b/server/src/modules/metadata-fetch/metadata-fetch.controller.test.ts
index ce5135fd3..9ac190909 100644
--- a/server/src/modules/metadata-fetch/metadata-fetch.controller.test.ts
+++ b/server/src/modules/metadata-fetch/metadata-fetch.controller.test.ts
@@ -58,6 +58,7 @@ describe('MetadataFetchController', () => {
 
     registry = {
       all: vi.fn(),
+      keysForMediaKind: vi.fn(),
     } as unknown as Mocked<ProviderRegistry>;
 
     providerConfig = {
@@ -66,8 +67,10 @@ describe('MetadataFetchController', () => {
     } as unknown as Mocked<ProviderConfigService>;
 
     const resolver = new MetadataPreferenceResolver();
+    const defaultPreferences = resolver.getDefaultPreferences();
     metadataPreferences = {
-      getGlobal: vi.fn().mockResolvedValue(resolver.getDefaultPreferences()),
+      getGlobal: vi.fn().mockResolvedValue(defaultPreferences),
+      getForLibrary: vi.fn().mockResolvedValue({ libraryId: 9, overrides: null, effective: defaultPreferences }),
     } as unknown as Mocked<MetadataPreferencesService>;
 
     throttleTracker = {
@@ -99,8 +102,8 @@ describe('MetadataFetchController', () => {
     ] as never);
 
     await expect(controller.listProviders({}, user)).resolves.toEqual([
-      { key: MetadataProviderKey.GOOGLE, label: 'Google Books', identifiable: true },
-      { key: MetadataProviderKey.OPEN_LIBRARY, label: 'OpenLibrary', identifiable: false },
+      { key: MetadataProviderKey.GOOGLE, label: 'Google Books', identifiable: true, coverPriority: 4 },
+      { key: MetadataProviderKey.OPEN_LIBRARY, label: 'OpenLibrary', identifiable: false, coverPriority: 5 },
     ]);
   });
 
@@ -117,10 +120,29 @@ describe('MetadataFetchController', () => {
 
     expect(service.getAccessibleBookLibraryId).toHaveBeenCalledWith(12, user);
     expect(pipeline.getEffectiveProviderKeys).toHaveBeenCalledWith(9);
+    expect(metadataPreferences.getForLibrary).toHaveBeenCalledWith(9);
     expect(result).toEqual([
-      { key: MetadataProviderKey.GOOGLE, label: 'Google Books', identifiable: true, selectedByFieldRules: true },
-      { key: MetadataProviderKey.OPEN_LIBRARY, label: 'OpenLibrary', identifiable: false, selectedByFieldRules: false },
-      { key: MetadataProviderKey.KOBO, label: 'Kobo', identifiable: true, selectedByFieldRules: true },
+      { key: MetadataProviderKey.GOOGLE, label: 'Google Books', identifiable: true, selectedByFieldRules: true, coverPriority: 4 },
+      { key: MetadataProviderKey.OPEN_LIBRARY, label: 'OpenLibrary', identifiable: false, selectedByFieldRules: false, coverPriority: 5 },
+      { key: MetadataProviderKey.KOBO, label: 'Kobo', identifiable: true, selectedByFieldRules: true, coverPriority: 2 },
+    ]);
+  });
+
+  it('exposes the configured Cover field order independently of registry order', async () => {
+    const resolver = new MetadataPreferenceResolver();
+    const preferences = resolver.getDefaultPreferences();
+    preferences.fields.cover.providers = [MetadataProviderKey.OPEN_LIBRARY, MetadataProviderKey.GOOGLE];
+    metadataPreferences.getGlobal.mockResolvedValue(preferences);
+    registry.all.mockReturnValue([
+      { key: MetadataProviderKey.GOOGLE, label: 'Google Books', identifiable: true },
+      { key: MetadataProviderKey.OPEN_LIBRARY, label: 'OpenLibrary', identifiable: false },
+    ] as never);
+
+    const result = await controller.listProviders({}, user);
+
+    expect(result).toEqual([
+      { key: MetadataProviderKey.GOOGLE, label: 'Google Books', identifiable: true, coverPriority: 1 },
+      { key: MetadataProviderKey.OPEN_LIBRARY, label: 'OpenLibrary', identifiable: false, coverPriority: 0 },
     ]);
   });
 
@@ -152,10 +174,13 @@ describe('MetadataFetchController', () => {
         title: 'Dune',
         author: 'Frank Herbert',
         isbn: '9780441172719',
+        seriesName: undefined,
+        seriesIndex: undefined,
         existingProviderIds: { [MetadataProviderKey.GOOGLE]: 'vol-1' },
         titleIsExplicitQuery: true,
         isAudiobook: false,
         includeAudiobookProviders: false,
+        validateCoverPlaceholders: true,
       },
       [MetadataProviderKey.GOOGLE, MetadataProviderKey.OPEN_LIBRARY],
     );
@@ -215,10 +240,13 @@ describe('MetadataFetchController', () => {
         title: 'Dune',
         author: undefined,
         isbn: undefined,
+        seriesName: undefined,
+        seriesIndex: undefined,
         existingProviderIds: {},
         titleIsExplicitQuery: true,
         isAudiobook: false,
         includeAudiobookProviders: true,
+        validateCoverPlaceholders: true,
       },
       [
         MetadataProviderKey.GOOGLE,
@@ -421,6 +449,52 @@ describe('MetadataFetchController', () => {
     ]);
   });
 
+  it('narrows the provider set to the ones serving the requested medium', async () => {
+    registry.keysForMediaKind.mockReturnValue([MetadataProviderKey.COMICVINE]);
+    service.search.mockReturnValue(of({ provider: MetadataProviderKey.COMICVINE, providerId: '4000-1', title: 'Saga #1' }));
+
+    const stream = await controller.stream({ title: 'Saga', mediaKind: 'comic' }, user);
+    await firstValueFrom(stream.pipe(toArray()));
+
+    expect(registry.keysForMediaKind).toHaveBeenCalledWith(expect.arrayContaining([MetadataProviderKey.GOOGLE]), 'comic');
+    expect(service.search).toHaveBeenCalledWith(expect.objectContaining({ title: 'Saga', isAudiobook: false }), [MetadataProviderKey.COMICVINE]);
+  });
+
+  it('reads the medium as the audiobook signal, so an audiobook provider in the list cannot flip an ebook search', async () => {
+    registry.keysForMediaKind.mockReturnValue([MetadataProviderKey.GOOGLE]);
+    service.search.mockReturnValue(of({ provider: MetadataProviderKey.GOOGLE, providerId: 'g1', title: 'Dune' }));
+
+    const stream = await controller.stream(
+      { title: 'Dune', mediaKind: 'ebook', providers: [MetadataProviderKey.GOOGLE, MetadataProviderKey.AUDIBLE] },
+      user,
+    );
+    await firstValueFrom(stream.pipe(toArray()));
+
+    expect(service.search).toHaveBeenCalledWith(expect.objectContaining({ title: 'Dune', isAudiobook: false, includeAudiobookProviders: false }), [
+      MetadataProviderKey.GOOGLE,
+    ]);
+  });
+
+  it('keeps an explicit isAudiobook flag ahead of the medium it was sent with', async () => {
+    registry.keysForMediaKind.mockReturnValue([MetadataProviderKey.GOOGLE]);
+    service.search.mockReturnValue(of({ provider: MetadataProviderKey.GOOGLE, providerId: 'g2', title: 'Dune' }));
+
+    const stream = await controller.stream({ title: 'Dune', mediaKind: 'ebook', isAudiobook: true }, user);
+    await firstValueFrom(stream.pipe(toArray()));
+
+    expect(service.search).toHaveBeenCalledWith(expect.objectContaining({ isAudiobook: true }), [MetadataProviderKey.GOOGLE]);
+  });
+
+  it('leaves the provider set untouched when no medium is stated', async () => {
+    service.search.mockReturnValue(of({ provider: MetadataProviderKey.GOOGLE, providerId: 'g3', title: 'Dune' }));
+
+    const stream = await controller.stream({ title: 'Dune', providers: [MetadataProviderKey.GOOGLE] }, user);
+    await firstValueFrom(stream.pipe(toArray()));
+
+    expect(registry.keysForMediaKind).not.toHaveBeenCalled();
+    expect(service.search).toHaveBeenCalledWith(expect.anything(), [MetadataProviderKey.GOOGLE]);
+  });
+
   it('infers audiobook search when audiobook providers are requested', async () => {
     service.search.mockReturnValue(of({ provider: MetadataProviderKey.AUDIBLE, providerId: 'B001', title: 'Audio Result' }));
 
diff --git a/server/src/modules/metadata-fetch/metadata-fetch.controller.ts b/server/src/modules/metadata-fetch/metadata-fetch.controller.ts
index cac02bcf1..098de0a9a 100644
--- a/server/src/modules/metadata-fetch/metadata-fetch.controller.ts
+++ b/server/src/modules/metadata-fetch/metadata-fetch.controller.ts
@@ -59,15 +59,16 @@ export class MetadataFetchController {
   async listProviders(@Query() dto: ListMetadataProvidersDto, @CurrentUser() user: RequestUser): Promise<MetadataProviderInfo[]> {
     if (dto.bookId) {
       const libraryId = await this.metadataFetchService.getAccessibleBookLibraryId(dto.bookId, user);
-      const [enabledProviderKeys, fieldRuleProviderKeys] = await Promise.all([
+      const [enabledProviderKeys, fieldRuleProviderKeys, libraryPreferences] = await Promise.all([
         this.resolveEnabledProviderKeys(),
         this.resolveFieldRuleProviderKeys(undefined, libraryId),
+        this.metadataPreferences.getForLibrary(libraryId),
       ]);
-      return this.providerInfosForKeys(enabledProviderKeys, new Set(fieldRuleProviderKeys));
+      return this.providerInfosForKeys(enabledProviderKeys, new Set(fieldRuleProviderKeys), libraryPreferences.effective.fields.cover.providers);
     }
 
-    const providerKeys = await this.resolveEnabledProviderKeys();
-    return this.providerInfosForKeys(providerKeys);
+    const [providerKeys, preferences] = await Promise.all([this.resolveEnabledProviderKeys(), this.metadataPreferences.getGlobal()]);
+    return this.providerInfosForKeys(providerKeys, undefined, preferences.fields.cover.providers);
   }
 
   @Get('providers/runtime')
@@ -84,17 +85,20 @@ export class MetadataFetchController {
   async stream(@Query() dto: MetadataSearchDto, @CurrentUser() user: RequestUser): Promise<Observable<MessageEvent>> {
     const storedContext = dto.bookId ? await this.metadataFetchService.getStoredProviderContext(dto.bookId, user) : null;
     const existingProviderIds = storedContext?.providerIds ?? {};
-    const [preferences, providerKeys] = await Promise.all([
+    const [preferences, enabledProviderKeys] = await Promise.all([
       this.metadataPreferences.getGlobal(),
       this.resolveSearchProviderKeys(dto.providers, storedContext?.libraryId),
     ]);
+    // A stated medium describes the book, so it settles which providers can answer at all. It
+    // narrows the caller's provider list rather than widening it, and never adds a disabled one.
+    const providerKeys = dto.mediaKind ? this.registry.keysForMediaKind(enabledProviderKeys, dto.mediaKind) : enabledProviderKeys;
     const requestedAudiobookProvider = (dto.providers ?? []).some(isAudiobookProvider);
     const onlyAudiobookProviders = providerKeys.length > 0 && providerKeys.every(isAudiobookProvider);
     const inferredIsAudiobook =
       requestedAudiobookProvider ||
       onlyAudiobookProviders ||
       Boolean(existingProviderIds[MetadataProviderKey.AUDIBLE] || existingProviderIds[MetadataProviderKey.LIBROFM]);
-    const isAudiobook = dto.isAudiobook ?? inferredIsAudiobook;
+    const isAudiobook = dto.isAudiobook ?? (dto.mediaKind ? dto.mediaKind === 'audiobook' : inferredIsAudiobook);
 
     const searchTitle = normalizeSearchTitle(dto.title);
     const params: MetadataSearchParams = {
@@ -107,6 +111,7 @@ export class MetadataFetchController {
       existingProviderIds,
       isAudiobook,
       includeAudiobookProviders: isAudiobook || providerKeys.some(isAudiobookProvider),
+      validateCoverPlaceholders: true,
     };
 
     const genreOptions = preferences.options?.genres;
@@ -166,16 +171,25 @@ export class MetadataFetchController {
     return this.resolveFieldRuleProviderKeys(undefined, libraryId);
   }
 
-  private providerInfosForKeys(providerKeys: MetadataProviderKey[], fieldRuleProviderKeys?: Set<MetadataProviderKey>): MetadataProviderInfo[] {
+  private providerInfosForKeys(
+    providerKeys: MetadataProviderKey[],
+    fieldRuleProviderKeys?: Set<MetadataProviderKey>,
+    coverProviderKeys: MetadataProviderKey[] = [],
+  ): MetadataProviderInfo[] {
     const keySet = new Set(providerKeys);
+    const coverPriorities = new Map(coverProviderKeys.map((key, index) => [key, index]));
     return this.registry
       .all()
       .filter((p) => keySet.has(p.key))
-      .map((p) => ({
-        key: p.key,
-        label: p.label,
-        identifiable: p.identifiable,
-        ...(fieldRuleProviderKeys ? { selectedByFieldRules: fieldRuleProviderKeys.has(p.key) } : {}),
-      }));
+      .map((p) => {
+        const coverPriority = coverPriorities.get(p.key);
+        return {
+          key: p.key,
+          label: p.label,
+          identifiable: p.identifiable,
+          ...(fieldRuleProviderKeys ? { selectedByFieldRules: fieldRuleProviderKeys.has(p.key) } : {}),
+          ...(coverPriority !== undefined ? { coverPriority } : {}),
+        };
+      });
   }
 }
diff --git a/server/src/modules/metadata-fetch/metadata-fetch.service.test.ts b/server/src/modules/metadata-fetch/metadata-fetch.service.test.ts
index 8460f1ec5..fa55456bc 100644
--- a/server/src/modules/metadata-fetch/metadata-fetch.service.test.ts
+++ b/server/src/modules/metadata-fetch/metadata-fetch.service.test.ts
@@ -496,6 +496,39 @@ describe('MetadataFetchService', () => {
     expect(statusesOf(events)).toEqual([{ provider: MetadataProviderKey.COMICVINE, outcome: 'throttled' }]);
   });
 
+  it('keeps the candidates a throttled provider had already assembled, and still records the cooldown', async () => {
+    const scraped = candidate(MetadataProviderKey.GOODREADS, '222794853', 'Dune');
+    const throttled: MetadataProvider = {
+      key: MetadataProviderKey.GOODREADS,
+      label: 'Goodreads',
+      identifiable: false,
+      search: vi.fn().mockRejectedValue(new ProviderThrottleError(undefined, 'bot challenge', [scraped])),
+    };
+    registry.select.mockReturnValue([throttled]);
+
+    const events = await firstValueFrom(service.search({ title: 'Dune' }).pipe(toArray()));
+
+    expect(events.filter(isCandidateEvent).map((event) => event.candidate)).toEqual([scraped]);
+    expect(statusesOf(events)).toEqual([{ provider: MetadataProviderKey.GOODREADS, outcome: 'throttled' }]);
+    expect(throttleTracker.record).toHaveBeenCalledWith(MetadataProviderKey.GOODREADS, undefined);
+  });
+
+  it('holds salvaged candidates to the same relevance bar as candidates from a provider that finished', async () => {
+    const unrelated = candidate(MetadataProviderKey.GOODREADS, '247090873', 'A Wholly Different Book');
+    const throttled: MetadataProvider = {
+      key: MetadataProviderKey.GOODREADS,
+      label: 'Goodreads',
+      identifiable: false,
+      search: vi.fn().mockRejectedValue(new ProviderThrottleError(undefined, 'bot challenge', [unrelated])),
+    };
+    registry.select.mockReturnValue([throttled]);
+
+    const events = await firstValueFrom(service.search({ title: 'Dune' }).pipe(toArray()));
+
+    expect(events.filter(isCandidateEvent)).toEqual([]);
+    expect(statusesOf(events)).toEqual([{ provider: MetadataProviderKey.GOODREADS, outcome: 'throttled' }]);
+  });
+
   it('reports a provider that errored, alongside the candidates the others found', async () => {
     const failing: MetadataProvider = {
       key: MetadataProviderKey.GOODREADS,
diff --git a/server/src/modules/metadata-fetch/metadata-fetch.service.ts b/server/src/modules/metadata-fetch/metadata-fetch.service.ts
index 0153e6d31..917c9faba 100644
--- a/server/src/modules/metadata-fetch/metadata-fetch.service.ts
+++ b/server/src/modules/metadata-fetch/metadata-fetch.service.ts
@@ -150,10 +150,14 @@ export class MetadataFetchService {
     } catch (error) {
       if (error instanceof ProviderThrottleError) {
         this.throttleTracker.record(provider.key, error.retryAfterSeconds);
+        // A provider throttled part-way through hands back what it had already assembled. The
+        // cooldown covers the requests it can no longer make; it is not a reason to drop finished
+        // candidates, and the status event still tells the client the provider was cut short.
+        const salvaged = filterAndRank([...error.partialCandidates], params);
         this.logger.warn(
-          `[metadata_fetch.provider_search] [fail] provider=${provider.key} durationMs=${Date.now() - startedAt} errorClass=ProviderThrottleError error="provider throttled" - provider fetch failed`,
+          `[metadata_fetch.provider_search] [fail] provider=${provider.key} durationMs=${Date.now() - startedAt} resultCount=${salvaged.length} errorClass=ProviderThrottleError error="provider throttled" - provider fetch failed`,
         );
-        return { candidates: [], outcome: 'throttled' };
+        return { candidates: salvaged, outcome: 'throttled' };
       }
 
       const errorClass = error instanceof Error ? error.name : 'UnknownError';
diff --git a/server/src/modules/metadata-fetch/provider-registry.test.ts b/server/src/modules/metadata-fetch/provider-registry.test.ts
index d73081b69..debb79ca5 100644
--- a/server/src/modules/metadata-fetch/provider-registry.test.ts
+++ b/server/src/modules/metadata-fetch/provider-registry.test.ts
@@ -1,14 +1,15 @@
 import { BadRequestException } from '@nestjs/common';
-import { MetadataProviderKey } from '@bookorbit/types';
+import { ConcreteBookMediaKind, MetadataProviderKey } from '@bookorbit/types';
 
 import { ProviderRegistry } from './provider-registry';
 import { MetadataProvider } from './providers/metadata-provider';
 
-function createProvider(key: MetadataProviderKey, label = key): MetadataProvider {
+function createProvider(key: MetadataProviderKey, label = key, mediaKinds?: readonly ConcreteBookMediaKind[]): MetadataProvider {
   return {
     key,
     label,
     identifiable: false,
+    ...(mediaKinds ? { mediaKinds } : {}),
     search: vi.fn().mockResolvedValue([]),
   };
 }
@@ -47,6 +48,40 @@ describe('ProviderRegistry', () => {
     );
   });
 
+  it('keeps providers that declare no media kinds, so a new provider is never scoped out silently', () => {
+    const registry = new ProviderRegistry([
+      createProvider(MetadataProviderKey.GOOGLE),
+      createProvider(MetadataProviderKey.COMICVINE, 'ComicVine', ['comic']),
+      createProvider(MetadataProviderKey.AUDIBLE, 'Audible', ['audiobook']),
+    ]);
+
+    expect(registry.keysForMediaKind([MetadataProviderKey.GOOGLE, MetadataProviderKey.COMICVINE, MetadataProviderKey.AUDIBLE], 'ebook')).toEqual([
+      MetadataProviderKey.GOOGLE,
+    ]);
+  });
+
+  it('keeps a specialist only for the medium it serves', () => {
+    const registry = new ProviderRegistry([
+      createProvider(MetadataProviderKey.GOOGLE),
+      createProvider(MetadataProviderKey.COMICVINE, 'ComicVine', ['comic']),
+      createProvider(MetadataProviderKey.AUDIBLE, 'Audible', ['audiobook']),
+    ]);
+    const keys = [MetadataProviderKey.GOOGLE, MetadataProviderKey.COMICVINE, MetadataProviderKey.AUDIBLE];
+
+    expect(registry.keysForMediaKind(keys, 'comic')).toEqual([MetadataProviderKey.GOOGLE, MetadataProviderKey.COMICVINE]);
+    expect(registry.keysForMediaKind(keys, 'audiobook')).toEqual([MetadataProviderKey.GOOGLE, MetadataProviderKey.AUDIBLE]);
+  });
+
+  it('leaves an unregistered key alone rather than masking it as a scoped-out provider', () => {
+    const registry = new ProviderRegistry([createProvider(MetadataProviderKey.GOOGLE)]);
+
+    // select() is what rejects an unknown key; swallowing it here would turn that error into an empty search.
+    expect(registry.keysForMediaKind([MetadataProviderKey.GOOGLE, MetadataProviderKey.HARDCOVER], 'ebook')).toEqual([
+      MetadataProviderKey.GOOGLE,
+      MetadataProviderKey.HARDCOVER,
+    ]);
+  });
+
   it('finds a provider by key', () => {
     const google = createProvider(MetadataProviderKey.GOOGLE);
     const registry = new ProviderRegistry([google]);
diff --git a/server/src/modules/metadata-fetch/provider-registry.ts b/server/src/modules/metadata-fetch/provider-registry.ts
index 5f90a01cc..18398ebfc 100644
--- a/server/src/modules/metadata-fetch/provider-registry.ts
+++ b/server/src/modules/metadata-fetch/provider-registry.ts
@@ -1,5 +1,5 @@
 import { BadRequestException, Inject, Injectable } from '@nestjs/common';
-import { MetadataProviderKey } from '@bookorbit/types';
+import { ConcreteBookMediaKind, MetadataProviderKey } from '@bookorbit/types';
 
 import { METADATA_PROVIDERS } from './constants';
 import { MetadataProvider } from './providers/metadata-provider';
@@ -28,4 +28,15 @@ export class ProviderRegistry {
   find(key: MetadataProviderKey): MetadataProvider | undefined {
     return this.providers.find((p) => p.key === key);
   }
+
+  /**
+   * Narrows keys to the providers worth asking about for one medium. A provider that declares no
+   * media kinds serves all of them, so this drops specialists rather than keeping a whitelist.
+   */
+  keysForMediaKind(keys: MetadataProviderKey[], mediaKind: ConcreteBookMediaKind): MetadataProviderKey[] {
+    return keys.filter((key) => {
+      const mediaKinds = this.find(key)?.mediaKinds;
+      return !mediaKinds || mediaKinds.includes(mediaKind);
+    });
+  }
 }
diff --git a/server/src/modules/metadata-fetch/provider-throttle.error.test.ts b/server/src/modules/metadata-fetch/provider-throttle.error.test.ts
index 18787eaa9..621d236e3 100644
--- a/server/src/modules/metadata-fetch/provider-throttle.error.test.ts
+++ b/server/src/modules/metadata-fetch/provider-throttle.error.test.ts
@@ -1,3 +1,5 @@
+import { MetadataProviderKey } from '@bookorbit/types';
+
 import { ProviderThrottleError } from './provider-throttle.error';
 
 describe('ProviderThrottleError', () => {
@@ -14,4 +16,15 @@ describe('ProviderThrottleError', () => {
     const error = new ProviderThrottleError();
     expect(error.retryAfterSeconds).toBeUndefined();
   });
+
+  it('carries no partial candidates unless a caller salvaged some', () => {
+    expect(new ProviderThrottleError().partialCandidates).toEqual([]);
+
+    const salvaged = new ProviderThrottleError(undefined, 'bot challenge', [
+      { provider: MetadataProviderKey.GOODREADS, providerId: '222794853', title: 'The First Witch of Boston' },
+    ]);
+    expect(salvaged.partialCandidates).toHaveLength(1);
+    expect(salvaged.reason).toBe('bot challenge');
+    expect(salvaged.message).toBe('Provider throttled (bot challenge)');
+  });
 });
diff --git a/server/src/modules/metadata-fetch/provider-throttle.error.ts b/server/src/modules/metadata-fetch/provider-throttle.error.ts
index 0975323db..baa575236 100644
--- a/server/src/modules/metadata-fetch/provider-throttle.error.ts
+++ b/server/src/modules/metadata-fetch/provider-throttle.error.ts
@@ -1,7 +1,17 @@
+import { MetadataCandidate } from '@bookorbit/types';
+
 export class ProviderThrottleError extends Error {
   constructor(
     readonly retryAfterSeconds?: number,
-    reason = 'HTTP 429',
+    readonly reason = 'HTTP 429',
+    /**
+     * Candidates the provider had already assembled when it was cut off. A provider that scrapes one
+     * detail page per result is usually several books in by the time it is throttled, and those books
+     * are complete: the cooldown governs the requests still to come, not the ones that already
+     * succeeded. Carrying them on the error is what lets the caller record the cooldown and keep the
+     * results in the same step.
+     */
+    readonly partialCandidates: readonly MetadataCandidate[] = [],
   ) {
     super(`Provider throttled (${reason})`);
     this.name = 'ProviderThrottleError';
diff --git a/server/src/modules/metadata-fetch/providers/amazon/amazon.provider.ts b/server/src/modules/metadata-fetch/providers/amazon/amazon.provider.ts
index f18526745..14bfb777e 100644
--- a/server/src/modules/metadata-fetch/providers/amazon/amazon.provider.ts
+++ b/server/src/modules/metadata-fetch/providers/amazon/amazon.provider.ts
@@ -9,7 +9,7 @@ import { ProviderThrottleError } from '../../provider-throttle.error';
 import { IdentifiableProvider } from '../metadata-provider';
 import { PROVIDER_DELAYS_MS, PROVIDER_LIMITS, PROVIDER_TIMEOUT_MS } from '../provider-constants';
 import { MetadataSearchParams } from '../metadata-search-params';
-import { buildRequestSignal, normalizeMaxCandidates, sleep } from '../provider-utils';
+import { buildRequestSignal, normalizeMaxCandidates, rethrowWithPartialCandidates, sleep } from '../provider-utils';
 import { extractAsins, parseBookPage } from './amazon.scraper';
 
 const HEADERS: HeadersInit = {
@@ -42,12 +42,16 @@ export class AmazonProvider implements IdentifiableProvider {
     const asins = await this.searchAsins(params, domain, cookie, maxCandidates, params.signal);
 
     const results: MetadataCandidate[] = [];
-    for (const asin of asins.slice(0, maxCandidates)) {
-      if (results.length > 0) {
-        await sleep(PROVIDER_DELAYS_MS.AMAZON_BETWEEN_REQUESTS, params.signal);
+    try {
+      for (const asin of asins.slice(0, maxCandidates)) {
+        if (results.length > 0) {
+          await sleep(PROVIDER_DELAYS_MS.AMAZON_BETWEEN_REQUESTS, params.signal);
+        }
+        const candidate = await this.fetchByAsin(asin, domain, cookie, params.signal);
+        if (candidate) results.push(candidate);
       }
-      const candidate = await this.fetchByAsin(asin, domain, cookie, params.signal);
-      if (candidate) results.push(candidate);
+    } catch (err) {
+      rethrowWithPartialCandidates(err, results);
     }
     return results;
   }
diff --git a/server/src/modules/metadata-fetch/providers/audible/audible.provider.ts b/server/src/modules/metadata-fetch/providers/audible/audible.provider.ts
index 3481edf9d..b1fd50fdc 100644
--- a/server/src/modules/metadata-fetch/providers/audible/audible.provider.ts
+++ b/server/src/modules/metadata-fetch/providers/audible/audible.provider.ts
@@ -19,6 +19,7 @@ export class AudibleProvider implements IdentifiableProvider {
   readonly key = MetadataProviderKey.AUDIBLE;
   readonly label = 'Audible';
   readonly identifiable = true as const;
+  readonly mediaKinds = ['audiobook'] as const;
 
   private readonly logger = new Logger(AudibleProvider.name);
 
diff --git a/server/src/modules/metadata-fetch/providers/audnexus/audnexus.provider.ts b/server/src/modules/metadata-fetch/providers/audnexus/audnexus.provider.ts
index d0180207e..003e7ee10 100644
--- a/server/src/modules/metadata-fetch/providers/audnexus/audnexus.provider.ts
+++ b/server/src/modules/metadata-fetch/providers/audnexus/audnexus.provider.ts
@@ -27,6 +27,7 @@ export class AudnexusProvider implements MetadataProvider {
   readonly key = MetadataProviderKey.AUDNEXUS;
   readonly label = 'AudNexus';
   readonly identifiable = false as const;
+  readonly mediaKinds = ['audiobook'] as const;
 
   private readonly logger = new Logger(AudnexusProvider.name);
 
diff --git a/server/src/modules/metadata-fetch/providers/comicvine/comicvine.provider.ts b/server/src/modules/metadata-fetch/providers/comicvine/comicvine.provider.ts
index 46d7da6f1..e28e50c3e 100644
--- a/server/src/modules/metadata-fetch/providers/comicvine/comicvine.provider.ts
+++ b/server/src/modules/metadata-fetch/providers/comicvine/comicvine.provider.ts
@@ -94,6 +94,7 @@ export class ComicVineProvider implements IdentifiableProvider {
   readonly key = MetadataProviderKey.COMICVINE;
   readonly label = 'ComicVine';
   readonly identifiable = true as const;
+  readonly mediaKinds = ['comic'] as const;
 
   private readonly logger = new Logger(ComicVineProvider.name);
 
diff --git a/server/src/modules/metadata-fetch/providers/goodreads/goodreads.provider.test.ts b/server/src/modules/metadata-fetch/providers/goodreads/goodreads.provider.test.ts
index ffa54a282..c3e6c5f72 100644
--- a/server/src/modules/metadata-fetch/providers/goodreads/goodreads.provider.test.ts
+++ b/server/src/modules/metadata-fetch/providers/goodreads/goodreads.provider.test.ts
@@ -356,6 +356,60 @@ describe('GoodreadsProvider', () => {
       expect(detailUrls).toEqual(['https://www.goodreads.com/book/show/1']);
     });
 
+    it('salvages the books already scraped when a bot challenge stops the batch part-way', async () => {
+      vi.useFakeTimers();
+      const autocomplete = [
+        {
+          bookId: '222794853',
+          bookUrl: '/book/show/222794853.The_First_Witch_of_Boston',
+          title: 'The First Witch of Boston',
+          bookTitleBare: 'The First Witch of Boston',
+        },
+        {
+          bookId: '247090873',
+          bookUrl: '/book/show/247090873.The_First_Witch_of_Boston_Book_Two',
+          title: 'The First Witch of Boston Book Two',
+          bookTitleBare: 'The First Witch of Boston Book Two',
+        },
+      ];
+      let firstBookAttempts = 0;
+
+      global.fetch = vi.fn((input: Parameters<typeof fetch>[0]) => {
+        const url = fetchUrl(input);
+        if (url.includes('/auto_complete')) return Promise.resolve({ ok: true, json: () => Promise.resolve(autocomplete) });
+        if (url.includes('/book/show/222794853')) {
+          firstBookAttempts += 1;
+          // Goodreads sheds load with a bare 503 that clears on the next try.
+          if (firstBookAttempts === 1) return Promise.resolve({ ok: false, status: 503, text: () => Promise.resolve('') });
+          return Promise.resolve({ ok: true, status: 200, text: () => Promise.resolve(goodreadsBookHtml('222794853', 'The First Witch of Boston')) });
+        }
+        return Promise.resolve({ ok: true, status: 202, text: () => Promise.resolve('') });
+      }) as never;
+
+      // Attach the handler before the timers run: a rejected promise nobody is holding is an
+      // unhandled rejection, which fails the whole run.
+      const settled = provider.search({ title: 'The First Witch of Boston' }).catch((err: unknown) => err);
+      await vi.runAllTimersAsync();
+      const error = await settled;
+
+      expect(error).toBeInstanceOf(ProviderThrottleError);
+      const throttle = error as ProviderThrottleError;
+      expect(throttle.partialCandidates.map((c) => c.providerId)).toEqual(['222794853', '247090873']);
+      // The first book was scraped in full; the challenged one falls back to its autocomplete entry.
+      expect(throttle.partialCandidates[0].title).toBe('The First Witch of Boston');
+      expect(throttle.partialCandidates[1].title).toBe('The First Witch of Boston Book Two');
+
+      const detailUrls = vi
+        .mocked(global.fetch)
+        .mock.calls.map(([url]) => fetchUrl(url))
+        .filter((url) => url.includes('/book/show/'));
+      expect(detailUrls).toEqual([
+        'https://www.goodreads.com/book/show/222794853',
+        'https://www.goodreads.com/book/show/222794853',
+        'https://www.goodreads.com/book/show/247090873',
+      ]);
+    });
+
     it('reports a bot challenge on a direct lookup as a throttle', async () => {
       global.fetch = vi
         .fn()
diff --git a/server/src/modules/metadata-fetch/providers/goodreads/goodreads.provider.ts b/server/src/modules/metadata-fetch/providers/goodreads/goodreads.provider.ts
index 890397df1..cadf0acd7 100644
--- a/server/src/modules/metadata-fetch/providers/goodreads/goodreads.provider.ts
+++ b/server/src/modules/metadata-fetch/providers/goodreads/goodreads.provider.ts
@@ -8,7 +8,7 @@ import { ProviderThrottleError } from '../../provider-throttle.error';
 import { IdentifiableProvider } from '../metadata-provider';
 import { PROVIDER_BUDGETS_MS, PROVIDER_DELAYS_MS, PROVIDER_LIMITS, PROVIDER_RETRY, PROVIDER_TIMEOUT_MS } from '../provider-constants';
 import { MetadataSearchParams } from '../metadata-search-params';
-import { buildRequestSignal, createSearchDeadline, SearchDeadline, sleep } from '../provider-utils';
+import { buildRequestSignal, createSearchDeadline, rethrowWithPartialCandidates, SearchDeadline, sleep } from '../provider-utils';
 import { mapGoodreadsApolloState, mapGoodreadsAutocompleteItem } from './goodreads.mapper';
 import { GoodreadsAutocompleteItem, GoodreadsNextData } from './goodreads.types';
 
@@ -65,19 +65,27 @@ export class GoodreadsProvider implements IdentifiableProvider {
       // Try the detail scrape first, since it is the only source of a full description. A page that
       // loads but fails to parse, or one that is briefly unavailable, only costs this one book.
       const results: MetadataCandidate[] = [];
-      for (const target of targets.slice(0, PROVIDER_LIMITS.GOODREADS_MAX_RESULTS)) {
-        let candidate: MetadataCandidate | null = null;
-        if (!deadline.expired()) {
-          if (results.length > 0) await sleep(PROVIDER_DELAYS_MS.GOODREADS_BETWEEN_REQUESTS, deadline.signal).catch(() => undefined);
-          // The pause between requests spends budget, so re-check before committing to a fetch.
+      try {
+        for (const target of targets.slice(0, PROVIDER_LIMITS.GOODREADS_MAX_RESULTS)) {
+          let candidate: MetadataCandidate | null = null;
+          let blocked = false;
           if (!deadline.expired()) {
-            const detail = await this.fetchBook(target.id, deadline);
-            candidate = detail.candidate;
-            if (detail.outcome === 'blocked') throw blockedError();
+            if (results.length > 0) await sleep(PROVIDER_DELAYS_MS.GOODREADS_BETWEEN_REQUESTS, deadline.signal).catch(() => undefined);
+            // The pause between requests spends budget, so re-check before committing to a fetch.
+            if (!deadline.expired()) {
+              const detail = await this.fetchBook(target.id, deadline);
+              candidate = detail.candidate;
+              blocked = detail.outcome === 'blocked';
+            }
           }
+          if (!candidate && target.item) candidate = mapGoodreadsAutocompleteItem(target.item, target.id);
+          if (candidate) results.push(candidate);
+          // The challenge gates every page from here on, but the book it hit still has its
+          // autocomplete candidate, and the books before it are already scraped in full.
+          if (blocked) throw blockedError();
         }
-        if (!candidate && target.item) candidate = mapGoodreadsAutocompleteItem(target.item, target.id);
-        if (candidate) results.push(candidate);
+      } catch (err) {
+        rethrowWithPartialCandidates(err, results);
       }
 
       return results;
diff --git a/server/src/modules/metadata-fetch/providers/google/google-cover-validator.test.ts b/server/src/modules/metadata-fetch/providers/google/google-cover-validator.test.ts
new file mode 100644
index 000000000..b452f4780
--- /dev/null
+++ b/server/src/modules/metadata-fetch/providers/google/google-cover-validator.test.ts
@@ -0,0 +1,85 @@
+import { createHash } from 'crypto';
+
+import { MetadataProviderKey, type MetadataCandidate } from '@bookorbit/types';
+
+import { GoogleCoverValidator } from './google-cover-validator';
+
+function candidate(coverUrl: string): MetadataCandidate {
+  return { provider: MetadataProviderKey.GOOGLE, providerId: coverUrl, title: 'Book', coverUrl };
+}
+
+function response(status: number, headers: Record<string, string> = {}, body: Uint8Array | null = null): Response {
+  return new Response(body, { status, headers });
+}
+
+describe('GoogleCoverValidator', () => {
+  it('removes the known HTTP 200 placeholder while preserving the candidate', async () => {
+    const placeholder = Buffer.from('google-books-placeholder-fixture');
+    const hash = createHash('sha256').update(placeholder).digest('hex');
+    const fetchImage = vi
+      .fn()
+      .mockResolvedValueOnce(response(200, { 'content-type': 'image/png', 'content-length': String(placeholder.length) }))
+      .mockResolvedValueOnce(response(200, { 'content-type': 'image/png' }, placeholder));
+    const validator = new GoogleCoverValidator({
+      fetchImage,
+      placeholderLengths: new Set([placeholder.length]),
+      placeholderHashes: new Set([hash]),
+    });
+
+    const [result] = await validator.filterCandidates([candidate('https://books.google.com/books/content?id=missing')]);
+
+    expect(result).toEqual(expect.objectContaining({ providerId: 'https://books.google.com/books/content?id=missing', coverUrl: undefined }));
+    expect(fetchImage).toHaveBeenNthCalledWith(1, expect.any(String), expect.objectContaining({ method: 'HEAD', redirect: 'manual' }));
+    expect(fetchImage).toHaveBeenNthCalledWith(2, expect.any(String), expect.objectContaining({ redirect: 'manual' }));
+  });
+
+  it('keeps a valid cover without downloading its body when headers cannot match the placeholder', async () => {
+    const fetchImage = vi.fn().mockResolvedValue(response(200, { 'content-type': 'image/jpeg', 'content-length': '120000' }));
+    const validator = new GoogleCoverValidator({ fetchImage });
+    const coverUrl = 'https://books.google.com/books/content?id=real';
+
+    const [result] = await validator.filterCandidates([candidate(coverUrl)]);
+
+    expect(result?.coverUrl).toBe(coverUrl);
+    expect(fetchImage).toHaveBeenCalledOnce();
+  });
+
+  it('keeps a cover when validation is unavailable instead of dropping potentially valid artwork', async () => {
+    const fetchImage = vi.fn().mockRejectedValue(new Error('network unavailable'));
+    const validator = new GoogleCoverValidator({ fetchImage });
+    const coverUrl = 'https://books.google.com/books/content?id=unknown';
+
+    const [result] = await validator.filterCandidates([candidate(coverUrl)]);
+
+    expect(result?.coverUrl).toBe(coverUrl);
+  });
+
+  it('does not fetch provider-supplied URLs outside the fixed Google Books cover endpoint', async () => {
+    const fetchImage = vi.fn();
+    const validator = new GoogleCoverValidator({ fetchImage });
+    const coverUrl = 'https://example.test/cover.jpg';
+
+    const [result] = await validator.filterCandidates([candidate(coverUrl)]);
+
+    expect(result?.coverUrl).toBe(coverUrl);
+    expect(fetchImage).not.toHaveBeenCalled();
+  });
+
+  it('bounds concurrent validation work', async () => {
+    let active = 0;
+    let maxActive = 0;
+    const fetchImage = vi.fn(async () => {
+      active += 1;
+      maxActive = Math.max(maxActive, active);
+      await Promise.resolve();
+      active -= 1;
+      return response(200, { 'content-type': 'image/jpeg', 'content-length': '120000' });
+    });
+    const validator = new GoogleCoverValidator({ fetchImage });
+    const candidates = Array.from({ length: 12 }, (_, index) => candidate(`https://books.google.com/books/content?id=${index}`));
+
+    await validator.filterCandidates(candidates);
+
+    expect(maxActive).toBeLessThanOrEqual(5);
+  });
+});
diff --git a/server/src/modules/metadata-fetch/providers/google/google-cover-validator.ts b/server/src/modules/metadata-fetch/providers/google/google-cover-validator.ts
new file mode 100644
index 000000000..5237f04ad
--- /dev/null
+++ b/server/src/modules/metadata-fetch/providers/google/google-cover-validator.ts
@@ -0,0 +1,129 @@
+import { createHash } from 'crypto';
+
+import type { MetadataCandidate } from '@bookorbit/types';
+
+import { buildRequestSignal } from '../provider-utils';
+
+const GOOGLE_BOOKS_COVER_HOST = 'books.google.com';
+const VALIDATION_TIMEOUT_MS = 2_000;
+const VALIDATION_CONCURRENCY = 5;
+const MAX_FINGERPRINT_BYTES = 32 * 1024;
+const CACHE_TTL_MS = 6 * 60 * 60 * 1_000;
+const CACHE_MAX_ENTRIES = 500;
+
+const GOOGLE_BOOKS_PLACEHOLDER_LENGTHS = new Set([9_103]);
+const GOOGLE_BOOKS_PLACEHOLDER_HASHES = new Set(['3efa8c43e5b4348f303a528c81adf435f0111ea752fe9f0f6241478b60987fa6']);
+
+type FetchImage = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+
+interface GoogleCoverValidatorOptions {
+  fetchImage?: FetchImage;
+  placeholderLengths?: ReadonlySet<number>;
+  placeholderHashes?: ReadonlySet<string>;
+}
+
+interface CachedValidation {
+  usable: boolean;
+  expiresAt: number;
+}
+
+export class GoogleCoverValidator {
+  private readonly cache = new Map<string, CachedValidation>();
+  private readonly fetchImage: FetchImage;
+  private readonly placeholderLengths: ReadonlySet<number>;
+  private readonly placeholderHashes: ReadonlySet<string>;
+
+  constructor(options: GoogleCoverValidatorOptions = {}) {
+    this.fetchImage = options.fetchImage ?? ((input, init) => fetch(input, init));
+    this.placeholderLengths = options.placeholderLengths ?? GOOGLE_BOOKS_PLACEHOLDER_LENGTHS;
+    this.placeholderHashes = options.placeholderHashes ?? GOOGLE_BOOKS_PLACEHOLDER_HASHES;
+  }
+
+  async filterCandidates(candidates: MetadataCandidate[], signal?: AbortSignal): Promise<MetadataCandidate[]> {
+    const output = [...candidates];
+    const jobs = candidates
+      .map((candidate, index) => ({ candidate, index }))
+      .filter(({ candidate }) => candidate.coverUrl && this.isGoogleBooksCoverUrl(candidate.coverUrl));
+    let cursor = 0;
+
+    const workers = Array.from({ length: Math.min(VALIDATION_CONCURRENCY, jobs.length) }, async () => {
+      while (cursor < jobs.length) {
+        const job = jobs[cursor++];
+        if (!job?.candidate.coverUrl) continue;
+        const usable = await this.isUsable(job.candidate.coverUrl, signal);
+        if (usable === false) output[job.index] = { ...job.candidate, coverUrl: undefined };
+      }
+    });
+
+    await Promise.all(workers);
+    return output;
+  }
+
+  private isGoogleBooksCoverUrl(value: string): boolean {
+    try {
+      const url = new URL(value);
+      return url.protocol === 'https:' && url.hostname === GOOGLE_BOOKS_COVER_HOST && url.pathname === '/books/content';
+    } catch {
+      return false;
+    }
+  }
+
+  private async isUsable(url: string, parentSignal?: AbortSignal): Promise<boolean | null> {
+    const cached = this.cache.get(url);
+    if (cached && cached.expiresAt > Date.now()) return cached.usable;
+    if (cached) this.cache.delete(url);
+
+    try {
+      const signal = buildRequestSignal(VALIDATION_TIMEOUT_MS, parentSignal);
+      const head = await this.fetchImage(url, { method: 'HEAD', redirect: 'manual', signal });
+      if (head.status === 404 || head.status === 410) return this.cacheResult(url, false);
+      if (!head.ok) return null;
+
+      const contentType = head.headers.get('content-type')?.split(';')[0]?.trim().toLowerCase();
+      const contentLength = Number(head.headers.get('content-length'));
+      if (contentType !== 'image/png' || !this.placeholderLengths.has(contentLength)) return this.cacheResult(url, true);
+
+      const response = await this.fetchImage(url, { redirect: 'manual', signal });
+      if (response.status === 404 || response.status === 410) return this.cacheResult(url, false);
+      if (!response.ok) return null;
+
+      const bytes = await this.readBounded(response);
+      if (!bytes) return null;
+      const hash = createHash('sha256').update(bytes).digest('hex');
+      return this.cacheResult(url, !this.placeholderHashes.has(hash));
+    } catch (error) {
+      if (parentSignal?.aborted) throw error;
+      return null;
+    }
+  }
+
+  private async readBounded(response: Response): Promise<Buffer | null> {
+    if (!response.body) return null;
+    const reader = response.body.getReader();
+    const chunks: Uint8Array[] = [];
+    let totalBytes = 0;
+
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      if (!value) continue;
+      totalBytes += value.byteLength;
+      if (totalBytes > MAX_FINGERPRINT_BYTES) {
+        await reader.cancel();
+        return null;
+      }
+      chunks.push(value);
+    }
+
+    return Buffer.concat(chunks);
+  }
+
+  private cacheResult(url: string, usable: boolean): boolean {
+    if (this.cache.size >= CACHE_MAX_ENTRIES) {
+      const oldest = this.cache.keys().next().value;
+      if (oldest !== undefined) this.cache.delete(oldest);
+    }
+    this.cache.set(url, { usable, expiresAt: Date.now() + CACHE_TTL_MS });
+    return usable;
+  }
+}
diff --git a/server/src/modules/metadata-fetch/providers/google/google.provider.test.ts b/server/src/modules/metadata-fetch/providers/google/google.provider.test.ts
index ba5260e67..86b096676 100644
--- a/server/src/modules/metadata-fetch/providers/google/google.provider.test.ts
+++ b/server/src/modules/metadata-fetch/providers/google/google.provider.test.ts
@@ -114,6 +114,62 @@ describe('GoogleProvider', () => {
       const result = await provider.search({ title: 'Test' });
       expect(result).toEqual([]);
     });
+
+    it('does not validate cover thumbnails during bulk-compatible searches', async () => {
+      global.fetch = vi.fn().mockResolvedValue({
+        ok: true,
+        json: vi.fn().mockResolvedValue({
+          items: [
+            {
+              id: 'vol1',
+              volumeInfo: {
+                title: 'Test Book',
+                imageLinks: { thumbnail: 'http://books.google.com/books/content?id=vol1&zoom=1' },
+              },
+            },
+          ],
+        }),
+      });
+
+      const result = await provider.search({ title: 'Test Book' });
+
+      expect(result[0]?.coverUrl).toBe('https://books.google.com/books/content?id=vol1&zoom=0');
+      expect(global.fetch).toHaveBeenCalledOnce();
+    });
+
+    it('performs the bounded cover check for interactive searches', async () => {
+      global.fetch = vi
+        .fn()
+        .mockResolvedValueOnce({
+          ok: true,
+          json: vi.fn().mockResolvedValue({
+            items: [
+              {
+                id: 'vol1',
+                volumeInfo: {
+                  title: 'Test Book',
+                  imageLinks: { thumbnail: 'http://books.google.com/books/content?id=vol1&zoom=1' },
+                },
+              },
+            ],
+          }),
+        })
+        .mockResolvedValueOnce(
+          new Response(null, {
+            status: 200,
+            headers: { 'content-type': 'image/jpeg', 'content-length': '120000' },
+          }),
+        );
+
+      const result = await provider.search({ title: 'Test Book', validateCoverPlaceholders: true });
+
+      expect(result[0]?.coverUrl).toBe('https://books.google.com/books/content?id=vol1&zoom=0');
+      expect(global.fetch).toHaveBeenCalledTimes(2);
+      expect(global.fetch).toHaveBeenLastCalledWith(
+        'https://books.google.com/books/content?id=vol1&zoom=0',
+        expect.objectContaining({ method: 'HEAD', redirect: 'manual' }),
+      );
+    });
   });
 
   describe('lookupById', () => {
diff --git a/server/src/modules/metadata-fetch/providers/google/google.provider.ts b/server/src/modules/metadata-fetch/providers/google/google.provider.ts
index 186c48850..bb2caa181 100644
--- a/server/src/modules/metadata-fetch/providers/google/google.provider.ts
+++ b/server/src/modules/metadata-fetch/providers/google/google.provider.ts
@@ -9,6 +9,7 @@ import { IdentifiableProvider } from '../metadata-provider';
 import { MetadataSearchParams } from '../metadata-search-params';
 import { PROVIDER_TIMEOUT_MS } from '../provider-constants';
 import { buildRequestSignal } from '../provider-utils';
+import { GoogleCoverValidator } from './google-cover-validator';
 import { mapGoogleVolume } from './google.mapper';
 import { GoogleBooksResponse, GoogleVolumeItem } from './google.types';
 
@@ -21,6 +22,7 @@ export class GoogleProvider implements IdentifiableProvider {
   readonly identifiable = true as const;
 
   private readonly logger = new Logger(GoogleProvider.name);
+  private readonly coverValidator = new GoogleCoverValidator();
 
   constructor(private readonly providerConfig: ProviderConfigService) {}
 
@@ -29,7 +31,7 @@ export class GoogleProvider implements IdentifiableProvider {
     if (!enabled || !apiKey.trim()) return [];
     const query = this.buildQuery(params);
     if (!query) return [];
-    return this.fetchVolumes(query, apiKey, params.signal);
+    return this.fetchVolumes(query, apiKey, params.validateCoverPlaceholders ?? false, params.signal);
   }
 
   async lookupById(providerId: string, signal?: AbortSignal): Promise<MetadataCandidate | null> {
@@ -73,7 +75,7 @@ export class GoogleProvider implements IdentifiableProvider {
     return parts.length ? parts.join(' ') : null;
   }
 
-  private async fetchVolumes(query: string, apiKey: string, signal?: AbortSignal): Promise<MetadataCandidate[]> {
+  private async fetchVolumes(query: string, apiKey: string, validateCoverPlaceholders: boolean, signal?: AbortSignal): Promise<MetadataCandidate[]> {
     const url = this.buildUrl('/volumes', { q: query, maxResults: '10', printType: 'books' }, apiKey);
     const startedAt = Date.now();
     const safeQuery = sanitizeLogValue(query);
@@ -88,7 +90,8 @@ export class GoogleProvider implements IdentifiableProvider {
         return [];
       }
       const body = (await res.json()) as GoogleBooksResponse;
-      const items = (body.items ?? []).map(mapGoogleVolume);
+      const mappedItems = (body.items ?? []).map(mapGoogleVolume);
+      const items = validateCoverPlaceholders ? await this.coverValidator.filterCandidates(mappedItems, signal) : mappedItems;
       this.logger.log(
         `[google] [end] op=search query="${safeQuery}" status=${res.status} resultCount=${items.length} durationMs=${Date.now() - startedAt}`,
       );
diff --git a/server/src/modules/metadata-fetch/providers/kobo/kobo.provider.ts b/server/src/modules/metadata-fetch/providers/kobo/kobo.provider.ts
index bf7415534..6079e01d0 100644
--- a/server/src/modules/metadata-fetch/providers/kobo/kobo.provider.ts
+++ b/server/src/modules/metadata-fetch/providers/kobo/kobo.provider.ts
@@ -9,7 +9,7 @@ import { ProviderThrottleError } from '../../provider-throttle.error';
 import { IdentifiableProvider } from '../metadata-provider';
 import { PROVIDER_DELAYS_MS, PROVIDER_LIMITS, PROVIDER_TIMEOUT_MS } from '../provider-constants';
 import { MetadataSearchParams } from '../metadata-search-params';
-import { normalizeMaxCandidates, sleep } from '../provider-utils';
+import { normalizeMaxCandidates, rethrowWithPartialCandidates, sleep } from '../provider-utils';
 import { fetchKoboHtmlWithCloudscraper } from './kobo-cloudscraper.fetcher';
 import {
   buildKoboBookUrl,
@@ -62,14 +62,18 @@ export class KoboProvider implements IdentifiableProvider {
     const links = await this.searchBookLinks(params, config, maxCandidates, params.signal);
     const results: MetadataCandidate[] = [];
 
-    for (const link of links.slice(0, maxCandidates)) {
-      if (params.signal?.aborted) break;
-      if (results.length > 0) {
-        await sleep(PROVIDER_DELAYS_MS.KOBO_BETWEEN_REQUESTS, params.signal);
+    try {
+      for (const link of links.slice(0, maxCandidates)) {
+        if (params.signal?.aborted) break;
+        if (results.length > 0) {
+          await sleep(PROVIDER_DELAYS_MS.KOBO_BETWEEN_REQUESTS, params.signal);
+        }
+        const candidate = await this.fetchByUrl(link.url, link.providerId, params.signal);
+        if (candidate) results.push(candidate);
+        if (params.signal?.aborted) break;
       }
-      const candidate = await this.fetchByUrl(link.url, link.providerId, params.signal);
-      if (candidate) results.push(candidate);
-      if (params.signal?.aborted) break;
+    } catch (err) {
+      rethrowWithPartialCandidates(err, results);
     }
 
     return results;
diff --git a/server/src/modules/metadata-fetch/providers/librofm/librofm.provider.ts b/server/src/modules/metadata-fetch/providers/librofm/librofm.provider.ts
index 18c517613..6545d0d66 100644
--- a/server/src/modules/metadata-fetch/providers/librofm/librofm.provider.ts
+++ b/server/src/modules/metadata-fetch/providers/librofm/librofm.provider.ts
@@ -8,7 +8,7 @@ import { ProviderThrottleError } from '../../provider-throttle.error';
 import type { IdentifiableProvider } from '../metadata-provider';
 import type { MetadataSearchParams } from '../metadata-search-params';
 import { PROVIDER_DELAYS_MS, PROVIDER_LIMITS, PROVIDER_TIMEOUT_MS } from '../provider-constants';
-import { allowsAudiobookProviders, buildRequestSignal, normalizeMaxCandidates, sleep } from '../provider-utils';
+import { allowsAudiobookProviders, buildRequestSignal, normalizeMaxCandidates, rethrowWithPartialCandidates, sleep } from '../provider-utils';
 import { mapLibroFmAudiobook } from './librofm.mapper';
 import type { LibroFmDetailsResponse, LibroFmSearchResponse } from './librofm.types';
 
@@ -24,6 +24,7 @@ export class LibroFmProvider implements IdentifiableProvider {
   readonly key = MetadataProviderKey.LIBROFM;
   readonly label = 'Libro.fm';
   readonly identifiable = true as const;
+  readonly mediaKinds = ['audiobook'] as const;
 
   private readonly logger = new Logger(LibroFmProvider.name);
 
@@ -48,10 +49,14 @@ export class LibroFmProvider implements IdentifiableProvider {
     const maxCandidates = normalizeMaxCandidates(params.maxCandidatesPerProvider, PROVIDER_LIMITS.LIBROFM_MAX_RESULTS);
     const isbns = await this.searchIsbns(query, maxCandidates, params.signal);
     const candidates: MetadataCandidate[] = [];
-    for (const isbn of isbns) {
-      if (candidates.length > 0) await sleep(PROVIDER_DELAYS_MS.LIBROFM_BETWEEN_REQUESTS, params.signal);
-      const candidate = await this.fetchByIsbn(isbn, params.signal);
-      if (candidate) candidates.push(candidate);
+    try {
+      for (const isbn of isbns) {
+        if (candidates.length > 0) await sleep(PROVIDER_DELAYS_MS.LIBROFM_BETWEEN_REQUESTS, params.signal);
+        const candidate = await this.fetchByIsbn(isbn, params.signal);
+        if (candidate) candidates.push(candidate);
+      }
+    } catch (err) {
+      rethrowWithPartialCandidates(err, candidates);
     }
     return candidates;
   }
diff --git a/server/src/modules/metadata-fetch/providers/lubimyczytac/lubimyczytac.provider.ts b/server/src/modules/metadata-fetch/providers/lubimyczytac/lubimyczytac.provider.ts
index ace4e02ba..1fb40da24 100644
--- a/server/src/modules/metadata-fetch/providers/lubimyczytac/lubimyczytac.provider.ts
+++ b/server/src/modules/metadata-fetch/providers/lubimyczytac/lubimyczytac.provider.ts
@@ -8,7 +8,7 @@ import { ProviderThrottleError } from '../../provider-throttle.error';
 import { IdentifiableProvider } from '../metadata-provider';
 import { PROVIDER_DELAYS_MS, PROVIDER_LIMITS, PROVIDER_TIMEOUT_MS } from '../provider-constants';
 import { MetadataSearchParams } from '../metadata-search-params';
-import { buildRequestSignal, normalizeMaxCandidates, sleep } from '../provider-utils';
+import { buildRequestSignal, normalizeMaxCandidates, rethrowWithPartialCandidates, sleep } from '../provider-utils';
 import {
   buildLubimyczytacBookUrl,
   buildLubimyczytacSearchUrl,
@@ -49,13 +49,17 @@ export class LubimyczytacProvider implements IdentifiableProvider {
     const links = await this.searchBookLinks(params, maxCandidates, params.signal);
 
     const results: MetadataCandidate[] = [];
-    for (const link of links.slice(0, maxCandidates)) {
-      if (params.signal?.aborted) break;
-      if (results.length > 0) {
-        await sleep(PROVIDER_DELAYS_MS.LUBIMYCZYTAC_BETWEEN_REQUESTS, params.signal);
+    try {
+      for (const link of links.slice(0, maxCandidates)) {
+        if (params.signal?.aborted) break;
+        if (results.length > 0) {
+          await sleep(PROVIDER_DELAYS_MS.LUBIMYCZYTAC_BETWEEN_REQUESTS, params.signal);
+        }
+        const candidate = await this.fetchByUrl(link.url, link.providerId, params.signal);
+        if (candidate) results.push(candidate);
       }
-      const candidate = await this.fetchByUrl(link.url, link.providerId, params.signal);
-      if (candidate) results.push(candidate);
+    } catch (err) {
+      rethrowWithPartialCandidates(err, results);
     }
 
     return results;
diff --git a/server/src/modules/metadata-fetch/providers/metadata-provider.ts b/server/src/modules/metadata-fetch/providers/metadata-provider.ts
index 7967a5b1c..9a0a0022b 100644
--- a/server/src/modules/metadata-fetch/providers/metadata-provider.ts
+++ b/server/src/modules/metadata-fetch/providers/metadata-provider.ts
@@ -1,4 +1,4 @@
-import { MetadataCandidate, MetadataProviderKey } from '@bookorbit/types';
+import { ConcreteBookMediaKind, MetadataCandidate, MetadataProviderKey } from '@bookorbit/types';
 
 import { MetadataSearchParams } from './metadata-search-params';
 
@@ -7,6 +7,11 @@ export interface MetadataProvider {
   readonly label: string;
   readonly identifiable: boolean;
   readonly timeoutMs?: number;
+  /**
+   * The media kinds this provider is worth asking about. Only specialists declare one; a provider
+   * that leaves it undefined serves every kind, so a new provider is never silently scoped out.
+   */
+  readonly mediaKinds?: readonly ConcreteBookMediaKind[];
   search(params: MetadataSearchParams): Promise<MetadataCandidate[]>;
 }
 
diff --git a/server/src/modules/metadata-fetch/providers/metadata-search-params.ts b/server/src/modules/metadata-fetch/providers/metadata-search-params.ts
index 40aaa3a7b..5caf5bd76 100644
--- a/server/src/modules/metadata-fetch/providers/metadata-search-params.ts
+++ b/server/src/modules/metadata-fetch/providers/metadata-search-params.ts
@@ -24,6 +24,9 @@ export interface MetadataSearchParams {
   // Hint for providers to cap deep candidate exploration in non-interactive flows
   // (e.g. auto-fill/background refresh where there is no manual candidate picking).
   maxCandidatesPerProvider?: number;
+  // Interactive result lists can afford bounded cover checks. Bulk metadata pipelines must not
+  // multiply one provider lookup into many thumbnail requests.
+  validateCoverPlaceholders?: boolean;
   // Internal-only signal used by orchestration timeout/cancellation.
   signal?: AbortSignal;
 }
diff --git a/server/src/modules/metadata-fetch/providers/provider-utils.test.ts b/server/src/modules/metadata-fetch/providers/provider-utils.test.ts
index da6f55c8e..cd74ee1e2 100644
--- a/server/src/modules/metadata-fetch/providers/provider-utils.test.ts
+++ b/server/src/modules/metadata-fetch/providers/provider-utils.test.ts
@@ -1,4 +1,18 @@
-import { allowsAudiobookProviders, buildRequestSignal, normalizeMaxCandidates, sleep, stripHtml } from './provider-utils';
+import { MetadataCandidate, MetadataProviderKey } from '@bookorbit/types';
+
+import { ProviderThrottleError } from '../provider-throttle.error';
+import {
+  allowsAudiobookProviders,
+  buildRequestSignal,
+  normalizeMaxCandidates,
+  rethrowWithPartialCandidates,
+  sleep,
+  stripHtml,
+} from './provider-utils';
+
+function candidate(providerId: string): MetadataCandidate {
+  return { provider: MetadataProviderKey.GOODREADS, providerId, title: `Book ${providerId}` };
+}
 
 describe('provider-utils', () => {
   describe('allowsAudiobookProviders', () => {
@@ -75,4 +89,52 @@ describe('provider-utils', () => {
       expect(signal.aborted).toBe(true);
     });
   });
+
+  describe('rethrowWithPartialCandidates', () => {
+    it('carries the candidates gathered before the throttle, keeping the retry-after and reason', () => {
+      const gathered = [candidate('1'), candidate('2')];
+
+      try {
+        rethrowWithPartialCandidates(new ProviderThrottleError(30, 'bot challenge'), gathered);
+        expect.unreachable('should have rethrown');
+      } catch (err) {
+        expect(err).toBeInstanceOf(ProviderThrottleError);
+        const throttle = err as ProviderThrottleError;
+        expect(throttle.partialCandidates).toEqual(gathered);
+        expect(throttle.retryAfterSeconds).toBe(30);
+        expect(throttle.message).toBe('Provider throttled (bot challenge)');
+      }
+    });
+
+    it('snapshots the candidates so a later push cannot change what was salvaged', () => {
+      const gathered = [candidate('1')];
+
+      try {
+        rethrowWithPartialCandidates(new ProviderThrottleError(), gathered);
+        expect.unreachable('should have rethrown');
+      } catch (err) {
+        gathered.push(candidate('2'));
+        expect((err as ProviderThrottleError).partialCandidates).toHaveLength(1);
+      }
+    });
+
+    it('leaves candidates attached by an inner loop alone', () => {
+      const inner = [candidate('inner')];
+      const original = new ProviderThrottleError(undefined, 'HTTP 429', inner);
+
+      expect(() => rethrowWithPartialCandidates(original, [candidate('outer')])).toThrow(original);
+    });
+
+    it('rethrows anything that is not a throttle untouched', () => {
+      const failure = new Error('bad upstream response');
+
+      expect(() => rethrowWithPartialCandidates(failure, [candidate('1')])).toThrow(failure);
+    });
+
+    it('rethrows the original throttle when nothing was gathered', () => {
+      const original = new ProviderThrottleError(30);
+
+      expect(() => rethrowWithPartialCandidates(original, [])).toThrow(original);
+    });
+  });
 });
diff --git a/server/src/modules/metadata-fetch/providers/provider-utils.ts b/server/src/modules/metadata-fetch/providers/provider-utils.ts
index c4fd1d766..b43ca741a 100644
--- a/server/src/modules/metadata-fetch/providers/provider-utils.ts
+++ b/server/src/modules/metadata-fetch/providers/provider-utils.ts
@@ -1,4 +1,7 @@
+import { MetadataCandidate } from '@bookorbit/types';
+
 import { htmlToPlainText } from '../../../common/utils/html-to-text.utils';
+import { ProviderThrottleError } from '../provider-throttle.error';
 import { MetadataSearchParams } from './metadata-search-params';
 
 export function allowsAudiobookProviders(params: MetadataSearchParams): boolean {
@@ -68,6 +71,18 @@ export function sleep(ms: number, signal?: AbortSignal): Promise<void> {
   });
 }
 
+/**
+ * Rethrows a throttle raised part-way through a per-result loop with the candidates gathered so far
+ * attached, so recording the cooldown does not also discard finished work. Anything else, and a
+ * throttle that already carries candidates from an inner loop, is rethrown untouched.
+ */
+export function rethrowWithPartialCandidates(error: unknown, candidates: readonly MetadataCandidate[]): never {
+  if (error instanceof ProviderThrottleError && candidates.length > 0 && error.partialCandidates.length === 0) {
+    throw new ProviderThrottleError(error.retryAfterSeconds, error.reason, [...candidates]);
+  }
+  throw error;
+}
+
 export function stripHtml(html: string): string {
   return htmlToPlainText(html);
 }
diff --git a/server/src/modules/metadata-fetch/providers/ranobedb/ranobedb.provider.ts b/server/src/modules/metadata-fetch/providers/ranobedb/ranobedb.provider.ts
index 7ba8535a7..bead77943 100644
--- a/server/src/modules/metadata-fetch/providers/ranobedb/ranobedb.provider.ts
+++ b/server/src/modules/metadata-fetch/providers/ranobedb/ranobedb.provider.ts
@@ -4,6 +4,7 @@ import { MetadataCandidate, MetadataProviderKey } from '@bookorbit/types';
 import { ProviderConfigService } from '../../../metadata-preferences/provider-config.service';
 import { IdentifiableProvider } from '../metadata-provider';
 import { MetadataSearchParams } from '../metadata-search-params';
+import { rethrowWithPartialCandidates } from '../provider-utils';
 import { RanobeDbClient } from './ranobedb.client';
 import { mapRanobeDbBook } from './ranobedb.mapper';
 
@@ -32,11 +33,15 @@ export class RanobeDbProvider implements IdentifiableProvider {
     if (ids.length === 0) return [];
 
     const candidates: MetadataCandidate[] = [];
-    for (const id of ids) {
-      const response = await this.client.fetchBook(id, params.signal);
-      if (!response) continue;
-      const candidate = mapRanobeDbBook(response.book);
-      if (candidate) candidates.push(candidate);
+    try {
+      for (const id of ids) {
+        const response = await this.client.fetchBook(id, params.signal);
+        if (!response) continue;
+        const candidate = mapRanobeDbBook(response.book);
+        if (candidate) candidates.push(candidate);
+      }
+    } catch (err) {
+      rethrowWithPartialCandidates(err, candidates);
     }
     return candidates;
   }
diff --git a/server/src/modules/metadata/lib/cover-cb7.test.ts b/server/src/modules/metadata/lib/cover-cb7.test.ts
index 40a27775d..67f17fc06 100644
--- a/server/src/modules/metadata/lib/cover-cb7.test.ts
+++ b/server/src/modules/metadata/lib/cover-cb7.test.ts
@@ -1,5 +1,5 @@
 vi.mock('fs/promises', () => ({ readFile: vi.fn() }));
-vi.mock('../../../common/sevenzip', () => ({ getSevenZip: vi.fn() }));
+vi.mock('../../../common/sevenzip', () => ({ getSevenZip: vi.fn(), createSevenZipTempId: (prefix: string) => `${prefix}_test` }));
 
 import { readFile } from 'fs/promises';
 
diff --git a/server/src/modules/metadata/lib/isbn-detect.ts b/server/src/modules/metadata/lib/isbn-detect.ts
index 571877d56..d92fd46af 100644
--- a/server/src/modules/metadata/lib/isbn-detect.ts
+++ b/server/src/modules/metadata/lib/isbn-detect.ts
@@ -1,3 +1,5 @@
+import { normalizeIsbn } from '../../../common/text-match/isbn-normalize';
+
 export interface IsbnHit {
   value: string;
   kind: 10 | 13;
@@ -6,9 +8,7 @@ export interface IsbnHit {
 
 const LABEL_LOOKBACK = 25;
 
-export function normalizeIsbn(raw: string): string {
-  return raw.replace(/[^0-9Xx]/g, '').toUpperCase();
-}
+export { normalizeIsbn };
 
 export function isValidIsbn10(n: string): boolean {
   if (!/^[0-9]{9}[0-9X]$/.test(n)) return false;
diff --git a/server/src/modules/metadata/lib/opf-parser.test.ts b/server/src/modules/metadata/lib/opf-parser.test.ts
index 9feff0072..0edb55eed 100644
--- a/server/src/modules/metadata/lib/opf-parser.test.ts
+++ b/server/src/modules/metadata/lib/opf-parser.test.ts
@@ -85,6 +85,27 @@ describe('parseOpf', () => {
       expect(r.subtitle).toBeNull();
     });
 
+    it('reduces a windows-style path left in dc:title to the file stem', () => {
+      const xml = epub2Opf('<dc:title>library\\imports\\Circe - Madeline Miller.epub</dc:title>');
+      expect(parseOpf(xml).title).toBe('Circe - Madeline Miller');
+    });
+
+    it('reduces a bare filename left in dc:title', () => {
+      const xml = epub2Opf('<dc:title>The_Hobbit.mobi</dc:title>');
+      expect(parseOpf(xml).title).toBe('The Hobbit');
+    });
+
+    it('reduces a posix path left in dc:title', () => {
+      const xml = epub2Opf('<dc:title>/path/to/library/Dune.azw3</dc:title>');
+      expect(parseOpf(xml).title).toBe('Dune');
+    });
+
+    it('leaves a title that merely contains a slash or a dot alone', () => {
+      expect(parseOpf(epub2Opf('<dc:title>And/Or</dc:title>')).title).toBe('And/Or');
+      expect(parseOpf(epub2Opf('<dc:title>Vol. 1</dc:title>')).title).toBe('Vol. 1');
+      expect(parseOpf(epub2Opf('<dc:title>Mr. Penumbra&apos;s 24-Hour Bookstore</dc:title>')).title).toBe("Mr. Penumbra's 24-Hour Bookstore");
+    });
+
     it('uses first title as main title when multiple titles but no refinements', () => {
       const xml = epub3Opf(`
         <dc:title id="t1">First Title</dc:title>
diff --git a/server/src/modules/metadata/lib/opf-parser.ts b/server/src/modules/metadata/lib/opf-parser.ts
index 3a11bd293..e4c81f103 100644
--- a/server/src/modules/metadata/lib/opf-parser.ts
+++ b/server/src/modules/metadata/lib/opf-parser.ts
@@ -38,6 +38,28 @@ export interface ParsedOpf {
   renditionLayout: string | null;
 }
 
+/**
+ * Extensions a converter leaves behind when it names `dc:title` after the file it was handed
+ * rather than after the book. Common enough on redistributed EPUBs to be worth undoing: one seen
+ * in the wild carried `D:\wwwroot\cleverpdf-web\523660\Circe - Madeline Miller.epub`, which
+ * matches against no provider at all.
+ */
+const FILE_NAMED_TITLE = /^(?:.*[\\/])?([^\\/]+)\.(?:epub|kepub|mobi|azw3?|azw|fb2|pdf|djvu|lit|rtf|txt|cbz|cbr|cb7|cbt)$/i;
+
+/**
+ * A title that is really a path or a filename, reduced to the part that could be a title.
+ *
+ * The extension is what proves it. A real title may contain a slash or a colon, so neither is
+ * enough on its own, but none ends in `.epub`. Anything else is returned untouched, because a
+ * title BookOrbit does not understand is still the one the book claims.
+ */
+function titleFromFileName(value: string): string {
+  const stem = FILE_NAMED_TITLE.exec(value.trim())?.[1];
+  if (!stem) return value;
+  const cleaned = stem.replace(/_+/g, ' ').replace(/\s+/g, ' ').trim();
+  return cleaned || value;
+}
+
 const parser = new XMLParser({
   ignoreAttributes: false,
   attributeNamePrefix: '@_',
@@ -309,6 +331,7 @@ export function parseOpf(xml: string): ParsedOpf {
     }
     title ??= getText(rawTitles[0]);
   }
+  if (title) title = titleFromFileName(title);
   subtitle ??= namedMeta('bookorbit:subtitle');
   subtitle ??= calibreUser.subtitle;
 
diff --git a/server/src/modules/metadata/lib/sevenzip-vfs.ts b/server/src/modules/metadata/lib/sevenzip-vfs.ts
index 6becea82d..603d868c2 100644
--- a/server/src/modules/metadata/lib/sevenzip-vfs.ts
+++ b/server/src/modules/metadata/lib/sevenzip-vfs.ts
@@ -1,12 +1,9 @@
-import { randomUUID } from 'crypto';
-
 import { getSevenZip } from '../../../common/sevenzip';
 
 export type SevenZipInstance = Awaited<ReturnType<typeof getSevenZip>>;
 
-export function createSevenZipTempId(prefix: string): string {
-  return `${prefix}_${randomUUID()}`;
-}
+/** Re-exported so the callers here keep one import; the helper itself is shared. */
+export { createSevenZipTempId } from '../../../common/sevenzip';
 
 export function cleanupSevenZipArtifacts(sevenZip: SevenZipInstance, archivePath: string, outDir: string): void {
   try {
diff --git a/server/src/modules/reader/cbz/cbz.service.test.ts b/server/src/modules/reader/cbz/cbz.service.test.ts
index 9cc1f141f..fd1b6a140 100644
--- a/server/src/modules/reader/cbz/cbz.service.test.ts
+++ b/server/src/modules/reader/cbz/cbz.service.test.ts
@@ -16,7 +16,7 @@ vi.mock('node-unrar-js', () => {
 
   return { createExtractorFromData: vi.fn(), UnrarError: MockUnrarError };
 });
-vi.mock('../../../common/sevenzip', () => ({ getSevenZip: vi.fn() }));
+vi.mock('../../../common/sevenzip', () => ({ getSevenZip: vi.fn(), createSevenZipTempId: (prefix: string) => `${prefix}_test` }));
 vi.mock('../../../common/comic-format-detect', () => ({
   detectComicContainerFormat: vi.fn().mockImplementation((_path: string, fmt: string) => Promise.resolve(fmt)),
 }));
diff --git a/server/src/modules/scanner/lib/release-plan.test.ts b/server/src/modules/scanner/lib/release-plan.test.ts
new file mode 100644
index 000000000..87065c4a6
--- /dev/null
+++ b/server/src/modules/scanner/lib/release-plan.test.ts
@@ -0,0 +1,334 @@
+import { describe, expect, it } from 'vitest';
+
+import {
+  interpretRelease,
+  MAX_RELEASE_FILES,
+  normalizeReleaseStem,
+  selectReleaseUnit,
+  unitRelativePath,
+  type ReleaseFileInput,
+} from './release-plan';
+
+function files(...paths: string[]): ReleaseFileInput[] {
+  return paths.map((path, index) => ({ path, sizeBytes: (index + 1) * 1000 }));
+}
+
+function titles(paths: string[]): string[] {
+  return interpretRelease(files(...paths))
+    .units.map((unit) => unit.title ?? '')
+    .sort();
+}
+
+describe('interpretRelease: the scenario matrix', () => {
+  it('reads a loose book file at the root as one unit', () => {
+    const plan = interpretRelease(files('Book.epub'));
+
+    expect(plan.units).toHaveLength(1);
+    expect(plan.units[0]).toMatchObject({ mediaKind: 'ebook', contentFileCount: 1, primaryPath: 'Book.epub' });
+  });
+
+  it('keeps a folder of one book plus its artwork and sidecars as one unit', () => {
+    const plan = interpretRelease(files('The Hobbit/The Hobbit.epub', 'The Hobbit/cover.jpg', 'The Hobbit/release.nfo', 'The Hobbit/metadata.opf'));
+
+    expect(plan.units).toHaveLength(1);
+    expect(plan.units[0]!.contentFileCount).toBe(1);
+    expect(plan.units[0]!.files).toHaveLength(4);
+    expect(plan.units[0]!.title).toBe('The Hobbit');
+  });
+
+  it('folds several formats of one title into a single unit', () => {
+    const plan = interpretRelease(files('Dune/Dune.epub', 'Dune/Dune.mobi', 'Dune/Dune.azw3'));
+
+    expect(plan.units).toHaveLength(1);
+    expect(plan.units[0]!.contentFileCount).toBe(3);
+    expect(plan.units[0]!.primaryPath).toBe('Dune/Dune.epub');
+  });
+
+  it('treats a release-group suffix as the same title rather than a second book', () => {
+    const plan = interpretRelease(files('Dune/Dune (retail).epub', 'Dune/Dune.mobi'));
+
+    expect(plan.units).toHaveLength(1);
+    expect(plan.units[0]!.contentFileCount).toBe(2);
+  });
+
+  it('ignores a sample directory instead of counting it as a second book', () => {
+    const plan = interpretRelease(files('Book.epub', 'Sample/preview.pdf'));
+
+    expect(plan.units).toHaveLength(1);
+    expect(plan.units[0]!.primaryPath).toBe('Book.epub');
+    expect(plan.ignored).toEqual([{ path: 'Sample/preview.pdf', reason: 'junk_dir' }]);
+  });
+
+  it('ignores a sample file sitting beside the book', () => {
+    const plan = interpretRelease(files('Book.epub', 'Book - sample.epub', 'preview.pdf'));
+
+    expect(plan.units).toHaveLength(1);
+    expect(plan.ignored.map((entry) => entry.reason)).toEqual(['sample', 'sample']);
+  });
+
+  it('reads a multipart audiobook as one ordered unit', () => {
+    const tracks = Array.from({ length: 31 }, (_, index) => `Neuromancer/Chapter ${index + 1}.mp3`);
+    const plan = interpretRelease(files(...tracks, 'Neuromancer/cover.jpg'));
+
+    expect(plan.units).toHaveLength(1);
+    const unit = plan.units[0]!;
+    expect(unit.mediaKind).toBe('audiobook');
+    expect(unit.contentFileCount).toBe(31);
+    expect(unit.files).toHaveLength(32);
+    expect(unit.primaryPath).toBe('Neuromancer/Chapter 1.mp3');
+  });
+
+  it('orders tracks naturally so chapter 10 follows chapter 9', () => {
+    const plan = interpretRelease(files('Book/Chapter 10.mp3', 'Book/Chapter 9.mp3', 'Book/Chapter 1.mp3'));
+
+    const ordered = plan.units[0]!.files.filter((file) => file.sortOrder !== null).map((file) => file.path);
+    expect(ordered).toEqual(['Book/Chapter 1.mp3', 'Book/Chapter 9.mp3', 'Book/Chapter 10.mp3']);
+  });
+
+  it('folds disc subdirectories into the audiobook above them', () => {
+    const plan = interpretRelease(files('Book/CD 1/track01.mp3', 'Book/CD 1/track02.mp3', 'Book/CD 2/track01.mp3', 'Book/cover.jpg'));
+
+    expect(plan.units).toHaveLength(1);
+    expect(plan.units[0]!.contentFileCount).toBe(3);
+    expect(plan.units[0]!.title).toBe('Book');
+    expect(plan.units[0]!.directory).toBe('Book');
+  });
+
+  /**
+   * Ordering by file name interleaved the discs, so a two-disc set played track 1 of disc 1, then
+   * track 1 of disc 2. The whole path is what carries the disc.
+   */
+  it('orders a two-disc audiobook disc by disc rather than interleaving the tracks', () => {
+    const plan = interpretRelease(files('Book/CD 2/track01.mp3', 'Book/CD 1/track02.mp3', 'Book/CD 2/track02.mp3', 'Book/CD 1/track01.mp3'));
+
+    expect(plan.units).toHaveLength(1);
+    const ordered = [...plan.units[0]!.files].filter((file) => file.sortOrder !== null).sort((a, b) => a.sortOrder! - b.sortOrder!);
+    expect(ordered.map((file) => file.path)).toEqual([
+      'Book/CD 1/track01.mp3',
+      'Book/CD 1/track02.mp3',
+      'Book/CD 2/track01.mp3',
+      'Book/CD 2/track02.mp3',
+    ]);
+    expect(plan.units[0]!.primaryPath).toBe('Book/CD 1/track01.mp3');
+  });
+
+  it('reports the path each file has inside its own unit', () => {
+    const plan = interpretRelease(files('Book/CD 1/track01.mp3', 'Book/CD 2/track01.mp3'));
+    const unit = plan.units[0]!;
+
+    expect(unit.files.map((file) => unitRelativePath(unit, file.path)).sort()).toEqual(['CD 1/track01.mp3', 'CD 2/track01.mp3']);
+  });
+
+  it('leaves a unit at the release root with its path unchanged', () => {
+    const plan = interpretRelease(files('Book.epub'));
+    const unit = plan.units[0]!;
+
+    expect(unit.directory).toBe('');
+    expect(unitRelativePath(unit, 'Book.epub')).toBe('Book.epub');
+  });
+
+  it('reads a single m4b as one unit', () => {
+    const plan = interpretRelease(files('Book.m4b'));
+
+    expect(plan.units).toHaveLength(1);
+    expect(plan.units[0]!.mediaKind).toBe('audiobook');
+  });
+
+  it('splits an m4b edition from an mp3 edition of the same title', () => {
+    const plan = interpretRelease(files('Book/Book.m4b', 'Book/Chapter 1.mp3', 'Book/Chapter 2.mp3'));
+
+    expect(plan.units).toHaveLength(2);
+    expect(plan.units.map((unit) => unit.contentFileCount).sort()).toEqual([1, 2]);
+  });
+
+  it('reads a series pack as one unit per title', () => {
+    const plan = interpretRelease(files('Discworld/Guards Guards.epub', 'Discworld/Mort.epub', 'Discworld/Small Gods.epub'));
+
+    expect(plan.units).toHaveLength(3);
+    expect(plan.units.map((unit) => unit.title).sort()).toEqual(['Guards Guards', 'Mort', 'Small Gods']);
+  });
+
+  it('reads a comic run as one unit per issue', () => {
+    const issues = Array.from({ length: 60 }, (_, index) => `Saga/Saga ${String(index + 1).padStart(3, '0')}.cbz`);
+    const plan = interpretRelease(files(...issues));
+
+    expect(plan.units).toHaveLength(60);
+    expect(plan.units.every((unit) => unit.mediaKind === 'comic' && unit.contentFileCount === 1)).toBe(true);
+  });
+
+  it('never extracts a comic archive, even though cbz is a zip and cbr is a rar', () => {
+    const plan = interpretRelease(files('Saga 001.cbz', 'Saga 002.cbr', 'Saga 003.cb7'));
+
+    expect(plan.containers).toEqual([]);
+    expect(plan.units).toHaveLength(3);
+  });
+
+  it('keeps an ebook and an audiobook of one work as separate units for placement to merge', () => {
+    const plan = interpretRelease(files('Dune/Dune.epub', 'Dune/Dune.m4b'));
+
+    expect(plan.units).toHaveLength(2);
+    expect(plan.units.map((unit) => unit.mediaKind).sort()).toEqual(['audiobook', 'ebook']);
+  });
+
+  it('reports an archived release as a container with no units', () => {
+    const plan = interpretRelease(files('Book.rar', 'Book.r00', 'Book.r01'));
+
+    expect(plan.units).toEqual([]);
+    expect(plan.containers.map((container) => container.kind)).toEqual(['rar', 'rar', 'rar']);
+  });
+
+  it('reports a zipped ebook as a container', () => {
+    const plan = interpretRelease(files('Book.epub.zip'));
+
+    expect(plan.units).toEqual([]);
+    expect(plan.containers).toEqual([{ path: 'Book.epub.zip', kind: 'zip' }]);
+  });
+
+  it('finds no unit in a release of artwork alone', () => {
+    const plan = interpretRelease(files('Screens/shot.png', 'release.nfo'));
+
+    expect(plan.units).toEqual([]);
+    expect(plan.containers).toEqual([]);
+  });
+});
+
+describe('interpretRelease: junk and padding', () => {
+  it('drops BitTorrent v1 padding files', () => {
+    const plan = interpretRelease(files('Book.epub', '____padding_file_0_abc', '.pad/32768'));
+
+    expect(plan.units).toHaveLength(1);
+    expect(plan.ignored.map((entry) => entry.reason).sort()).toEqual(['padding', 'padding']);
+  });
+
+  it('drops proof and screenshot directories', () => {
+    const plan = interpretRelease(files('Book.epub', 'Proof/proof1.jpg', 'Screenshots/1.png', '_UNPACK_/old.epub'));
+
+    expect(plan.units).toHaveLength(1);
+    expect(plan.ignored).toHaveLength(3);
+  });
+
+  it('drops dotfiles', () => {
+    const plan = interpretRelease(files('Book.epub', '.DS_Store'));
+
+    expect(plan.units).toHaveLength(1);
+    expect(plan.ignored).toEqual([{ path: '.DS_Store', reason: 'unsupported' }]);
+  });
+
+  it('does not mistake a title beginning with a sample word for a sample', () => {
+    expect(titles(['Preview of Death.epub'])).toEqual(['Preview of Death']);
+  });
+});
+
+describe('interpretRelease: bounds and shape', () => {
+  it('flags a release longer than the cap as truncated', () => {
+    const many = Array.from({ length: MAX_RELEASE_FILES + 5 }, (_, index) => `Pack/Book ${index}.epub`);
+    const plan = interpretRelease(files(...many));
+
+    expect(plan.truncated).toBe(true);
+    expect(plan.units).toHaveLength(MAX_RELEASE_FILES);
+  });
+
+  it('sums a unit size across its files and tolerates unknown sizes', () => {
+    const plan = interpretRelease([
+      { path: 'Book/Book.epub', sizeBytes: 100 },
+      { path: 'Book/cover.jpg', sizeBytes: null },
+    ]);
+
+    expect(plan.units[0]!.sizeBytes).toBe(100);
+  });
+
+  it('reports a null size when nothing in the unit states one', () => {
+    const plan = interpretRelease([{ path: 'Book.epub', sizeBytes: null }]);
+
+    expect(plan.units[0]!.sizeBytes).toBeNull();
+  });
+
+  it('gives artwork no sort order and content files a contiguous one', () => {
+    const plan = interpretRelease(files('Book/a.mp3', 'Book/b.mp3', 'Book/cover.jpg'));
+
+    expect(plan.units[0]!.files.map((file) => file.sortOrder)).toEqual([0, 1, null]);
+  });
+
+  it('attaches artwork only by stem when a directory holds several books', () => {
+    const plan = interpretRelease(files('Pack/Mort.epub', 'Pack/Mort.jpg', 'Pack/Small Gods.epub', 'Pack/random.jpg'));
+
+    const mort = plan.units.find((unit) => unit.title === 'Mort')!;
+    expect(mort.files.map((file) => file.path)).toEqual(['Pack/Mort.epub', 'Pack/Mort.jpg']);
+    expect(plan.ignored).toEqual([{ path: 'Pack/random.jpg', reason: 'unsupported' }]);
+  });
+
+  it('folds a stem-named subdirectory into the book it belongs to', () => {
+    const plan = interpretRelease(files('Book.epub', 'Book/cover.jpg'));
+
+    expect(plan.units).toHaveLength(1);
+    expect(plan.units[0]!.files).toHaveLength(2);
+  });
+
+  it('ignores an empty file list', () => {
+    expect(interpretRelease([])).toEqual({ units: [], ignored: [], containers: [], truncated: false });
+  });
+});
+
+describe('normalizeReleaseStem', () => {
+  it.each([
+    ['Dune', 'dune'],
+    ['Dune (retail)', 'dune'],
+    ['Dune [v2]', 'dune'],
+    ['Dune - fixed', 'dune'],
+    ['Dune.retail', 'dune'],
+    ['Dune_Messiah', 'dune messiah'],
+  ])('normalizes %s to %s', (input, expected) => {
+    expect(normalizeReleaseStem(input)).toBe(expected);
+  });
+});
+
+describe('selectReleaseUnit', () => {
+  function plan(...paths: string[]) {
+    return interpretRelease(files(...paths));
+  }
+
+  it('takes the only unit a release resolves to', () => {
+    const selection = selectReleaseUnit(plan('Dune/Dune.epub'));
+
+    expect(selection.kind).toBe('unit');
+    expect(selection.kind === 'unit' && selection.ignored).toEqual([]);
+  });
+
+  it('finds nothing in a release with no unit', () => {
+    expect(selectReleaseUnit(plan('release.nfo')).kind).toBe('none');
+  });
+
+  /** The request already said which kind of book it wanted, so nobody needs to be asked again. */
+  it('narrows a mixed release by the media kind the request asked for', () => {
+    const selection = selectReleaseUnit(plan('Dune/Dune.epub', 'Dune/Dune.m4b'), { mediaKind: 'audiobook' });
+
+    expect(selection.kind).toBe('unit');
+    expect(selection.kind === 'unit' && selection.unit.mediaKind).toBe('audiobook');
+    expect(selection.kind === 'unit' && selection.ignored).toHaveLength(1);
+  });
+
+  it('stays ambiguous when the media kind matches more than one unit', () => {
+    const selection = selectReleaseUnit(plan('Pack/Mort.epub', 'Pack/Small Gods.epub'), { mediaKind: 'ebook' });
+
+    expect(selection.kind).toBe('ambiguous');
+    expect(selection.kind === 'ambiguous' && selection.units).toHaveLength(2);
+  });
+
+  it('stays ambiguous when nothing narrows the release', () => {
+    expect(selectReleaseUnit(plan('Pack/Mort.epub', 'Pack/Small Gods.epub')).kind).toBe('ambiguous');
+  });
+
+  /** A choice already made outranks a media kind that disagrees: a human made it looking at both. */
+  it('honours a choice already made over the requested media kind', () => {
+    const selection = selectReleaseUnit(plan('Dune/Dune.epub', 'Dune/Dune.m4b'), {
+      mediaKind: 'audiobook',
+      primaryPath: 'Dune/Dune.epub',
+    });
+
+    expect(selection.kind === 'unit' && selection.unit.mediaKind).toBe('ebook');
+  });
+
+  it('finds nothing when the chosen unit is no longer in the release', () => {
+    expect(selectReleaseUnit(plan('Pack/Mort.epub'), { primaryPath: 'Pack/Gone.epub' }).kind).toBe('none');
+  });
+});
diff --git a/server/src/modules/scanner/lib/release-plan.ts b/server/src/modules/scanner/lib/release-plan.ts
new file mode 100644
index 000000000..8a24bfd75
--- /dev/null
+++ b/server/src/modules/scanner/lib/release-plan.ts
@@ -0,0 +1,410 @@
+import { getBookMediaKind } from '@bookorbit/types';
+
+import { naturalCompare } from '../../../common/utils/natural-sort.utils';
+import { classifyFile, type FileRole } from './classify';
+import { isDiscDirectory, stemOf } from './walk';
+
+/**
+ * What a downloaded release actually is, decided once and read at two call sites: the `.torrent`
+ * manifest before the grab, and the finished directory after it. Keeping one rule set means the
+ * picker can say "this becomes one audiobook of 31 tracks" rather than "multiple supported files",
+ * and it means a release cannot be accepted at grab time and then refused at import.
+ *
+ * Pure by construction: no filesystem, no database, no request. Selection against a request is a
+ * separate question answered over the plan this returns.
+ *
+ * This deliberately does not share the scanner's *splitting* rule. `book_per_folder` scanning is
+ * "one folder = one book", so 41 different-titled epubs in a directory scan as one book. Here they
+ * are 41 units, because a release directory is a delivery boundary and a library folder is a
+ * placement boundary, and turning one into the other is the whole job. What is shared are the
+ * primitives: classification, media class, natural order and disc folding.
+ */
+
+export type ReleaseMediaKind = 'ebook' | 'audiobook' | 'comic';
+
+export type ReleaseIgnoredReason = 'sample' | 'padding' | 'unsupported' | 'junk_dir';
+
+export type ReleaseContainerKind = 'zip' | 'rar' | '7z';
+
+export interface ReleaseFileInput {
+  /** Relative to the release root, `/` separated. Callers strip any common root segment first. */
+  path: string;
+  sizeBytes: number | null;
+}
+
+export interface ReleasePlanFile {
+  path: string;
+  sizeBytes: number | null;
+  format: string | null;
+  role: FileRole;
+  /** Content files only, natural order within the unit. */
+  sortOrder: number | null;
+}
+
+export interface ReleaseUnit {
+  mediaKind: ReleaseMediaKind;
+  /** Best guess for a chooser to show, from the directory name or the file stem. */
+  title: string | null;
+  files: ReleasePlanFile[];
+  /** What metadata and cover extraction should read. */
+  primaryPath: string;
+  contentFileCount: number;
+  sizeBytes: number | null;
+  /**
+   * The directory every file of this unit hangs off, relative to the release root and `''` at the
+   * root itself. Disc folding means a file can sit below it, so this is what tells a placement the
+   * difference between `CD 1/track01.mp3` and `CD 2/track01.mp3` - two files with one name.
+   */
+  directory: string;
+}
+
+export interface ReleasePlan {
+  units: ReleaseUnit[];
+  ignored: Array<{ path: string; reason: ReleaseIgnoredReason }>;
+  containers: Array<{ path: string; kind: ReleaseContainerKind }>;
+  /**
+   * Part of the release was never interpreted: the input ran past `MAX_RELEASE_FILES`, or the
+   * caller that produced it hit a bound of its own and said so. A truncated plan is a plan that
+   * may be missing half of a multipart book, so importing from it is importing part of a book.
+   */
+  truncated: boolean;
+}
+
+/** A release is books plus artwork, not a filesystem. Matches the .torrent manifest's own cap. */
+export const MAX_RELEASE_FILES = 2_000;
+
+const JUNK_DIRECTORIES = new Set(['sample', 'samples', 'screens', 'screenshots', 'proof', 'proofs', '_unpack_', '.pad']);
+
+/**
+ * BitTorrent v1 padding. Matched by name rather than by the `attr: p` flag because the manifest
+ * parser reads only `path` and `length`, and the post-download call site has no flags at all: a
+ * name rule is the one rule that works at both call sites.
+ */
+const PADDING_FILE_PATTERN = /^_{4,}padding_file|^\.____padding_file|^\.pad$/i;
+
+/** Whole stem or a trailing token only, so `preview.pdf` is a sample and `Preview of Death` is not. */
+const SAMPLE_FILE_PATTERN = /^(?:sample|preview|excerpt)$|[\s._-](?:sample|preview|excerpt)$/i;
+
+const CONTAINER_KINDS: Array<{ kind: ReleaseContainerKind; test: (ext: string) => boolean }> = [
+  { kind: 'zip', test: (ext) => ext === 'zip' },
+  // Multipart RAR volumes: `.rar` plus `.r00`, `.r01`, and the newer `.part1.rar` spelling.
+  { kind: 'rar', test: (ext) => ext === 'rar' || /^r\d{2,3}$/.test(ext) },
+  { kind: '7z', test: (ext) => ext === '7z' || /^\d{3}$/.test(ext) },
+];
+
+/**
+ * Comics are content and must never be treated as archives even though a `.cbz` is a zip and a
+ * `.cbr` is a rar. Checked before the container test, so ordering here is load-bearing.
+ */
+function containerKind(format: string | null, role: FileRole): ReleaseContainerKind | null {
+  if (!format || role === 'content') return null;
+  for (const { kind, test } of CONTAINER_KINDS) {
+    if (test(format)) return kind;
+  }
+  return null;
+}
+
+/** Strips the noise release groups add to a stem so `Book (retail)` and `Book [v2]` are one book. */
+export function normalizeReleaseStem(stem: string): string {
+  return stem
+    .replace(/\.(retail|fixed|repack|proper|v\d+)$/i, '')
+    .replace(/[([{][^)\]}]*[)\]}]/g, ' ')
+    .replace(/[\s._-]+(retail|fixed|repack|proper|unabridged|abridged|v\d+)$/i, '')
+    .replace(/[\s._-]+/g, ' ')
+    .trim()
+    .toLowerCase();
+}
+
+interface WorkingFile {
+  input: ReleaseFileInput;
+  segments: string[];
+  name: string;
+  dir: string;
+  format: string | null;
+  role: FileRole;
+}
+
+export interface InterpretReleaseOptions {
+  /**
+   * What the release itself is called: the torrent's `name`, or the downloaded directory's own
+   * name. Paths arrive relative to the release root, so a unit sitting at that root has no
+   * directory name of its own to be titled after, and "track 01" is a poor answer where
+   * "Neuromancer" was available.
+   */
+  rootName?: string | null;
+  /**
+   * The caller already gave up on part of the release: a directory walk that hit its own depth or
+   * entry ceiling, for instance. Without this a truncated listing is indistinguishable from a
+   * complete one, because the interpreter only ever sees what it was handed.
+   */
+  truncated?: boolean;
+}
+
+export function interpretRelease(files: ReleaseFileInput[], options: InterpretReleaseOptions = {}): ReleasePlan {
+  const overLength = files.length > MAX_RELEASE_FILES;
+  const truncated = overLength || options.truncated === true;
+  const considered = overLength ? files.slice(0, MAX_RELEASE_FILES) : files;
+
+  const ignored: ReleasePlan['ignored'] = [];
+  const containers: ReleasePlan['containers'] = [];
+  const kept: WorkingFile[] = [];
+  const stemsByDirectory = indexStemsByDirectory(considered);
+
+  for (const input of considered) {
+    const segments = input.path.split('/').filter((segment) => segment.length > 0 && segment !== '.');
+    if (segments.length === 0) continue;
+
+    const name = segments[segments.length - 1]!;
+    const directorySegments = segments.slice(0, -1);
+
+    const junkSegment = directorySegments.find((segment) => JUNK_DIRECTORIES.has(segment.toLowerCase()));
+    if (junkSegment !== undefined) {
+      ignored.push({ path: input.path, reason: junkSegment.toLowerCase() === '.pad' ? 'padding' : 'junk_dir' });
+      continue;
+    }
+
+    if (PADDING_FILE_PATTERN.test(name)) {
+      ignored.push({ path: input.path, reason: 'padding' });
+      continue;
+    }
+
+    const { format, role } = classifyFile(name);
+
+    const container = containerKind(format, role);
+    if (container) {
+      containers.push({ path: input.path, kind: container });
+      continue;
+    }
+
+    if (name.startsWith('.')) {
+      ignored.push({ path: input.path, reason: 'unsupported' });
+      continue;
+    }
+
+    if (role === 'content' && SAMPLE_FILE_PATTERN.test(stemOf(name))) {
+      ignored.push({ path: input.path, reason: 'sample' });
+      continue;
+    }
+
+    kept.push({ input, segments, name, dir: effectiveDirectory(directorySegments, stemsByDirectory), format, role });
+  }
+
+  const units: ReleaseUnit[] = [];
+  for (const [dir, group] of groupByDirectory(kept)) {
+    units.push(...unitsForDirectory(dir, group, ignored, options.rootName ?? null));
+  }
+
+  return { units, ignored, containers, truncated };
+}
+
+/**
+ * Disc subdirectories belong to the book above them, exactly as the scanner folds them, so a
+ * `CD 1` / `CD 2` audiobook is one unit rather than two. Stem-named subdirectories fold the same
+ * way, which is how `Book.epub` keeps its `Book/cover.jpg`.
+ */
+function effectiveDirectory(directorySegments: string[], stemsByDirectory: Map<string, Set<string>>): string {
+  const segments = [...directorySegments];
+
+  while (segments.length > 0) {
+    const last = segments[segments.length - 1]!;
+    if (isDiscDirectory(last)) {
+      segments.pop();
+      continue;
+    }
+    if (stemsByDirectory.get(segments.slice(0, -1).join('/'))?.has(last)) {
+      segments.pop();
+      continue;
+    }
+    break;
+  }
+
+  return segments.join('/');
+}
+
+/**
+ * One pass up front rather than a scan of every file per file. A 2000-entry series pack is a
+ * perfectly ordinary release, and the quadratic version of this cost half a second on its own.
+ */
+function indexStemsByDirectory(all: ReleaseFileInput[]): Map<string, Set<string>> {
+  const byDirectory = new Map<string, Set<string>>();
+  for (const file of all) {
+    const segments = file.path.split('/').filter(Boolean);
+    if (segments.length === 0) continue;
+    const dir = segments.slice(0, -1).join('/');
+    const stems = byDirectory.get(dir);
+    if (stems) stems.add(stemOf(segments[segments.length - 1]!));
+    else byDirectory.set(dir, new Set([stemOf(segments[segments.length - 1]!)]));
+  }
+  return byDirectory;
+}
+
+function groupByDirectory(files: WorkingFile[]): Map<string, WorkingFile[]> {
+  const byDir = new Map<string, WorkingFile[]>();
+  for (const file of files) {
+    const existing = byDir.get(file.dir);
+    if (existing) existing.push(file);
+    else byDir.set(file.dir, [file]);
+  }
+  return byDir;
+}
+
+function unitsForDirectory(dir: string, group: WorkingFile[], ignored: ReleasePlan['ignored'], rootName: string | null): ReleaseUnit[] {
+  const content = group.filter((file) => file.role === 'content');
+  const sidecars = group.filter((file) => file.role !== 'content');
+
+  if (content.length === 0) {
+    for (const sidecar of sidecars) ignored.push({ path: sidecar.input.path, reason: 'unsupported' });
+    return [];
+  }
+
+  const buckets = new Map<string, WorkingFile[]>();
+  for (const file of content) {
+    const kind = getBookMediaKind(file.format);
+    // An m4b edition and an mp3 edition of the same title are two editions of one book, and which
+    // one to keep is a choice, not a merge. Splitting by format defers it to the chooser; for the
+    // ordinary all-one-format audiobook it is a no-op.
+    const key = kind === 'audiobook' ? `audiobook:${file.format ?? ''}` : kind === 'comic' ? `comic:${file.input.path}` : `ebook:${unitStem(file)}`;
+    const existing = buckets.get(key);
+    if (existing) existing.push(file);
+    else buckets.set(key, [file]);
+  }
+
+  const dirName = dir ? (dir.split('/').pop() ?? null) : rootName;
+  const singleUnit = buckets.size === 1;
+
+  const units: ReleaseUnit[] = [];
+  for (const bucketFiles of buckets.values()) {
+    // On the whole path, not the file name: a disc-foldered unit holds several `track01.mp3`, and
+    // ordering by name interleaves the discs into track01, track01, track02, track02.
+    const ordered = [...bucketFiles].sort((a, b) => naturalCompare(a.input.path, b.input.path));
+    const mediaKind = getBookMediaKind(ordered[0]!.format) as ReleaseMediaKind;
+    const attached = sidecars.filter((sidecar) => matchesUnit(sidecar, ordered, singleUnit));
+
+    const planFiles: ReleasePlanFile[] = [
+      ...ordered.map((file, index) => toPlanFile(file, index)),
+      ...attached.map((file) => toPlanFile(file, null)),
+    ];
+
+    units.push({
+      mediaKind,
+      title: unitTitle(ordered, dirName, singleUnit),
+      files: planFiles,
+      primaryPath: primaryPathOf(ordered),
+      contentFileCount: ordered.length,
+      sizeBytes: sumSizes(planFiles),
+      directory: dir,
+    });
+  }
+
+  for (const sidecar of sidecars) {
+    if (!units.some((unit) => unit.files.some((file) => file.path === sidecar.input.path))) {
+      ignored.push({ path: sidecar.input.path, reason: 'unsupported' });
+    }
+  }
+
+  return units;
+}
+
+/**
+ * A directory with one unit owns all its artwork and sidecars. A directory with several - a comic
+ * run, a series pack - can only claim what its stem matches, because a lone `cover.jpg` beside 60
+ * issues belongs to no one issue in particular.
+ */
+function matchesUnit(sidecar: WorkingFile, unitFiles: WorkingFile[], singleUnit: boolean): boolean {
+  if (singleUnit) return true;
+  const stem = normalizeReleaseStem(stemOf(sidecar.name));
+  return unitFiles.some((file) => normalizeReleaseStem(stemOf(file.name)) === stem);
+}
+
+function toPlanFile(file: WorkingFile, sortOrder: number | null): ReleasePlanFile {
+  return { path: file.input.path, sizeBytes: file.input.sizeBytes, format: file.format, role: file.role, sortOrder };
+}
+
+function unitStem(file: WorkingFile): string {
+  return normalizeReleaseStem(stemOf(file.name));
+}
+
+/**
+ * The directory name is the better guess whenever it names the whole unit, which is the usual
+ * release shape. Inside a pack, where one directory holds several books, only the stem can tell
+ * them apart.
+ */
+function unitTitle(ordered: WorkingFile[], dirName: string | null, singleUnit: boolean): string | null {
+  if (singleUnit && dirName) return dirName;
+  const stem = stemOf(ordered[0]!.name)
+    .replace(/[\s._-]+/g, ' ')
+    .trim();
+  return stem || dirName;
+}
+
+/** Highest-priority format first, then natural order, so an m4b wins over track one of a set. */
+function primaryPathOf(ordered: WorkingFile[]): string {
+  const best = [...ordered].sort((a, b) => formatRank(a.format) - formatRank(b.format) || naturalCompare(a.input.path, b.input.path))[0]!;
+  return best.input.path;
+}
+
+/**
+ * Where a file sits *inside* its unit, `/` separated. This is what a placement has to preserve:
+ * flattening it to the file name makes the second disc overwrite the first.
+ */
+export function unitRelativePath(unit: ReleaseUnit, path: string): string {
+  if (!unit.directory) return path;
+  const prefix = `${unit.directory}/`;
+  return path.startsWith(prefix) ? path.slice(prefix.length) : path;
+}
+
+function formatRank(format: string | null): number {
+  if (!format) return Number.MAX_SAFE_INTEGER;
+  const index = FORMAT_RANK.indexOf(format.toLowerCase());
+  return index === -1 ? Number.MAX_SAFE_INTEGER : index;
+}
+
+const FORMAT_RANK: string[] = ['epub', 'kepub', 'azw3', 'azw', 'mobi', 'fb2', 'pdf', 'cbz', 'cbr', 'cb7', 'm4b', 'm4a', 'flac', 'opus', 'ogg', 'mp3'];
+
+function sumSizes(files: ReleasePlanFile[]): number | null {
+  let total = 0;
+  let seen = false;
+  for (const file of files) {
+    if (file.sizeBytes === null) continue;
+    total += file.sizeBytes;
+    seen = true;
+  }
+  return seen ? total : null;
+}
+
+/**
+ * Which unit of a plan to import. The second half of the interpreter's job, kept separate from
+ * `interpretRelease` because only this half needs to know what was requested: the picker asks what
+ * a release *is* without a request in hand, and the chooser needs the whole plan rather than one
+ * already narrowed down.
+ */
+export type ReleaseSelection =
+  { kind: 'unit'; unit: ReleaseUnit; ignored: ReleaseUnit[] } | { kind: 'ambiguous'; units: ReleaseUnit[] } | { kind: 'none' };
+
+export interface ReleaseSelectionContext {
+  /** What the request asked for. Narrows a mixed release without asking anyone. */
+  mediaKind?: ReleaseMediaKind | null;
+  /** A unit already chosen by a human, identified by the path a re-read of the release repeats. */
+  primaryPath?: string | null;
+}
+
+export function selectReleaseUnit(plan: ReleasePlan, context: ReleaseSelectionContext = {}): ReleaseSelection {
+  if (plan.units.length === 0) return { kind: 'none' };
+
+  // A choice already made wins over everything, including a media kind that disagrees with it: the
+  // person who made it was looking at the same list.
+  if (context.primaryPath) {
+    const chosen = plan.units.find((unit) => unit.primaryPath === context.primaryPath);
+    if (!chosen) return { kind: 'none' };
+    return { kind: 'unit', unit: chosen, ignored: plan.units.filter((unit) => unit !== chosen) };
+  }
+
+  if (plan.units.length === 1) return { kind: 'unit', unit: plan.units[0]!, ignored: [] };
+
+  const matching = context.mediaKind ? plan.units.filter((unit) => unit.mediaKind === context.mediaKind) : [];
+  if (matching.length === 1) {
+    return { kind: 'unit', unit: matching[0]!, ignored: plan.units.filter((unit) => unit !== matching[0]) };
+  }
+
+  return { kind: 'ambiguous', units: plan.units };
+}
diff --git a/server/src/modules/scanner/lib/stability.ts b/server/src/modules/scanner/lib/stability.ts
index 5370ec052..4c2299e0e 100644
--- a/server/src/modules/scanner/lib/stability.ts
+++ b/server/src/modules/scanner/lib/stability.ts
@@ -1,4 +1,5 @@
-import { stat } from 'fs/promises';
+import { readdir, stat } from 'fs/promises';
+import { join } from 'path';
 
 const POLL_INTERVAL_MS = 3_000;
 const STABLE_DURATION_MS = 10_000;
@@ -41,3 +42,83 @@ export async function waitForStability(absolutePath: string, knownMtimeMs?: numb
     await new Promise<void>((r) => setTimeout(r, POLL_INTERVAL_MS));
   }
 }
+
+/**
+ * How much of a dropped folder a single settle check will read. A release is books plus artwork,
+ * not a filesystem, and the point here is only to notice that the tree stopped growing.
+ */
+const DIRECTORY_MAX_DEPTH = 6;
+const DIRECTORY_MAX_ENTRIES = 5_000;
+
+interface DirectorySnapshot {
+  entries: number;
+  sizeBytes: number;
+  latestMtimeMs: number;
+}
+
+/**
+ * Wait until a directory tree stops growing: no new entries and no size changes for
+ * STABLE_DURATION_MS. The file version of this watches one mtime, which says nothing about a
+ * folder still receiving its twentieth track.
+ *
+ * Same shortcut as {@link waitForStability}: a tree whose newest file has not been touched in the
+ * last minute is already settled, so a rescan of an idle dock costs one walk rather than a wait.
+ * Returns silently if the directory disappears - the caller handles the missing case.
+ */
+export async function waitForDirectoryStability(absolutePath: string): Promise<void> {
+  let previous = await snapshotDirectory(absolutePath);
+  if (!previous) return;
+  if (Date.now() - previous.latestMtimeMs > RECENTLY_MODIFIED_THRESHOLD_MS) return;
+
+  const deadline = Date.now() + MAX_WAIT_MS;
+  let stableSince = Date.now();
+
+  while (Date.now() < deadline) {
+    await new Promise<void>((r) => setTimeout(r, POLL_INTERVAL_MS));
+
+    const current = await snapshotDirectory(absolutePath);
+    if (!current) return;
+
+    if (current.entries !== previous.entries || current.sizeBytes !== previous.sizeBytes || current.latestMtimeMs !== previous.latestMtimeMs) {
+      previous = current;
+      stableSince = Date.now();
+    } else if (Date.now() - stableSince >= STABLE_DURATION_MS) {
+      return;
+    }
+  }
+}
+
+async function snapshotDirectory(root: string): Promise<DirectorySnapshot | null> {
+  const snapshot: DirectorySnapshot = { entries: 0, sizeBytes: 0, latestMtimeMs: 0 };
+  let reachable = false;
+
+  const walk = async (dir: string, depth: number): Promise<void> => {
+    if (depth > DIRECTORY_MAX_DEPTH || snapshot.entries >= DIRECTORY_MAX_ENTRIES) return;
+    let entries;
+    try {
+      entries = await readdir(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    reachable = true;
+
+    for (const entry of entries) {
+      if (++snapshot.entries > DIRECTORY_MAX_ENTRIES) return;
+      const full = join(dir, entry.name);
+      if (entry.isDirectory()) {
+        await walk(full, depth + 1);
+        continue;
+      }
+      try {
+        const info = await stat(full);
+        snapshot.sizeBytes += info.size;
+        snapshot.latestMtimeMs = Math.max(snapshot.latestMtimeMs, info.mtimeMs);
+      } catch {
+        // A file that vanished between the listing and the stat is a change like any other.
+      }
+    }
+  };
+
+  await walk(root, 0);
+  return reachable ? snapshot : null;
+}
diff --git a/server/src/modules/scanner/lib/walk.ts b/server/src/modules/scanner/lib/walk.ts
index 1537db57e..f69eb414e 100644
--- a/server/src/modules/scanner/lib/walk.ts
+++ b/server/src/modules/scanner/lib/walk.ts
@@ -33,12 +33,12 @@ const DIR_CONCURRENCY_LIMIT = 50;
 // but avoids broad matches like "Discography".
 const DISC_DIR_PATTERN = /^(?:cd|disc|disk|part|pt|side)(?:[\s_-]*(?:\d+|[A-Za-z]|[IVXLCM]+))$/i;
 
-function isDiscDirectory(name: string): boolean {
+export function isDiscDirectory(name: string): boolean {
   return DISC_DIR_PATTERN.test(name);
 }
 
 // Returns the filename stem (basename without the last extension).
-function stemOf(name: string): string {
+export function stemOf(name: string): string {
   const i = name.lastIndexOf('.');
   return i > 0 ? name.slice(0, i) : name;
 }
diff --git a/server/src/modules/upload/upload-processor.service.test.ts b/server/src/modules/upload/upload-processor.service.test.ts
index ace829997..87efde2dc 100644
--- a/server/src/modules/upload/upload-processor.service.test.ts
+++ b/server/src/modules/upload/upload-processor.service.test.ts
@@ -31,6 +31,7 @@ describe('UploadProcessorService', () => {
   const selectFrom = vi.fn();
   const selectWhere = vi.fn();
   const selectLimit = vi.fn();
+  const deleteWhere = vi.fn();
 
   const tx = {
     select: vi.fn(() => ({ from: selectFrom })),
@@ -50,6 +51,10 @@ describe('UploadProcessorService', () => {
       if (table === books) return { set: updateBooksSet };
       throw new Error('unexpected table');
     }),
+    delete: vi.fn((table: unknown) => {
+      if (table === books || table === bookFiles) return { where: deleteWhere };
+      throw new Error('unexpected table');
+    }),
   };
 
   const db = {
@@ -73,6 +78,7 @@ describe('UploadProcessorService', () => {
     insertBookFilesReturning.mockResolvedValue([{ id: 420 }]);
     updateBooksSet.mockReturnValue({ where: updateBooksWhere });
     updateBooksWhere.mockResolvedValue(undefined);
+    deleteWhere.mockResolvedValue(undefined);
 
     orchestrator.scheduleImportedBooksIfEligible.mockResolvedValue(0);
 
@@ -326,4 +332,75 @@ describe('UploadProcessorService', () => {
       expect(metadataService.extractAndSave).toHaveBeenCalledWith(1, '/tmp/file.azw', 'azw');
     });
   });
+  /**
+   * Filing a 31-track audiobook through `createBookRecord` opened 31 transactions, so a failure on
+   * track three left the first two behind as a book nobody asked for.
+   */
+  describe('createUnitBookRecords', () => {
+    const unitFiles = [
+      { folderPath: '/library/Book', absolutePath: '/library/Book/track-01.mp3', relPath: 'Book/track-01.mp3', format: 'mp3', sizeBytes: 10 },
+      { folderPath: '/library/Book', absolutePath: '/library/Book/track-02.mp3', relPath: 'Book/track-02.mp3', format: 'mp3', sizeBytes: 20 },
+    ];
+
+    it('writes every file of the unit inside one transaction', async () => {
+      insertBooksReturning.mockResolvedValueOnce([{ id: 42 }]);
+      // The book created for the first file is found again for the second.
+      selectLimit
+        .mockResolvedValueOnce([])
+        .mockResolvedValueOnce([{ id: 42 }])
+        .mockResolvedValueOnce([]);
+
+      const result = await service.createUnitBookRecords(1, 2, unitFiles);
+
+      expect(db.transaction).toHaveBeenCalledTimes(1);
+      expect(result).toEqual({ bookIds: [42], createdBookIds: [42], attachedFileIds: [] });
+      expect(insertBooksValues).toHaveBeenCalledTimes(1);
+      expect(insertBookFilesValues).toHaveBeenCalledTimes(2);
+    });
+
+    it('remembers file rows added to a book that was already there', async () => {
+      // Existing book, and no `book_files` row yet at that path.
+      selectLimit.mockResolvedValueOnce([{ id: 99 }]).mockResolvedValueOnce([]);
+      insertBookFilesReturning.mockResolvedValueOnce([{ id: 777 }]);
+
+      const result = await service.createUnitBookRecords(1, 2, [unitFiles[0]!]);
+
+      expect(result).toEqual({ bookIds: [99], createdBookIds: [], attachedFileIds: [777] });
+    });
+
+    it('leaves a row that already pointed at that path out of the rollback set', async () => {
+      selectLimit.mockResolvedValueOnce([{ id: 99 }]).mockResolvedValueOnce([{ id: 777 }]);
+
+      const result = await service.createUnitBookRecords(1, 2, [unitFiles[0]!]);
+
+      expect(result).toEqual({ bookIds: [99], createdBookIds: [], attachedFileIds: [] });
+    });
+
+    it('hashes every file before opening the transaction', async () => {
+      await service.createUnitBookRecords(1, 2, unitFiles);
+
+      expect(mockComputeFileHash).toHaveBeenCalledTimes(2);
+      expect(db.transaction).toHaveBeenCalledTimes(1);
+    });
+
+    it('refuses an empty unit rather than creating a book with no files', async () => {
+      await expect(service.createUnitBookRecords(1, 2, [])).rejects.toBeInstanceOf(InternalServerErrorException);
+    });
+  });
+
+  describe('deleteUnitBookRecords', () => {
+    it('clears the file rows before the books that own them', async () => {
+      await service.deleteUnitBookRecords({ bookIds: [42], createdBookIds: [42], attachedFileIds: [777] });
+
+      expect(tx.delete).toHaveBeenNthCalledWith(1, bookFiles);
+      expect(tx.delete).toHaveBeenNthCalledWith(2, bookFiles);
+      expect(tx.delete).toHaveBeenNthCalledWith(3, books);
+    });
+
+    it('does nothing when the unit created nothing of its own', async () => {
+      await service.deleteUnitBookRecords({ bookIds: [99], createdBookIds: [], attachedFileIds: [] });
+
+      expect(db.transaction).not.toHaveBeenCalled();
+    });
+  });
 });
diff --git a/server/src/modules/upload/upload-processor.service.ts b/server/src/modules/upload/upload-processor.service.ts
index 24304a7c9..0d39084c8 100644
--- a/server/src/modules/upload/upload-processor.service.ts
+++ b/server/src/modules/upload/upload-processor.service.ts
@@ -1,8 +1,9 @@
 import { Inject, Injectable, InternalServerErrorException, Logger, Optional } from '@nestjs/common';
 import { stat } from 'fs/promises';
-import { and, eq } from 'drizzle-orm';
+import { and, eq, inArray } from 'drizzle-orm';
 import { NodePgDatabase } from 'drizzle-orm/node-postgres';
 import { isAudioFormat } from '@bookorbit/types';
+import type { FileRole as BookFileRole } from '../scanner/lib/classify';
 import { sanitizeLogValue } from '../../common/utils/log-sanitize.utils';
 
 import { DB } from '../../db';
@@ -13,6 +14,36 @@ import { MetadataService } from '../metadata/metadata.service';
 import { computeFileHash } from '../scanner/lib/hash';
 
 type Db = NodePgDatabase<typeof schema>;
+type Tx = Parameters<Parameters<Db['transaction']>[0]>[0];
+
+/** One file of a unit, already placed on disk, described the way `book_files` wants it. */
+export interface UnitBookFileInput {
+  folderPath: string;
+  absolutePath: string;
+  relPath: string;
+  format: string;
+  sizeBytes: number;
+  role?: BookFileRole;
+  sortOrder?: number | null;
+}
+
+/**
+ * What a unit actually wrote, so a later failure can take it back. `attachedFileIds` are rows
+ * added to books that were already there: undoing those must remove the file rows and leave the
+ * book alone.
+ */
+export interface UnitBookRecords {
+  /** Every book the unit touched, primary first. */
+  bookIds: number[];
+  createdBookIds: number[];
+  attachedFileIds: number[];
+}
+
+interface MeasuredFile {
+  ino: bigint;
+  mtime: Date;
+  fileHash: string;
+}
 
 const METADATA_FORMATS = new Set([
   'epub',
@@ -43,6 +74,12 @@ export class UploadProcessorService {
     @Optional() private readonly autoFetchOrchestrator?: BookMetadataFetchOrchestratorService,
   ) {}
 
+  /**
+   * One `book_files` row, attached to the book that owns `folderPath` or to a new one. Calling it
+   * repeatedly with the same `folderPath` is how a multi-file unit becomes one book with many
+   * files, and it is why the caller must pass the **primary file first**: `primaryFileId` is set
+   * only on the call that creates the book.
+   */
   async createBookRecord(
     libraryId: number,
     libraryFolderId: number,
@@ -51,71 +88,130 @@ export class UploadProcessorService {
     relPath: string,
     format: string,
     sizeBytes: number,
+    options: { role?: BookFileRole; sortOrder?: number | null } = {},
   ): Promise<{ bookId: number; created: boolean }> {
-    const [fileStat, fileHash] = await Promise.all([stat(absolutePath, { bigint: true }), computeFileHash(absolutePath)]);
-    const ino = fileStat.ino;
+    const measured = await this.measureFile(absolutePath);
+    const result = await this.db.transaction((tx) =>
+      this.upsertBookFile(tx, libraryId, libraryFolderId, { folderPath, absolutePath, relPath, format, sizeBytes, ...options }, measured),
+    );
+    return { bookId: result.bookId, created: result.createdBook };
+  }
 
-    const result = await this.db.transaction(async (tx) => {
-      const [existingBook] = await tx
-        .select({ id: books.id })
-        .from(books)
-        .where(and(eq(books.libraryId, libraryId), eq(books.folderPath, folderPath)))
-        .limit(1);
+  /**
+   * Every file of one unit in a single transaction. `createBookRecord` opens its own transaction
+   * per call, so filing a 31-track audiobook through it committed 31 times and a failure on track
+   * three left the first two behind as a ghost book. Here nothing is visible until all of it is.
+   *
+   * Files must arrive **primary first**: `primaryFileId` is set on the row that creates the book.
+   */
+  async createUnitBookRecords(libraryId: number, libraryFolderId: number, files: UnitBookFileInput[]): Promise<UnitBookRecords> {
+    if (files.length === 0) throw new InternalServerErrorException('Cannot create a book from an empty unit');
 
-      if (existingBook) {
-        const fileValues = {
-          bookId: existingBook.id,
-          libraryFolderId,
-          absolutePath,
-          relPath,
-          ino,
-          sizeBytes,
-          mtime: fileStat.mtime,
-          fileHash,
-          format,
-          role: 'content' as const,
-        };
-        const [file] = await tx
-          .insert(bookFiles)
-          .values(fileValues)
-          .onConflictDoUpdate({
-            target: bookFiles.absolutePath,
-            set: { bookId: existingBook.id, libraryFolderId, relPath, ino, sizeBytes, mtime: fileStat.mtime, fileHash, format },
-          })
-          .returning({ id: bookFiles.id });
-        if (!file) throw new InternalServerErrorException('Failed to create book file');
-        return { bookId: existingBook.id, created: false };
+    // Hashing is the expensive half and needs no transaction, so it happens before one is open
+    // rather than holding a write transaction for the length of a 31-track read.
+    const measured: MeasuredFile[] = [];
+    for (const file of files) measured.push(await this.measureFile(file.absolutePath));
+
+    return this.db.transaction(async (tx) => {
+      const bookIds: number[] = [];
+      const createdBookIds: number[] = [];
+      const attachedFileIds: number[] = [];
+
+      for (const [index, file] of files.entries()) {
+        const result = await this.upsertBookFile(tx, libraryId, libraryFolderId, file, measured[index]!);
+        if (!bookIds.includes(result.bookId)) bookIds.push(result.bookId);
+        if (result.createdBook) createdBookIds.push(result.bookId);
+        // A row on a book this unit created goes away with the book, so only rows attached to a
+        // book that was already there need remembering - and only the ones actually inserted,
+        // never one that was already pointing at that path.
+        else if (result.createdFile && !createdBookIds.includes(result.bookId)) attachedFileIds.push(result.fileId);
       }
 
-      const [book] = await tx.insert(books).values({ libraryId, libraryFolderId, folderPath, status: 'present' }).returning({ id: books.id });
-      if (!book) throw new InternalServerErrorException('Failed to create book record');
-
-      // Always create an empty metadata row so joins never return null (mirrors scanner behaviour).
-      await tx.insert(bookMetadata).values({ bookId: book.id });
-
-      const [file] = await tx
-        .insert(bookFiles)
-        .values({
-          bookId: book.id,
-          libraryFolderId,
-          absolutePath,
-          relPath,
-          ino,
-          sizeBytes,
-          mtime: fileStat.mtime,
-          fileHash,
-          format,
-          role: 'content',
-        })
-        .returning({ id: bookFiles.id });
-      if (!file) throw new InternalServerErrorException('Failed to create book file');
-
-      await tx.update(books).set({ primaryFileId: file.id }).where(eq(books.id, book.id));
-
-      return { bookId: book.id, created: true };
+      return { bookIds, createdBookIds, attachedFileIds };
     });
+  }
 
-    return result;
+  /**
+   * Takes back exactly what {@link createUnitBookRecords} wrote. Books it created go entirely,
+   * taking their files and metadata with them through the cascade; books it only attached to keep
+   * everything except the rows this unit added.
+   */
+  async deleteUnitBookRecords(records: UnitBookRecords): Promise<void> {
+    if (records.createdBookIds.length === 0 && records.attachedFileIds.length === 0) return;
+
+    await this.db.transaction(async (tx) => {
+      if (records.attachedFileIds.length > 0) {
+        await tx.delete(bookFiles).where(inArray(bookFiles.id, records.attachedFileIds));
+      }
+      if (records.createdBookIds.length > 0) {
+        // `books.primary_file_id` is `on delete set null`, so clearing the files first leaves
+        // nothing pointing at a row that is about to disappear.
+        await tx.delete(bookFiles).where(inArray(bookFiles.bookId, records.createdBookIds));
+        await tx.delete(books).where(inArray(books.id, records.createdBookIds));
+      }
+    });
+  }
+
+  private async measureFile(absolutePath: string): Promise<MeasuredFile> {
+    const [fileStat, fileHash] = await Promise.all([stat(absolutePath, { bigint: true }), computeFileHash(absolutePath)]);
+    return { ino: fileStat.ino, mtime: fileStat.mtime, fileHash };
+  }
+
+  private async upsertBookFile(
+    tx: Tx,
+    libraryId: number,
+    libraryFolderId: number,
+    file: UnitBookFileInput,
+    measured: MeasuredFile,
+  ): Promise<{ bookId: number; createdBook: boolean; fileId: number; createdFile: boolean }> {
+    const { folderPath, absolutePath, relPath, format, sizeBytes } = file;
+    const role = file.role ?? 'content';
+    const sortOrder = file.sortOrder ?? null;
+    const values = {
+      libraryFolderId,
+      absolutePath,
+      relPath,
+      ino: measured.ino,
+      sizeBytes,
+      mtime: measured.mtime,
+      fileHash: measured.fileHash,
+      format,
+      role,
+      sortOrder,
+    };
+
+    const [existingBook] = await tx
+      .select({ id: books.id })
+      .from(books)
+      .where(and(eq(books.libraryId, libraryId), eq(books.folderPath, folderPath)))
+      .limit(1);
+
+    if (existingBook) {
+      const [alreadyThere] = await tx.select({ id: bookFiles.id }).from(bookFiles).where(eq(bookFiles.absolutePath, absolutePath)).limit(1);
+      const [fileRow] = await tx
+        .insert(bookFiles)
+        .values({ ...values, bookId: existingBook.id })
+        .onConflictDoUpdate({ target: bookFiles.absolutePath, set: { ...values, bookId: existingBook.id } })
+        .returning({ id: bookFiles.id });
+      if (!fileRow) throw new InternalServerErrorException('Failed to create book file');
+      return { bookId: existingBook.id, createdBook: false, fileId: fileRow.id, createdFile: alreadyThere === undefined };
+    }
+
+    const [book] = await tx.insert(books).values({ libraryId, libraryFolderId, folderPath, status: 'present' }).returning({ id: books.id });
+    if (!book) throw new InternalServerErrorException('Failed to create book record');
+
+    // Always create an empty metadata row so joins never return null (mirrors scanner behaviour).
+    await tx.insert(bookMetadata).values({ bookId: book.id });
+
+    const [fileRow] = await tx
+      .insert(bookFiles)
+      .values({ ...values, bookId: book.id })
+      .returning({ id: bookFiles.id });
+    if (!fileRow) throw new InternalServerErrorException('Failed to create book file');
+
+    await tx.update(books).set({ primaryFileId: fileRow.id }).where(eq(books.id, book.id));
+
+    return { bookId: book.id, createdBook: true, fileId: fileRow.id, createdFile: true };
   }
 
   processNewBookImportAsync(bookId: number, libraryId: number, absolutePath: string, format: string): void {
diff --git a/server/src/modules/user-preferences/user-preferences.controller.test.ts b/server/src/modules/user-preferences/user-preferences.controller.test.ts
index bbdff0a7f..35a26afad 100644
--- a/server/src/modules/user-preferences/user-preferences.controller.test.ts
+++ b/server/src/modules/user-preferences/user-preferences.controller.test.ts
@@ -1,6 +1,7 @@
 import type { Mocked } from 'vitest';
 import {
   EMPTY_CONTENT_FILTER_RULES,
+  type BookRequestPreferences,
   type CoverSearchPreferences,
   type DisplayPreferences,
   type LocalePreferences,
@@ -85,10 +86,12 @@ describe('UserPreferencesController', () => {
       getDisplayPreferences: vi.fn(),
       getLocalePreferences: vi.fn(),
       getCoverSearchPreferences: vi.fn(),
+      getBookRequestPreferences: vi.fn(),
       upsertThemePreferences: vi.fn(),
       upsertDisplayPreferences: vi.fn(),
       upsertLocalePreferences: vi.fn(),
       upsertCoverSearchPreferences: vi.fn(),
+      upsertBookRequestPreferences: vi.fn(),
     } as unknown as Mocked<UserPreferencesService>;
 
     controller = new UserPreferencesController(service);
@@ -166,6 +169,21 @@ describe('UserPreferencesController', () => {
     expect(service.upsertCoverSearchPreferences).toHaveBeenCalledWith(42, validCoverSearchPreferences);
   });
 
+  it('GET /book-requests returns the pinned request destination', async () => {
+    const preferences: BookRequestPreferences = { defaultLibraryId: 4, defaultFolderId: 9 };
+    service.getBookRequestPreferences.mockResolvedValueOnce(preferences);
+
+    await expect(controller.getBookRequestPreferences(makeUser({ id: 11 }))).resolves.toEqual({ settings: preferences });
+    expect(service.getBookRequestPreferences).toHaveBeenCalledWith(11);
+  });
+
+  it('PUT /book-requests forwards the current user id and settings', async () => {
+    const dto = { settings: { defaultLibraryId: 4, defaultFolderId: null } };
+
+    await expect(controller.upsertBookRequestPreferences(dto, makeUser({ id: 42 }))).resolves.toBeUndefined();
+    expect(service.upsertBookRequestPreferences).toHaveBeenCalledWith(42, dto.settings);
+  });
+
   it('GET /locale returns null settings when no saved preferences exist', async () => {
     service.getLocalePreferences.mockResolvedValueOnce(null);
 
diff --git a/server/src/modules/user-preferences/user-preferences.controller.ts b/server/src/modules/user-preferences/user-preferences.controller.ts
index 2b0dc632b..7947d96b6 100644
--- a/server/src/modules/user-preferences/user-preferences.controller.ts
+++ b/server/src/modules/user-preferences/user-preferences.controller.ts
@@ -45,6 +45,18 @@ export class UserPreferencesController {
     await this.userPreferencesService.upsertCoverSearchPreferences(user.id, dto.settings);
   }
 
+  @Get('book-requests')
+  async getBookRequestPreferences(@CurrentUser() user: RequestUser) {
+    const settings = await this.userPreferencesService.getBookRequestPreferences(user.id);
+    return { settings };
+  }
+
+  @Put('book-requests')
+  @HttpCode(204)
+  async upsertBookRequestPreferences(@Body() dto: UpsertUserPreferenceDto, @CurrentUser() user: RequestUser) {
+    await this.userPreferencesService.upsertBookRequestPreferences(user.id, dto.settings);
+  }
+
   @Get('locale')
   async getLocalePreferences(@CurrentUser() user: RequestUser) {
     const settings = await this.userPreferencesService.getLocalePreferences(user.id);
diff --git a/server/src/modules/user-preferences/user-preferences.service.test.ts b/server/src/modules/user-preferences/user-preferences.service.test.ts
index 443eedf03..585e7c98a 100644
--- a/server/src/modules/user-preferences/user-preferences.service.test.ts
+++ b/server/src/modules/user-preferences/user-preferences.service.test.ts
@@ -2,6 +2,7 @@ import { BadRequestException } from '@nestjs/common';
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 import type {
   Accent,
+  BookRequestPreferences,
   CoverSearchPreferences,
   DisplayPreferences,
   LocalePreferences,
@@ -95,13 +96,17 @@ const validCoverSearchPreferences: CoverSearchPreferences = {
   defaultProvider: 'itunes',
 };
 
+const validBookRequestPreferences: BookRequestPreferences = { defaultLanguage: 'de' };
+
 const repo = {
-  findByCategory:
-    vi.fn<
-      (
-        ...args: [number, string]
-      ) => Promise<{ data: ThemePreferences | DisplayPreferences | LocalePreferences | ServerFontPreferences | CoverSearchPreferences } | undefined>
-    >(),
+  findByCategory: vi.fn<
+    (...args: [number, string]) => Promise<
+      | {
+          data: ThemePreferences | DisplayPreferences | LocalePreferences | ServerFontPreferences | CoverSearchPreferences | BookRequestPreferences;
+        }
+      | undefined
+    >
+  >(),
   upsert: vi.fn<(...args: [number, string, Record<string, unknown>]) => Promise<void>>(),
   delete: vi.fn<(...args: [number, string]) => Promise<void>>(),
 };
@@ -172,6 +177,66 @@ describe('UserPreferencesService', () => {
     expect(repo.upsert).not.toHaveBeenCalled();
   });
 
+  it('getBookRequestPreferences returns no language when nothing was saved', async () => {
+    await expect(service.getBookRequestPreferences(7)).resolves.toEqual({ defaultLanguage: null });
+    expect(repo.findByCategory).toHaveBeenCalledWith(7, 'book-requests');
+  });
+
+  it('getBookRequestPreferences returns the pinned language', async () => {
+    repo.findByCategory.mockResolvedValueOnce({ data: validBookRequestPreferences });
+
+    await expect(service.getBookRequestPreferences(7)).resolves.toEqual(validBookRequestPreferences);
+  });
+
+  it('getBookRequestPreferences falls back safely when stored data is malformed', async () => {
+    repo.findByCategory.mockResolvedValueOnce({ data: { defaultLanguage: 'klingon' } } as never);
+
+    await expect(service.getBookRequestPreferences(7)).resolves.toEqual({ defaultLanguage: null });
+  });
+
+  it('upsertBookRequestPreferences saves a pinned language', async () => {
+    await expect(service.upsertBookRequestPreferences(11, { ...validBookRequestPreferences })).resolves.toBeUndefined();
+    expect(repo.upsert).toHaveBeenCalledWith(11, 'book-requests', validBookRequestPreferences);
+  });
+
+  /**
+   * Destinations lived in this category under two different shapes before the instance default
+   * replaced them. Rows written by either build still exist, and both must keep their language
+   * rather than failing strict validation and reverting the whole category to the defaults.
+   */
+  it('getBookRequestPreferences drops a destination pinned before the instance default existed', async () => {
+    repo.findByCategory.mockResolvedValueOnce({ data: { defaultLibraryId: 4, defaultFolderId: 9, defaultLanguage: 'de' } } as never);
+
+    await expect(service.getBookRequestPreferences(7)).resolves.toEqual({ defaultLanguage: 'de' });
+  });
+
+  it('getBookRequestPreferences drops a per-medium destination too', async () => {
+    repo.findByCategory.mockResolvedValueOnce({
+      data: { destinations: { ebook: { libraryId: 4, folderId: 9 } }, defaultLanguage: 'de' },
+    } as never);
+
+    await expect(service.getBookRequestPreferences(7)).resolves.toEqual({ defaultLanguage: 'de' });
+  });
+
+  it('upsertBookRequestPreferences drops a destination a stale client still sends', async () => {
+    await expect(service.upsertBookRequestPreferences(11, { defaultLibraryId: 4, defaultLanguage: 'de' })).resolves.toBeUndefined();
+    expect(repo.upsert).toHaveBeenCalledWith(11, 'book-requests', { defaultLanguage: 'de' });
+  });
+
+  it('upsertBookRequestPreferences rejects a language no release could be matched against', async () => {
+    await expect(service.upsertBookRequestPreferences(11, { ...validBookRequestPreferences, defaultLanguage: 'klingon' })).rejects.toBeInstanceOf(
+      BadRequestException,
+    );
+    expect(repo.upsert).not.toHaveBeenCalled();
+  });
+
+  it('upsertBookRequestPreferences rejects unknown fields', async () => {
+    await expect(service.upsertBookRequestPreferences(11, { ...validBookRequestPreferences, unexpected: true })).rejects.toBeInstanceOf(
+      BadRequestException,
+    );
+    expect(repo.upsert).not.toHaveBeenCalled();
+  });
+
   it('getLocalePreferences returns null when repository has no row', async () => {
     await expect(service.getLocalePreferences(7)).resolves.toBeNull();
     expect(repo.findByCategory).toHaveBeenCalledWith(7, 'locale');
diff --git a/server/src/modules/user-preferences/user-preferences.service.ts b/server/src/modules/user-preferences/user-preferences.service.ts
index 3210c4bbb..901426ed5 100644
--- a/server/src/modules/user-preferences/user-preferences.service.ts
+++ b/server/src/modules/user-preferences/user-preferences.service.ts
@@ -12,17 +12,21 @@ import {
   CARD_OVERLAY_KEYS,
   COVER_SEARCH_DEFAULT_PROVIDERS,
   COVER_SIZE_SCOPES,
+  DEFAULT_BOOK_REQUEST_PREFERENCES,
+  RETIRED_BOOK_REQUEST_PREFERENCE_FIELDS,
   DEFAULT_COVER_SEARCH_PROVIDER,
   FONT_FAMILY_NAME_MAX_LENGTH,
   GRID_CARD_LABEL_FIELDS,
   MAX_SERVER_FONTS,
   RADIUS_IDS,
+  REQUEST_LANGUAGE_CODES,
   SERIES_CARD_COVER_MODES,
   SUPPORTED_LOCALES,
   SURFACE_OPACITY_MAX,
   SURFACE_OPACITY_MIN,
   TABLE_DENSITIES,
   THEME_IDS,
+  type BookRequestPreferences,
   type DisplayPreferences,
   type CoverSearchPreferences,
   type LocalePreferences,
@@ -97,6 +101,39 @@ const COVER_SEARCH_DEFAULTS: CoverSearchPreferences = {
   defaultProvider: DEFAULT_COVER_SEARCH_PROVIDER,
 };
 
+/**
+ * Destinations used to live here: first one pair for every medium, then one pair per medium. Both
+ * are now answered by the instance default, so anything stored under either shape is dropped on
+ * the way in rather than rejected. The object is strict and a strict parse failure falls back to
+ * the defaults, which would take the user's pinned language down with it.
+ */
+function dropRetiredFields(value: unknown): unknown {
+  if (typeof value !== 'object' || value === null) return value;
+  const record = { ...(value as Record<string, unknown>) };
+  for (const field of RETIRED_BOOK_REQUEST_PREFERENCE_FIELDS) delete record[field];
+  return record;
+}
+
+const BOOK_REQUEST_PREFERENCES_SCHEMA = z.preprocess(
+  dropRetiredFields,
+  z
+    .object({
+      /**
+       * Defaulted rather than required, so a row stored before this field existed still parses.
+       *
+       * Restricted to codes the release matcher can actually compare: a language it does not know
+       * is a hard filter nothing satisfies, so storing one would reject every release rather than
+       * leaving the field open.
+       */
+      defaultLanguage: z
+        .string()
+        .refine((value) => REQUEST_LANGUAGE_CODES.includes(value), { message: 'must be a language the release matcher can compare' })
+        .nullable()
+        .default(null),
+    })
+    .strict(),
+);
+
 const LOCALE_PREFERENCES_SCHEMA = z
   .object({
     locale: z.enum(SUPPORTED_LOCALES),
@@ -260,6 +297,24 @@ export class UserPreferencesService {
     await this.repo.upsert(userId, 'cover-search', result.data);
   }
 
+  async getBookRequestPreferences(userId: number): Promise<BookRequestPreferences> {
+    const row = await this.repo.findByCategory(userId, 'book-requests');
+    const result = BOOK_REQUEST_PREFERENCES_SCHEMA.safeParse(row?.data);
+    return result.success ? result.data : { ...DEFAULT_BOOK_REQUEST_PREFERENCES };
+  }
+
+  async upsertBookRequestPreferences(userId: number, data: Record<string, unknown>): Promise<void> {
+    const result = BOOK_REQUEST_PREFERENCES_SCHEMA.safeParse(data);
+    if (!result.success) {
+      const firstIssue = result.error.issues[0];
+      const issuePath = firstIssue?.path.length ? firstIssue.path.join('.') : 'settings';
+      const issueMessage = firstIssue?.message ?? 'Invalid settings payload';
+      throw new BadRequestException(`Invalid book request preferences at "${issuePath}": ${issueMessage}`);
+    }
+
+    await this.repo.upsert(userId, 'book-requests', result.data);
+  }
+
   async upsertThemePreferences(userId: number, data: Record<string, unknown>): Promise<void> {
     const start = Date.now();
     this.logger.log(`[user_preferences.upsert_theme] [start] userId=${userId} - upsert theme preferences started`);
diff --git a/server/src/modules/user/content-filter.repository.test.ts b/server/src/modules/user/content-filter.repository.test.ts
index eedf0d7a6..67b8a6fe7 100644
--- a/server/src/modules/user/content-filter.repository.test.ts
+++ b/server/src/modules/user/content-filter.repository.test.ts
@@ -51,6 +51,15 @@ describe('ContentFilterRepository', () => {
     });
   });
 
+  it('findByUserId carries the exemption only for a user who has it', async () => {
+    mockDb.where.mockResolvedValueOnce([]).mockResolvedValueOnce([]);
+    await expect(repo.findByUserId(7)).resolves.not.toHaveProperty('exemptRequestsFromUserId');
+
+    mockDb.where.mockResolvedValueOnce([]).mockResolvedValueOnce([]);
+    mockDb.limit.mockResolvedValueOnce([{ seeOwnRequestedBooks: true }]);
+    await expect(repo.findByUserId(7)).resolves.toMatchObject({ exemptRequestsFromUserId: 7 });
+  });
+
   it('findByUserIdWithNames returns named include and exclude items', async () => {
     mockDb.where
       .mockResolvedValueOnce([
@@ -67,6 +76,7 @@ describe('ContentFilterRepository', () => {
       excludeTags: [{ id: 2, name: 'Horror' }],
       includeGenres: [{ id: 3, name: 'Fantasy' }],
       excludeGenres: [{ id: 4, name: 'Thriller' }],
+      seeOwnRequestedBooks: false,
     });
   });
 
diff --git a/server/src/modules/user/content-filter.repository.ts b/server/src/modules/user/content-filter.repository.ts
index b176aaf0c..3191f8825 100644
--- a/server/src/modules/user/content-filter.repository.ts
+++ b/server/src/modules/user/content-filter.repository.ts
@@ -1,5 +1,5 @@
 import { BadRequestException, Inject, Injectable } from '@nestjs/common';
-import { eq, inArray } from 'drizzle-orm';
+import { and, eq, inArray } from 'drizzle-orm';
 import { NodePgDatabase } from 'drizzle-orm/node-postgres';
 
 import type { ContentFilterRules, ContentFilterRulesWithNames } from '@bookorbit/types';
@@ -13,7 +13,7 @@ export class ContentFilterRepository {
   constructor(@Inject(DB) private readonly db: Db) {}
 
   async findByUserId(userId: number): Promise<ContentFilterRules> {
-    const [tagRows, genreRows] = await Promise.all([
+    const [tagRows, genreRows, exemptRows] = await Promise.all([
       this.db
         .select({ filterType: schema.userContentFilterTags.filterType, tagId: schema.userContentFilterTags.tagId })
         .from(schema.userContentFilterTags)
@@ -22,6 +22,7 @@ export class ContentFilterRepository {
         .select({ filterType: schema.userContentFilterGenres.filterType, genreId: schema.userContentFilterGenres.genreId })
         .from(schema.userContentFilterGenres)
         .where(eq(schema.userContentFilterGenres.userId, userId)),
+      this.db.select({ seeOwnRequestedBooks: schema.users.seeOwnRequestedBooks }).from(schema.users).where(eq(schema.users.id, userId)).limit(1),
     ]);
 
     return {
@@ -29,11 +30,12 @@ export class ContentFilterRepository {
       excludeTagIds: tagRows.filter((r) => r.filterType === 'exclude').map((r) => r.tagId),
       includeGenreIds: genreRows.filter((r) => r.filterType === 'include').map((r) => r.genreId),
       excludeGenreIds: genreRows.filter((r) => r.filterType === 'exclude').map((r) => r.genreId),
+      ...(exemptRows[0]?.seeOwnRequestedBooks ? { exemptRequestsFromUserId: userId } : {}),
     };
   }
 
   async findByUserIdWithNames(userId: number): Promise<ContentFilterRulesWithNames> {
-    const [tagRows, genreRows] = await Promise.all([
+    const [tagRows, genreRows, exemptRows] = await Promise.all([
       this.db
         .select({
           filterType: schema.userContentFilterTags.filterType,
@@ -52,6 +54,7 @@ export class ContentFilterRepository {
         .from(schema.userContentFilterGenres)
         .innerJoin(schema.genres, eq(schema.userContentFilterGenres.genreId, schema.genres.id))
         .where(eq(schema.userContentFilterGenres.userId, userId)),
+      this.db.select({ seeOwnRequestedBooks: schema.users.seeOwnRequestedBooks }).from(schema.users).where(eq(schema.users.id, userId)).limit(1),
     ]);
 
     return {
@@ -59,6 +62,7 @@ export class ContentFilterRepository {
       excludeTags: tagRows.filter((r) => r.filterType === 'exclude').map((r) => ({ id: r.tagId, name: r.tagName })),
       includeGenres: genreRows.filter((r) => r.filterType === 'include').map((r) => ({ id: r.genreId, name: r.genreName })),
       excludeGenres: genreRows.filter((r) => r.filterType === 'exclude').map((r) => ({ id: r.genreId, name: r.genreName })),
+      seeOwnRequestedBooks: exemptRows[0]?.seeOwnRequestedBooks ?? false,
     };
   }
 
@@ -127,6 +131,17 @@ export class ContentFilterRepository {
     return result;
   }
 
+  /** Which of these users may see books they requested regardless of their own restrictions. */
+  async findExemptUserIds(userIds: number[]): Promise<Set<number>> {
+    if (userIds.length === 0) return new Set();
+
+    const rows = await this.db
+      .select({ id: schema.users.id })
+      .from(schema.users)
+      .where(and(inArray(schema.users.id, userIds), eq(schema.users.seeOwnRequestedBooks, true)));
+    return new Set(rows.map((r) => r.id));
+  }
+
   private async validateEntityIds(tagIds: number[], genreIds: number[]): Promise<void> {
     if (tagIds.length > 0) {
       const existing = await this.db.select({ id: schema.tags.id }).from(schema.tags).where(inArray(schema.tags.id, tagIds));
diff --git a/server/src/modules/user/dto/set-content-filters.dto.ts b/server/src/modules/user/dto/set-content-filters.dto.ts
index 2779927c1..0112be517 100644
--- a/server/src/modules/user/dto/set-content-filters.dto.ts
+++ b/server/src/modules/user/dto/set-content-filters.dto.ts
@@ -1,4 +1,4 @@
-import { IsArray, IsInt, IsOptional } from 'class-validator';
+import { IsArray, IsBoolean, IsInt, IsOptional } from 'class-validator';
 
 export class SetContentFiltersDto {
   @IsOptional()
@@ -20,4 +20,9 @@ export class SetContentFiltersDto {
   @IsArray()
   @IsInt({ each: true })
   excludeGenreIds?: number[];
+
+  /** Lets books this user requested through the rules above. Omitted leaves the current setting. */
+  @IsOptional()
+  @IsBoolean()
+  seeOwnRequestedBooks?: boolean;
 }
diff --git a/server/src/modules/user/user-events.service.ts b/server/src/modules/user/user-events.service.ts
new file mode 100644
index 000000000..220c772e8
--- /dev/null
+++ b/server/src/modules/user/user-events.service.ts
@@ -0,0 +1,25 @@
+import { Injectable } from '@nestjs/common';
+import { EventEmitter } from 'events';
+
+/**
+ * Emitted with the id of an account that is about to be deleted, before anything is removed.
+ *
+ * Deleting a user cascades their rows away, and some of those rows are the only record of work
+ * running somewhere else: a torrent in a download client, a file this process is still fetching.
+ * Once the row is gone nothing knows the work exists, so whoever owns it has to be given the
+ * chance to stop it first - which is why this fires before the delete and is waited on.
+ *
+ * The seam exists so the user module never learns what a book request is. A listener that throws
+ * must not be able to stop an account being deleted, so the emitter logs and continues. What it
+ * waits on is bounded by the listener: the download clients it talks to answer or time out.
+ */
+export const USER_DELETING = 'user.deleting';
+
+export interface UserDeletingEvent {
+  userId: number;
+  /** Registers work to finish before the account and everything cascading from it is removed. */
+  waitFor(work: Promise<void>): void;
+}
+
+@Injectable()
+export class UserEventsService extends EventEmitter {}
diff --git a/server/src/modules/user/user.module.test.ts b/server/src/modules/user/user.module.test.ts
index af28cdc4d..b268d54fb 100644
--- a/server/src/modules/user/user.module.test.ts
+++ b/server/src/modules/user/user.module.test.ts
@@ -5,6 +5,7 @@ import { OidcIdentityRepository } from './oidc-identity.repository';
 import { UserController } from './user.controller';
 import { UserAvatarStorageService } from './user-avatar-storage.service';
 import { UserAvatarService } from './user-avatar.service';
+import { UserEventsService } from './user-events.service';
 import { UserModule } from './user.module';
 import { UserRepository } from './user.repository';
 import { UserService } from './user.service';
@@ -19,6 +20,7 @@ describe('UserModule', () => {
       UserAvatarStorageService,
       OidcIdentityRepository,
       ContentFilterRepository,
+      UserEventsService,
     ]);
     expect(Reflect.getMetadata('exports', UserModule)).toEqual([
       UserService,
@@ -27,6 +29,7 @@ describe('UserModule', () => {
       UserAvatarStorageService,
       OidcIdentityRepository,
       ContentFilterRepository,
+      UserEventsService,
     ]);
   });
 });
diff --git a/server/src/modules/user/user.module.ts b/server/src/modules/user/user.module.ts
index 64478c393..60543f984 100644
--- a/server/src/modules/user/user.module.ts
+++ b/server/src/modules/user/user.module.ts
@@ -6,6 +6,7 @@ import { ContentFilterRepository } from './content-filter.repository';
 import { OidcIdentityRepository } from './oidc-identity.repository';
 import { UserAvatarStorageService } from './user-avatar-storage.service';
 import { UserAvatarService } from './user-avatar.service';
+import { UserEventsService } from './user-events.service';
 import { UserController } from './user.controller';
 import { UserRepository } from './user.repository';
 import { UserService } from './user.service';
@@ -13,7 +14,23 @@ import { UserService } from './user.service';
 @Module({
   imports: [AppSettingsModule, UserStatisticsModule],
   controllers: [UserController],
-  providers: [UserService, UserRepository, UserAvatarService, UserAvatarStorageService, OidcIdentityRepository, ContentFilterRepository],
-  exports: [UserService, UserRepository, UserAvatarService, UserAvatarStorageService, OidcIdentityRepository, ContentFilterRepository],
+  providers: [
+    UserService,
+    UserRepository,
+    UserAvatarService,
+    UserAvatarStorageService,
+    OidcIdentityRepository,
+    ContentFilterRepository,
+    UserEventsService,
+  ],
+  exports: [
+    UserService,
+    UserRepository,
+    UserAvatarService,
+    UserAvatarStorageService,
+    OidcIdentityRepository,
+    ContentFilterRepository,
+    UserEventsService,
+  ],
 })
 export class UserModule {}
diff --git a/server/src/modules/user/user.repository.test.ts b/server/src/modules/user/user.repository.test.ts
index 4214071b9..444f9cf50 100644
--- a/server/src/modules/user/user.repository.test.ts
+++ b/server/src/modules/user/user.repository.test.ts
@@ -28,6 +28,7 @@ vi.mock('bcryptjs', () => ({ hash: vi.fn() }));
 import { hash } from 'bcryptjs';
 import { createHash, randomBytes, randomUUID } from 'crypto';
 import { eq, ilike, sql } from 'drizzle-orm';
+import { Permission } from '@bookorbit/types';
 
 import * as schema from '../../db/schema';
 import { UserRepository } from './user.repository';
@@ -634,6 +635,34 @@ describe('UserRepository', () => {
     expect(tx.delete).not.toHaveBeenCalled();
   });
 
+  it('deleteManagedUser finishes dependent cleanup before deleting the user row', async () => {
+    const lifecycleWhere = vi.fn().mockResolvedValue([
+      { id: 1, active: false, isSuperuser: false, provisioningMethod: 'local' },
+      { id: 12, active: true, isSuperuser: false, provisioningMethod: 'local' },
+    ]);
+    const lifecycleFrom = vi.fn().mockReturnValue({ where: lifecycleWhere });
+    const order: string[] = [];
+    const deleteWhere = vi.fn().mockImplementation(() => {
+      order.push('delete');
+      return Promise.resolve();
+    });
+    const tx = {
+      execute: vi.fn().mockResolvedValue(undefined),
+      select: vi.fn().mockReturnValue({ from: lifecycleFrom }),
+      delete: vi.fn().mockReturnValue({ where: deleteWhere }),
+    };
+    db.transaction.mockImplementation((callback) => callback(tx as never));
+
+    await expect(
+      repo.deleteManagedUser(1, 12, () => {
+        order.push('cleanup');
+        return Promise.resolve();
+      }),
+    ).resolves.toBe('updated');
+
+    expect(order).toEqual(['cleanup', 'delete']);
+  });
+
   it('clearLockout resets the attempt counter and the lock timestamp', async () => {
     await repo.clearLockout(12);
 
@@ -667,6 +696,70 @@ describe('UserRepository', () => {
     ]);
   });
 
+  /**
+   * Enforced here rather than in the service because this is the one line every assignment path
+   * reaches, OIDC auto-provisioning included, and that path skips the service entirely.
+   */
+  it('setPermissions grants a permission that would otherwise be inert without its dependency', async () => {
+    const txInsertValues = vi.fn().mockResolvedValue(undefined);
+    db.transaction.mockImplementation(async (cb: (tx: unknown) => Promise<void>) =>
+      cb({
+        delete: vi.fn().mockReturnValue({ where: vi.fn().mockResolvedValue(undefined) }),
+        insert: vi.fn().mockReturnValue({ values: txInsertValues }),
+      }),
+    );
+
+    await repo.setPermissions(7, [Permission.BookRequestSelfFulfill]);
+
+    expect(txInsertValues).toHaveBeenCalledWith([
+      { userId: 7, permissionName: Permission.BookRequestSelfFulfill },
+      { userId: 7, permissionName: Permission.BookRequestAccess },
+    ]);
+  });
+
+  /**
+   * Moderating the queue is a superset of using it. Without this a `manage_book_requests` grant
+   * produced an account the queue websocket rejected and the summary route answered 403 to.
+   */
+  it('setPermissions pulls book request access in behind the moderator and auto-approve grants', async () => {
+    const txInsertValues = vi.fn().mockResolvedValue(undefined);
+    db.transaction.mockImplementation(async (cb: (tx: unknown) => Promise<void>) =>
+      cb({
+        delete: vi.fn().mockReturnValue({ where: vi.fn().mockResolvedValue(undefined) }),
+        insert: vi.fn().mockReturnValue({ values: txInsertValues }),
+      }),
+    );
+
+    await repo.setPermissions(7, [Permission.ManageBookRequests]);
+    expect(txInsertValues).toHaveBeenCalledWith([
+      { userId: 7, permissionName: Permission.ManageBookRequests },
+      { userId: 7, permissionName: Permission.BookRequestAccess },
+    ]);
+
+    await repo.setPermissions(7, [Permission.BookRequestAutoApprove]);
+    expect(txInsertValues).toHaveBeenLastCalledWith([
+      { userId: 7, permissionName: Permission.BookRequestAutoApprove },
+      { userId: 7, permissionName: Permission.BookRequestAccess },
+    ]);
+  });
+
+  it('setPermissions does not duplicate a dependency that was already selected', async () => {
+    const txInsertValues = vi.fn().mockResolvedValue(undefined);
+    db.transaction.mockImplementation(async (cb: (tx: unknown) => Promise<void>) =>
+      cb({
+        delete: vi.fn().mockReturnValue({ where: vi.fn().mockResolvedValue(undefined) }),
+        insert: vi.fn().mockReturnValue({ values: txInsertValues }),
+      }),
+    );
+
+    await repo.setPermissions(7, [Permission.BookRequestAccess, Permission.BookRequestSelfFulfill]);
+
+    expect(txInsertValues).toHaveBeenCalledWith([
+      { userId: 7, permissionName: Permission.BookRequestAccess },
+      { userId: 7, permissionName: Permission.BookRequestSelfFulfill },
+    ]);
+  });
+
   it('incrementTokenVersion updates with SQL expression', async () => {
     await repo.incrementTokenVersion(4);
 
diff --git a/server/src/modules/user/user.repository.ts b/server/src/modules/user/user.repository.ts
index 8571be6a6..19db16bcf 100644
--- a/server/src/modules/user/user.repository.ts
+++ b/server/src/modules/user/user.repository.ts
@@ -5,7 +5,7 @@ import type { SQL } from 'drizzle-orm';
 import { NodePgDatabase } from 'drizzle-orm/node-postgres';
 import { hash } from 'bcryptjs';
 
-import { Permission } from '@bookorbit/types';
+import { Permission, withRequiredPermissions } from '@bookorbit/types';
 import type { UserAttentionReason, UserListSortDirection, UserListSortField, UserListState, UserListSummary } from '@bookorbit/types';
 import { RequestUser } from '../../common/types/request-user';
 import { DB } from '../../db';
@@ -319,6 +319,7 @@ export class UserRepository {
           avatarSource: schema.users.avatarSource,
           avatarVersion: schema.users.avatarVersion,
           provisioningMethod: schema.users.provisioningMethod,
+          seeOwnRequestedBooks: schema.users.seeOwnRequestedBooks,
           permissionName: schema.userPermissions.permissionName,
         })
         .from(schema.users)
@@ -365,6 +366,7 @@ export class UserRepository {
         excludeTagIds: tagFilterRows.filter((r) => r.filterType === 'exclude').map((r) => r.tagId),
         includeGenreIds: genreFilterRows.filter((r) => r.filterType === 'include').map((r) => r.genreId),
         excludeGenreIds: genreFilterRows.filter((r) => r.filterType === 'exclude').map((r) => r.genreId),
+        ...(first.seeOwnRequestedBooks ? { exemptRequestsFromUserId: first.id } : {}),
       },
     };
   }
@@ -379,7 +381,7 @@ export class UserRepository {
     return user;
   }
 
-  async update(id: number, data: Partial<Pick<typeof schema.users.$inferInsert, 'name' | 'email' | 'active' | 'settings'>>) {
+  async update(id: number, data: Partial<Pick<typeof schema.users.$inferInsert, 'name' | 'email' | 'active' | 'settings' | 'seeOwnRequestedBooks'>>) {
     const { settings, ...rest } = data;
     const setData: Record<string, unknown> = { ...rest, updatedAt: new Date() };
     if (settings !== undefined) {
@@ -436,7 +438,7 @@ export class UserRepository {
     await this.db.delete(schema.users).where(eq(schema.users.id, id));
   }
 
-  async deleteManagedUser(requestingUserId: number, targetUserId: number): Promise<ManagedUserMutationStatus> {
+  async deleteManagedUser(requestingUserId: number, targetUserId: number, beforeDelete?: () => Promise<void>): Promise<ManagedUserMutationStatus> {
     return this.db.transaction(async (tx) => {
       await this.lockSuperuserLifecycle(tx);
       const { requester, target } = await this.findLifecycleUsers(tx, requestingUserId, targetUserId);
@@ -444,16 +446,25 @@ export class UserRepository {
       if (target.isSuperuser && !this.isActiveSuperuser(requester)) return 'requester_not_superuser';
       if (target.isSuperuser && (await this.countOtherActiveSuperusers(tx, targetUserId)) === 0) return 'last_superuser';
 
+      if (beforeDelete) await beforeDelete();
       await tx.delete(schema.users).where(eq(schema.users.id, targetUserId));
       return 'updated';
     });
   }
 
+  /**
+   * The one chokepoint every assignment path reaches, which is why the dependency rule lives here
+   * rather than in the service: user creation, shared-user creation, the permissions endpoint and
+   * OIDC auto-provisioning all end up on this line, and the OIDC one skips the service's own
+   * normalisation entirely. A permission that is inert without another is granted with it.
+   */
   async setPermissions(userId: number, permissionNames: Permission[]) {
+    const resolved = withRequiredPermissions(permissionNames);
+
     await this.db.transaction(async (tx) => {
       await tx.delete(schema.userPermissions).where(eq(schema.userPermissions.userId, userId));
-      if (permissionNames.length > 0) {
-        await tx.insert(schema.userPermissions).values(permissionNames.map((permissionName) => ({ userId, permissionName })));
+      if (resolved.length > 0) {
+        await tx.insert(schema.userPermissions).values(resolved.map((permissionName) => ({ userId, permissionName })));
       }
     });
   }
diff --git a/server/src/modules/user/user.service.test.ts b/server/src/modules/user/user.service.test.ts
index 40c6b2db0..09c15b83a 100644
--- a/server/src/modules/user/user.service.test.ts
+++ b/server/src/modules/user/user.service.test.ts
@@ -6,6 +6,7 @@ import { hash } from 'bcryptjs';
 import { randomBytes } from 'crypto';
 import { Permission } from '@bookorbit/types';
 
+import { USER_DELETING, UserEventsService, type UserDeletingEvent } from './user-events.service';
 import { UserService } from './user.service';
 
 const mockHash = hash as MockedFunction<typeof hash>;
@@ -60,12 +61,14 @@ describe('UserService', () => {
   };
 
   let service: UserService;
+  let events: UserEventsService;
 
   beforeEach(() => {
     vi.resetAllMocks();
     vi.spyOn(Logger.prototype, 'log').mockImplementation(() => undefined);
     vi.spyOn(Logger.prototype, 'warn').mockImplementation(() => undefined);
-    service = new UserService(userRepo as any, config as any, contentFilterRepo as any, appSettingsService as any, userStatistics as any);
+    events = new UserEventsService();
+    service = new UserService(userRepo as any, config as any, contentFilterRepo as any, appSettingsService as any, userStatistics as any, events);
 
     mockHash.mockResolvedValue('hashed-secret');
     mockRandomBytes.mockReturnValue(Buffer.from('abcd', 'hex'));
@@ -465,7 +468,53 @@ describe('UserService', () => {
 
   it('deleteUser deletes non-superuser targets', async () => {
     await expect(service.deleteUser(2, reqUser({ isSuperuser: false }))).resolves.toBeUndefined();
-    expect(userRepo.deleteManagedUser).toHaveBeenCalledWith(1, 2);
+    expect(userRepo.deleteManagedUser).toHaveBeenCalledWith(1, 2, expect.any(Function));
+  });
+
+  /**
+   * The cascade removes the only rows saying a torrent or a staged file belonged to this account,
+   * so anything holding work on their behalf has to be able to stop it while it is still findable.
+   */
+  it("deleteUser lets listeners stop the account's work before the row goes", async () => {
+    const order: string[] = [];
+    userRepo.deleteManagedUser.mockImplementation(async (_requestingUserId: number, _targetUserId: number, beforeDelete: () => Promise<void>) => {
+      await beforeDelete();
+      order.push('delete');
+      return 'updated';
+    });
+    events.on(USER_DELETING, (event: UserDeletingEvent) => {
+      event.waitFor(Promise.resolve().then(() => void order.push('detach')));
+    });
+
+    await service.deleteUser(2, reqUser({ isSuperuser: false }));
+
+    expect(order).toEqual(['detach', 'delete']);
+  });
+
+  /** An account the operator asked to remove has to go, whatever a listener makes of it. */
+  it('deleteUser deletes anyway when stopping that work fails', async () => {
+    userRepo.deleteManagedUser.mockImplementation(async (_requestingUserId: number, _targetUserId: number, beforeDelete: () => Promise<void>) => {
+      await beforeDelete();
+      return 'updated';
+    });
+    events.on(USER_DELETING, (event: UserDeletingEvent) => event.waitFor(Promise.reject(new Error('the client is unreachable'))));
+
+    await expect(service.deleteUser(2, reqUser({ isSuperuser: false }))).resolves.toBeUndefined();
+    expect(userRepo.deleteManagedUser).toHaveBeenCalledWith(1, 2, expect.any(Function));
+  });
+
+  /** A listener throwing before it registers anything reaches the emit call itself. */
+  it('deleteUser deletes anyway when a listener throws outright', async () => {
+    userRepo.deleteManagedUser.mockImplementation(async (_requestingUserId: number, _targetUserId: number, beforeDelete: () => Promise<void>) => {
+      await beforeDelete();
+      return 'updated';
+    });
+    events.on(USER_DELETING, () => {
+      throw new Error('the listener is broken');
+    });
+
+    await expect(service.deleteUser(2, reqUser({ isSuperuser: false }))).resolves.toBeUndefined();
+    expect(userRepo.deleteManagedUser).toHaveBeenCalledWith(1, 2, expect.any(Function));
   });
 
   it('setPermissions blocks modifying own permissions', async () => {
@@ -726,7 +775,14 @@ describe('UserService.updateSeriesCollapsePreferences', () => {
     vi.resetAllMocks();
     config.get.mockReturnValue('http://localhost:5173');
     appSettingsService.getDefaultLibraryAccessLibraryIds.mockResolvedValue([]);
-    service = new UserService(userRepo as any, config as any, contentFilterRepo as any, appSettingsService as any, userStatistics as any);
+    service = new UserService(
+      userRepo as any,
+      config as any,
+      contentFilterRepo as any,
+      appSettingsService as any,
+      userStatistics as any,
+      new UserEventsService(),
+    );
   });
 
   it('throws NotFoundException when user does not exist', async () => {
diff --git a/server/src/modules/user/user.service.ts b/server/src/modules/user/user.service.ts
index 5ee76f294..abdcb1dc1 100644
--- a/server/src/modules/user/user.service.ts
+++ b/server/src/modules/user/user.service.ts
@@ -17,6 +17,7 @@ import { UpdateMeDto } from './dto/update-me.dto';
 import { UpdateUserDto } from './dto/update-user.dto';
 import { UpdateMeSettingsDto } from './dto/update-me-settings.dto';
 import { UpdateSeriesCollapsePreferencesDto } from './dto/update-series-collapse-preferences.dto';
+import { USER_DELETING, UserEventsService, type UserDeletingEvent } from './user-events.service';
 import { UserRepository, type UserListQuery } from './user.repository';
 import { AppSettingsService } from '../app-settings/app-settings.service';
 import { UserStatisticsService } from '../user-statistics/user-statistics.service';
@@ -35,6 +36,7 @@ export class UserService {
     private readonly contentFilterRepo: ContentFilterRepository,
     private readonly appSettingsService: AppSettingsService,
     private readonly userStatistics: UserStatisticsService,
+    private readonly events: UserEventsService,
   ) {}
 
   findByUsername(username: string) {
@@ -330,12 +332,42 @@ export class UserService {
     if (id === requestingUser.id) {
       throw new ConflictException('You cannot delete your own account');
     }
-    const result = await this.userRepo.deleteManagedUser(requestingUser.id, id);
+    const result = await this.userRepo.deleteManagedUser(requestingUser.id, id, () => this.announceDeletion(id));
     if (result === 'target_not_found') throw new NotFoundException('User not found');
     if (result === 'requester_not_superuser') throw new ForbiddenException('Only administrators can delete administrator accounts');
     if (result === 'last_superuser') throw new ConflictException('Cannot delete the last administrator');
   }
 
+  /**
+   * Gives everything holding work on this account's behalf the chance to stop it, before the
+   * cascade removes the only rows that say the work exists.
+   *
+   * Awaited, because running afterwards would be pointless: a torrent whose attempt row is gone
+   * cannot be found again. Failures are logged and the deletion proceeds - an account the operator
+   * asked to remove must go, and the alternative to a leaked torrent is an account that cannot be
+   * deleted at all.
+   */
+  private async announceDeletion(userId: number): Promise<void> {
+    const pending: Promise<void>[] = [];
+    const event: UserDeletingEvent = { userId, waitFor: (work) => pending.push(work) };
+    try {
+      this.events.emit(USER_DELETING, event);
+    } catch (error: unknown) {
+      // A listener that threw before it could register anything, which is still not a reason to
+      // refuse the deletion; whatever it holds is reported here and left running.
+      pending.push(Promise.reject(error instanceof Error ? error : new Error(String(error))));
+    }
+    if (pending.length === 0) return;
+
+    for (const outcome of await Promise.allSettled(pending)) {
+      if (outcome.status !== 'rejected') continue;
+      const message = outcome.reason instanceof Error ? outcome.reason.message : String(outcome.reason);
+      this.logger.warn(
+        `[user.delete] [fail] userId=${userId} error="${sanitizeLogValue(message)}" - work belonging to this account could not be stopped before deletion`,
+      );
+    }
+  }
+
   setPermissionsDirectly(userId: number, permissionNames: Permission[]) {
     return this.userRepo.setPermissions(userId, permissionNames);
   }
@@ -506,5 +538,9 @@ export class UserService {
       excludeGenreIds: dto.excludeGenreIds ?? [],
     };
     await this.contentFilterRepo.replaceFilters(targetUserId, filters);
+
+    if (dto.seeOwnRequestedBooks !== undefined) {
+      await this.userRepo.update(targetUserId, { seeOwnRequestedBooks: dto.seeOwnRequestedBooks });
+    }
   }
 }
diff --git a/server/src/scripts/migrate.ts b/server/src/scripts/migrate.ts
index 29d2c85cf..f8986041b 100644
--- a/server/src/scripts/migrate.ts
+++ b/server/src/scripts/migrate.ts
@@ -1,10 +1,12 @@
 import { existsSync } from 'fs';
 import { join } from 'path';
+import { readMigrationFiles } from 'drizzle-orm/migrator';
 import { drizzle } from 'drizzle-orm/node-postgres';
 import { migrate } from 'drizzle-orm/node-postgres/migrator';
 import { Pool } from 'pg';
 
 import { createPostgresClientConfig } from '../db/postgres-connection-config';
+import { reconcileMigrationLedgerTimestamps } from './migration-ledger-compatibility';
 import { installPostgresExtensions } from './postgres-extensions';
 import { prepareLegacySeriesIndexColumns } from './series-index-migration-compatibility';
 
@@ -39,9 +41,10 @@ async function runMigrations() {
 
   try {
     await installPostgresExtensions(pool);
+    const migrationsFolder = resolveMigrationsFolder();
+    await reconcileMigrationLedgerTimestamps(pool, readMigrationFiles({ migrationsFolder }));
     await prepareLegacySeriesIndexColumns(pool);
 
-    const migrationsFolder = resolveMigrationsFolder();
     await migrate(drizzle(pool), { migrationsFolder });
 
     console.log(`Migrations applied successfully from ${migrationsFolder}`);
diff --git a/server/src/scripts/migration-ledger-compatibility.test.ts b/server/src/scripts/migration-ledger-compatibility.test.ts
new file mode 100644
index 000000000..b28b2c241
--- /dev/null
+++ b/server/src/scripts/migration-ledger-compatibility.test.ts
@@ -0,0 +1,64 @@
+import type { MigrationMeta } from 'drizzle-orm/migrator';
+import type { Pool } from 'pg';
+
+import { reconcileMigrationLedgerTimestamps } from './migration-ledger-compatibility';
+
+const migrations = [
+  { hash: 'first', folderMillis: 100 },
+  { hash: 'second', folderMillis: 200 },
+] as const satisfies readonly Pick<MigrationMeta, 'folderMillis' | 'hash'>[];
+
+function createPool(tableName: string | null, ledgerRows: Array<{ id: number; hash: string; createdAt: string }> = []) {
+  const query = vi.fn((statement: string) => {
+    if (statement.includes('to_regclass')) return Promise.resolve({ rows: [{ tableName }] });
+    if (statement.includes('SELECT id, hash')) return Promise.resolve({ rows: ledgerRows });
+    if (statement.startsWith('UPDATE')) return Promise.resolve({ rows: [], rowCount: 1 });
+    return Promise.resolve({ rows: [], rowCount: 0 });
+  });
+  const release = vi.fn();
+  const pool = { connect: vi.fn(() => Promise.resolve({ query, release })) } as unknown as Pick<Pool, 'connect'>;
+  return { pool, query, release };
+}
+
+describe('reconcileMigrationLedgerTimestamps', () => {
+  it('does nothing before Drizzle has created its ledger table', async () => {
+    const { pool, query, release } = createPool(null);
+
+    await expect(reconcileMigrationLedgerTimestamps(pool, migrations)).resolves.toEqual({ repairedRows: 0 });
+    expect(query).toHaveBeenCalledTimes(4);
+    expect(query).toHaveBeenNthCalledWith(1, 'BEGIN');
+    expect(query).toHaveBeenLastCalledWith('COMMIT');
+    expect(release).toHaveBeenCalledOnce();
+  });
+
+  it('repairs timestamps only when an applied migration hash is known and mismatched', async () => {
+    const { pool, query } = createPool('drizzle.__drizzle_migrations', [
+      { id: 7, hash: 'first', createdAt: '50' },
+      { id: 8, hash: 'second', createdAt: '200' },
+      { id: 9, hash: 'unknown', createdAt: '25' },
+    ]);
+
+    await expect(reconcileMigrationLedgerTimestamps(pool, migrations)).resolves.toEqual({ repairedRows: 1 });
+    expect(query).toHaveBeenCalledWith('UPDATE drizzle.__drizzle_migrations SET created_at = $1 WHERE id = $2 AND hash = $3 AND created_at <> $1', [
+      100,
+      7,
+      'first',
+    ]);
+    expect(query.mock.calls.filter(([statement]) => statement.startsWith('UPDATE'))).toHaveLength(1);
+  });
+
+  it('rolls back and releases the client when reconciliation fails', async () => {
+    const query = vi
+      .fn()
+      .mockResolvedValueOnce({ rows: [] })
+      .mockResolvedValueOnce({ rows: [] })
+      .mockRejectedValueOnce(new Error('ledger unavailable'))
+      .mockResolvedValueOnce({ rows: [] });
+    const release = vi.fn();
+    const pool = { connect: vi.fn(() => Promise.resolve({ query, release })) } as unknown as Pick<Pool, 'connect'>;
+
+    await expect(reconcileMigrationLedgerTimestamps(pool, migrations)).rejects.toThrow('ledger unavailable');
+    expect(query).toHaveBeenLastCalledWith('ROLLBACK');
+    expect(release).toHaveBeenCalledOnce();
+  });
+});
diff --git a/server/src/scripts/migration-ledger-compatibility.ts b/server/src/scripts/migration-ledger-compatibility.ts
new file mode 100644
index 000000000..8ce864966
--- /dev/null
+++ b/server/src/scripts/migration-ledger-compatibility.ts
@@ -0,0 +1,69 @@
+import type { MigrationMeta } from 'drizzle-orm/migrator';
+import type { Pool } from 'pg';
+
+import { sanitizeLogValue } from '../common/utils/log-sanitize.utils';
+
+type CompatibilityResult = {
+  repairedRows: number;
+};
+
+type LedgerRow = {
+  id: number;
+  hash: string;
+  createdAt: string;
+};
+
+export async function reconcileMigrationLedgerTimestamps(
+  pool: Pick<Pool, 'connect'>,
+  migrations: readonly Pick<MigrationMeta, 'folderMillis' | 'hash'>[],
+): Promise<CompatibilityResult> {
+  const client = await pool.connect();
+  const startedAt = Date.now();
+
+  try {
+    await client.query('BEGIN');
+    await client.query(`SELECT pg_advisory_xact_lock(hashtext('bookorbit'), hashtext('migration-ledger-compatibility'))`);
+    const table = await client.query<{ tableName: string | null }>(`SELECT to_regclass('drizzle.__drizzle_migrations')::text AS "tableName"`);
+    if (table.rows[0]?.tableName === null || table.rows.length === 0) {
+      await client.query('COMMIT');
+      return { repairedRows: 0 };
+    }
+
+    const expectedTimestamps = new Map(migrations.map((migration) => [migration.hash, migration.folderMillis]));
+    const ledger = await client.query<LedgerRow>(`
+      SELECT id, hash, created_at::text AS "createdAt"
+      FROM drizzle.__drizzle_migrations
+      ORDER BY id
+    `);
+
+    let repairedRows = 0;
+    for (const row of ledger.rows) {
+      const expected = expectedTimestamps.get(row.hash);
+      if (expected === undefined || row.createdAt === String(expected)) continue;
+      const updated = await client.query(`UPDATE drizzle.__drizzle_migrations SET created_at = $1 WHERE id = $2 AND hash = $3 AND created_at <> $1`, [
+        expected,
+        row.id,
+        row.hash,
+      ]);
+      repairedRows += updated.rowCount ?? 0;
+    }
+
+    await client.query('COMMIT');
+    if (repairedRows > 0) {
+      console.warn(
+        `[db.migration-ledger-compatibility] [end] durationMs=${Date.now() - startedAt} repaired=${repairedRows} - applied migration timestamps reconciled`,
+      );
+    }
+    return { repairedRows };
+  } catch (error) {
+    await client.query('ROLLBACK');
+    const errorClass = error instanceof Error ? error.name : typeof error;
+    const message = error instanceof Error ? error.message : String(error);
+    console.error(
+      `[db.migration-ledger-compatibility] [fail] durationMs=${Date.now() - startedAt} errorClass=${errorClass} error="${sanitizeLogValue(message)}" - applied migration timestamps could not be reconciled`,
+    );
+    throw error;
+  } finally {
+    client.release();
+  }
+}
diff --git a/server/test/authorization-matrix.e2e-spec.ts b/server/test/authorization-matrix.e2e-spec.ts
index 62f90a035..b1db27aa2 100644
--- a/server/test/authorization-matrix.e2e-spec.ts
+++ b/server/test/authorization-matrix.e2e-spec.ts
@@ -45,6 +45,8 @@ interface RouteInventoryRoute {
   httpMethod: string;
   path: string;
   permissions: string[];
+  /** `any` means one of `permissions` is enough; absent means every one of them is required. */
+  permissionMode?: 'any';
   libraryAccess: string[];
   isPublic: boolean;
   allowDefault: boolean;
@@ -78,6 +80,7 @@ interface Personas {
   allPermsUser: TestUserSession;
   permsNoLibraryUser: TestUserSession;
   manageUsersAdmin: TestUserSession;
+  appSettingsAdmin: TestUserSession;
   metadataEditor: TestUserSession;
   opdsOwner: TestUserSession;
   opdsIntruder: TestUserSession;
@@ -95,6 +98,7 @@ interface Personas {
 
 const currentDir = dirname(fileURLToPath(import.meta.url));
 const routeInventory = loadRouteInventory();
+const uncoveredRoutes = loadUncoveredRoutes();
 
 const supportedMethods = new Set<SupportedHttpMethod>(['GET', 'POST', 'PUT', 'PATCH', 'DELETE']);
 
@@ -117,6 +121,16 @@ function loadRouteInventory(): RouteInventory {
   };
 }
 
+/**
+ * Routes the hand-maintained inventory does not describe yet, and which every other test in this
+ * file therefore never probes. A frozen baseline rather than an allow-list: it may shrink as
+ * entries are written, never grow, so a route added from today on has to be inventoried.
+ */
+function loadUncoveredRoutes(): string[] {
+  const file = join(currentDir, 'e2e/authorization-matrix/route-inventory/uncovered-routes.json');
+  return JSON.parse(readFileSync(file, 'utf8')) as string[];
+}
+
 function liveRouteLabels(app: NestFastifyApplication): string[] {
   const allMethodPaths = new Set(routeInventory.routes.filter((route) => route.httpMethod === 'ALL').map((route) => route.path));
   const labels = new Set<string>();
@@ -199,6 +213,7 @@ describe('Authorization matrix (e2e)', () => {
       allPermsUser: await createUserAndLogin(ctx, { permissions: allPermissions }),
       permsNoLibraryUser: await createUserAndLogin(ctx, { permissions: allPermissions }),
       manageUsersAdmin: await createUserAndLogin(ctx, { permissions: [Permission.ManageUsers] }),
+      appSettingsAdmin: await createUserAndLogin(ctx, { permissions: [Permission.ManageAppSettings] }),
       metadataEditor: await createUserAndLogin(ctx, { permissions: [Permission.LibraryEditMetadata] }),
       opdsOwner: await createUserAndLogin(ctx, { permissions: [Permission.OpdsAccess] }),
       opdsIntruder: await createUserAndLogin(ctx, { permissions: [Permission.OpdsAccess] }),
@@ -485,6 +500,27 @@ describe('Authorization matrix (e2e)', () => {
       expect(liveLabels).toEqual(inventoryLabels);
     });
 
+    /**
+     * The inventory is hand-maintained and every other test in this file reads *from* it, so a
+     * route it does not list is a route this suite silently never probes. Five guarded
+     * book-request endpoints sat unprobed until this assertion existed.
+     *
+     * The inventory does not describe the whole application yet, so the gap is frozen in
+     * `uncovered-routes.json` rather than pretended away: a route that is in neither the inventory
+     * nor that baseline fails here, which is what makes omitting a new endpoint impossible. The
+     * baseline is held to shrinking only, and to naming routes that still exist.
+     */
+    it('keeps every route the application serves either inventoried or in the frozen gap baseline', () => {
+      const inventoryLabels = new Set(routeInventory.routes.filter((route) => isSupportedMethod(route.httpMethod)).map(routeLabel));
+      const baseline = new Set(uncoveredRoutes);
+      const live = liveRouteLabels(ctx.app);
+      const liveLabels = new Set(live);
+
+      expect(live.filter((label) => !inventoryLabels.has(label) && !baseline.has(label))).toEqual([]);
+      expect([...baseline].filter((label) => inventoryLabels.has(label))).toEqual([]);
+      expect([...baseline].filter((label) => !liveLabels.has(label))).toEqual([]);
+    });
+
     it('serves the authenticated random scroller through the batch route', async () => {
       const response = await ctx.app.inject({
         method: 'POST',
@@ -540,6 +576,17 @@ describe('Authorization matrix (e2e)', () => {
       assertNoFailures('permission denial matrix', failures);
     }, 180_000);
 
+    it('allows a settings operator to read book-request source status without request access', async () => {
+      const response = await ctx.app.inject({
+        method: 'GET',
+        url: '/api/v1/book-requests/source-status',
+        headers: authHeader(personas.appSettingsAdmin.accessToken),
+      });
+
+      expect(response.statusCode).toBe(200);
+      expect(response.json()).toEqual({ configured: expect.any(Number), enabled: expect.any(Number) });
+    });
+
     it('proves allow-path for each permission without missing-permission errors', async () => {
       const permissionRoutes = routeInventory.routes.filter(
         (route) => !route.isPublic && route.permissions.length > 0 && isSupportedMethod(route.httpMethod),
@@ -548,7 +595,11 @@ describe('Authorization matrix (e2e)', () => {
         .map((raw) => toPermission(raw))
         .filter((permission): permission is Permission => permission !== null)
         .sort();
-      const enumPermissions = [...Object.values(Permission)].sort();
+      // Permissions that grant a capability *within* a route rather than gating the route itself,
+      // so they legitimately never appear on a guard. Every entry needs a service-level test
+      // proving the capability is actually enforced; keep this list as short as it can be.
+      const serviceEnforcedPermissions: Permission[] = [Permission.BookRequestAutoApprove];
+      const enumPermissions = [...Object.values(Permission)].filter((permission) => !serviceEnforcedPermissions.includes(permission)).sort();
       expect(inventoryPermissions).toEqual(enumPermissions);
 
       const probes: Record<
@@ -680,11 +731,27 @@ describe('Authorization matrix (e2e)', () => {
           path: '/notifications',
           token: 'allPerms',
         },
+        [Permission.BookRequestAccess]: {
+          method: 'GET',
+          path: '/book-requests/summary',
+          token: 'allPerms',
+        },
+        [Permission.ManageBookRequests]: {
+          method: 'GET',
+          path: '/admin/book-requests',
+          token: 'allPerms',
+        },
+        [Permission.BookRequestSelfFulfill]: {
+          method: 'GET',
+          path: '/book-request-fulfilment/download-clients',
+          token: 'allPerms',
+        },
       };
 
       const failures: MatrixFailure[] = [];
 
       for (const permission of Object.values(Permission)) {
+        if (serviceEnforcedPermissions.includes(permission)) continue;
         const probe = probes[permission];
         const inventoryRoute = routeInventory.routes.find((route) => route.httpMethod === probe.method && route.path === probe.path);
         expect(inventoryRoute).toBeTruthy();
@@ -725,7 +792,13 @@ describe('Authorization matrix (e2e)', () => {
         (route) => !route.isPublic && route.libraryAccess.length > 0 && isSupportedMethod(route.httpMethod),
       );
       expect(guardedRoutes.map(routeLabel).sort()).toEqual(
-        ['GET /libraries/:id', 'POST /libraries/:id/books', 'GET /libraries/:id/stats', 'POST /libraries/:id/write-metadata-to-files'].sort(),
+        [
+          'GET /libraries/:id',
+          'POST /libraries/:id/books',
+          'GET /libraries/:id/stats',
+          'POST /libraries/:id/write-metadata-to-files',
+          'GET /scanner/libraries/:id/scan-history',
+        ].sort(),
       );
 
       for (const route of guardedRoutes) {
diff --git a/server/test/book-requests.e2e-spec.ts b/server/test/book-requests.e2e-spec.ts
new file mode 100644
index 000000000..935340f5f
--- /dev/null
+++ b/server/test/book-requests.e2e-spec.ts
@@ -0,0 +1,679 @@
+import { randomUUID } from 'crypto';
+
+import { and, eq } from 'drizzle-orm';
+import { Permission } from '@bookorbit/types';
+import type { BookRequestBulkResult, BookRequestItem, BookRequestPage, BookRequestSubmitResult } from '@bookorbit/types';
+
+import * as schema from '../src/db/schema';
+import {
+  authHeader,
+  closeAuthorizationMatrixE2EContext,
+  createAuthorizationMatrixE2EContext,
+  createBookDockRow,
+  createLibraryWithFolder,
+  createUserAndLogin,
+  grantLibraryAccess,
+  type AuthorizationMatrixE2EContext,
+  type CreatedLibrary,
+  type TestUserSession,
+} from './e2e/authorization-matrix/authorization-matrix-harness';
+
+/**
+ * What the authorization matrix cannot express.
+ *
+ * The matrix probes every route with a set of personas and asserts the guard's answer, which is
+ * exactly the wrong shape for this feature: almost every rule here is per row rather than per
+ * route. "A cannot read B's request" and "a self-fulfiller may drive their own request and nobody
+ * else's" both pass the guard and are then decided by the service, and the three plugin routes are
+ * gated by a hand-rolled superuser check the matrix has no dimension for.
+ *
+ * The state machine is exercised over the paths that need no download client. Grab, transfer and
+ * import are covered by unit tests against mocked adapters; standing a real client up here would
+ * test the client rather than BookOrbit.
+ */
+
+const SCENARIO_TIMEOUT_MS = 60_000;
+
+const REQUESTER_PERMISSIONS = [Permission.BookRequestAccess];
+const MODERATOR_PERMISSIONS = [Permission.BookRequestAccess, Permission.ManageBookRequests];
+const SELF_FULFIL_PERMISSIONS = [Permission.BookRequestAccess, Permission.BookRequestSelfFulfill];
+
+interface SubmitOptions {
+  title?: string;
+  mediaKind?: 'ebook' | 'audiobook' | 'comic';
+  targetLibraryId?: number | null;
+  selfServe?: boolean;
+  userId?: number;
+  authors?: string[];
+  preferredFormats?: string[];
+  note?: string;
+}
+
+describe('Book requests (e2e)', () => {
+  let ctx: AuthorizationMatrixE2EContext;
+  let library: CreatedLibrary;
+  let otherLibrary: CreatedLibrary;
+  let requester: TestUserSession;
+  let secondRequester: TestUserSession;
+  let moderator: TestUserSession;
+  let selfFulfiller: TestUserSession;
+  let otherSelfFulfiller: TestUserSession;
+  let settingsAdmin: TestUserSession;
+  let superuser: TestUserSession;
+
+  beforeAll(async () => {
+    ctx = await createAuthorizationMatrixE2EContext();
+
+    library = await createLibraryWithFolder(ctx, { name: `book-requests-lib-${randomUUID()}` });
+    otherLibrary = await createLibraryWithFolder(ctx, { name: `book-requests-other-${randomUUID()}` });
+
+    requester = await createUserAndLogin(ctx, { permissions: REQUESTER_PERMISSIONS });
+    secondRequester = await createUserAndLogin(ctx, { permissions: REQUESTER_PERMISSIONS });
+    moderator = await createUserAndLogin(ctx, { permissions: MODERATOR_PERMISSIONS });
+    selfFulfiller = await createUserAndLogin(ctx, { permissions: SELF_FULFIL_PERMISSIONS });
+    otherSelfFulfiller = await createUserAndLogin(ctx, { permissions: SELF_FULFIL_PERMISSIONS });
+    settingsAdmin = await createUserAndLogin(ctx, { permissions: [Permission.ManageAppSettings] });
+    superuser = await createUserAndLogin(ctx, { isSuperuser: true });
+
+    await Promise.all(
+      [requester, secondRequester, moderator, selfFulfiller, otherSelfFulfiller].map((user) =>
+        grantLibraryAccess(ctx, user.userId, library.libraryId, 'viewer'),
+      ),
+    );
+    // Deliberately reachable by the moderator only, so a reroute onto it is a real reroute.
+    await grantLibraryAccess(ctx, moderator.userId, otherLibrary.libraryId, 'viewer');
+  }, 240_000);
+
+  afterAll(async () => {
+    await closeAuthorizationMatrixE2EContext(ctx);
+  });
+
+  function inject(method: 'GET' | 'POST' | 'DELETE', url: string, session: TestUserSession, payload?: unknown) {
+    return ctx.app.inject({
+      method,
+      url: `/api/v1${url}`,
+      headers: authHeader(session.accessToken),
+      ...(payload === undefined ? {} : { payload }),
+    });
+  }
+
+  /** A unique title per call, so nothing in this file collides on the live-request dedupe key. */
+  async function submit(session: TestUserSession, options: SubmitOptions = {}) {
+    return inject('POST', '/book-requests', session, {
+      title: options.title ?? `Book Requests E2E ${randomUUID()}`,
+      mediaKind: options.mediaKind ?? 'ebook',
+      authors: options.authors ?? ['Fixture Author'],
+      ...(options.targetLibraryId === undefined ? { targetLibraryId: library.libraryId } : { targetLibraryId: options.targetLibraryId }),
+      ...(options.selfServe === undefined ? {} : { selfServe: options.selfServe }),
+      ...(options.userId === undefined ? {} : { userId: options.userId }),
+      ...(options.preferredFormats === undefined ? {} : { preferredFormats: options.preferredFormats }),
+      ...(options.note === undefined ? {} : { note: options.note }),
+    });
+  }
+
+  async function submitOk(session: TestUserSession, options: SubmitOptions = {}): Promise<BookRequestSubmitResult> {
+    const response = await submit(session, options);
+    expect(response.statusCode).toBe(201);
+    return response.json() as BookRequestSubmitResult;
+  }
+
+  function statusOf(requestId: number): Promise<string | undefined> {
+    return ctx.db
+      .select({ status: schema.bookRequests.status })
+      .from(schema.bookRequests)
+      .where(eq(schema.bookRequests.id, requestId))
+      .limit(1)
+      .then((rows) => rows[0]?.status);
+  }
+
+  describe('lifecycle', () => {
+    it(
+      'carries a request from pending through an approval that reroutes it to being filed by hand',
+      async () => {
+        const { request, subscribed } = await submitOk(requester);
+        expect(subscribed).toBe(false);
+        expect(request.status).toBe('pending');
+        expect(request.targetLibraryId).toBe(library.libraryId);
+
+        // The approver disagrees with where the requester wanted it, which is the whole reason
+        // approval accepts a destination rather than only a note.
+        const approved = await inject('POST', `/admin/book-requests/${request.id}/approve`, moderator, {
+          targetLibraryId: otherLibrary.libraryId,
+          decisionNote: 'Rerouted to the reference library',
+        });
+        expect(approved.statusCode).toBe(200);
+
+        const afterApproval = approved.json() as BookRequestItem;
+        expect(afterApproval.status).toBe('approved');
+        expect(afterApproval.targetLibraryId).toBe(otherLibrary.libraryId);
+        expect(afterApproval.decidedByUserId).toBe(moderator.userId);
+        expect(afterApproval.decidedByUsername).toBe(moderator.username);
+        expect(afterApproval.decidedAt).not.toBeNull();
+        expect(afterApproval.decisionNote).toBe('Rerouted to the reference library');
+
+        const dockRow = await createBookDockRow(ctx, { uploadedBy: moderator.userId });
+        const filed = await inject('POST', `/admin/book-requests/${request.id}/fulfill`, moderator, {
+          bookDockFileId: dockRow.id,
+          note: 'Filed from the dock',
+        });
+        expect(filed.statusCode).toBe(200);
+
+        const available = filed.json() as BookRequestItem;
+        expect(available.status).toBe('available');
+        expect(available.bookDockFileId).toBe(dockRow.id);
+        expect(available.decisionNote).toBe('Filed from the dock');
+
+        // Terminal: filing again is refused rather than silently re-stamping the decision.
+        const again = await inject('POST', `/admin/book-requests/${request.id}/fulfill`, moderator, { bookDockFileId: dockRow.id });
+        expect(again.statusCode).toBe(400);
+      },
+      SCENARIO_TIMEOUT_MS,
+    );
+
+    it(
+      'refuses to approve anything that is no longer pending',
+      async () => {
+        const { request } = await submitOk(requester);
+        expect((await inject('POST', `/admin/book-requests/${request.id}/reject`, moderator, {})).statusCode).toBe(200);
+
+        const late = await inject('POST', `/admin/book-requests/${request.id}/approve`, moderator, { targetLibraryId: library.libraryId });
+
+        expect(late.statusCode).toBe(400);
+        expect(await statusOf(request.id)).toBe('rejected');
+      },
+      SCENARIO_TIMEOUT_MS,
+    );
+
+    it(
+      'lets the requester cancel their own request and nobody else cancel it for them',
+      async () => {
+        const { request } = await submitOk(requester);
+
+        expect((await inject('POST', `/book-requests/${request.id}/cancel`, secondRequester)).statusCode).toBe(403);
+        expect(await statusOf(request.id)).toBe('pending');
+
+        expect((await inject('POST', `/book-requests/${request.id}/cancel`, requester)).statusCode).toBe(200);
+        expect(await statusOf(request.id)).toBe('cancelled');
+      },
+      SCENARIO_TIMEOUT_MS,
+    );
+  });
+
+  describe('dedupe', () => {
+    it(
+      'folds a second request for the same work into the first rather than 500ing on the unique index',
+      async () => {
+        const title = `Dedupe E2E ${randomUUID()}`;
+        const first = await submitOk(requester, { title });
+
+        const second = await submitOk(secondRequester, { title });
+
+        expect(second.subscribed).toBe(true);
+        expect(second.request.id).toBe(first.request.id);
+        expect(second.request.subscribers.map((subscriber) => subscriber.userId)).toContain(secondRequester.userId);
+
+        // The requester is not a subscriber of their own request: they are its owner.
+        expect(second.request.subscribers.map((subscriber) => subscriber.userId)).not.toContain(requester.userId);
+      },
+      SCENARIO_TIMEOUT_MS,
+    );
+
+    /**
+     * A non-Latin title used to collapse to one constant key, so the second such request of a
+     * medium hit the unique index and 500d. It has to attach exactly as an ASCII one does.
+     */
+    it(
+      'dedupes a non-Latin title without falling back to a shared key',
+      async () => {
+        const cyrillic = `Война и мир ${randomUUID().slice(0, 8)}`;
+        const japanese = `吾輩は猫である ${randomUUID().slice(0, 8)}`;
+
+        const first = await submitOk(requester, { title: cyrillic, authors: ['Лев Толстой'] });
+        const attached = await submitOk(secondRequester, { title: cyrillic, authors: ['Лев Толстой'] });
+        expect(attached.request.id).toBe(first.request.id);
+
+        // A different non-Latin work is a different request, not the same key again.
+        const other = await submitOk(requester, { title: japanese, authors: ['夏目漱石'] });
+        expect(other.request.id).not.toBe(first.request.id);
+        expect(other.subscribed).toBe(false);
+      },
+      SCENARIO_TIMEOUT_MS,
+    );
+
+    it(
+      'lets a settled work be asked for again',
+      async () => {
+        const title = `Re-request E2E ${randomUUID()}`;
+        const first = await submitOk(requester, { title });
+        expect((await inject('POST', `/admin/book-requests/${first.request.id}/reject`, moderator, {})).statusCode).toBe(200);
+
+        const second = await submitOk(requester, { title });
+
+        expect(second.subscribed).toBe(false);
+        expect(second.request.id).not.toBe(first.request.id);
+        expect(second.request.status).toBe('pending');
+      },
+      SCENARIO_TIMEOUT_MS,
+    );
+  });
+
+  describe('visibility and ownership', () => {
+    it(
+      'keeps one requester out of another requester’s request while letting a subscriber in',
+      async () => {
+        const title = `Visibility E2E ${randomUUID()}`;
+        const { request } = await submitOk(requester, { title });
+
+        const stranger = await createUserAndLogin(ctx, { permissions: REQUESTER_PERMISSIONS });
+        expect((await inject('GET', `/book-requests/${request.id}`, stranger)).statusCode).toBe(403);
+
+        await submitOk(secondRequester, { title });
+        expect((await inject('GET', `/book-requests/${request.id}`, secondRequester)).statusCode).toBe(200);
+
+        // A moderator reaches every request without being on it.
+        expect((await inject('GET', `/book-requests/${request.id}`, moderator)).statusCode).toBe(200);
+      },
+      SCENARIO_TIMEOUT_MS,
+    );
+
+    it(
+      'refuses the admin list to somebody who can only file requests',
+      async () => {
+        expect((await inject('GET', '/admin/book-requests', requester)).statusCode).toBe(403);
+        expect((await inject('GET', '/admin/book-requests', moderator)).statusCode).toBe(200);
+      },
+      SCENARIO_TIMEOUT_MS,
+    );
+
+    /**
+     * The self-fulfilment routes pass the guard for anybody holding the permission. Which rows
+     * they may drive is decided per request, and that is the rule worth an end-to-end probe.
+     */
+    it(
+      'lets a self-fulfiller drive their own request and refuses them somebody else’s',
+      async () => {
+        const mine = await submitOk(selfFulfiller, { selfServe: true });
+        expect(mine.request.selfServe).toBe(true);
+        expect(mine.request.status).toBe('approved');
+
+        expect((await inject('GET', `/book-request-fulfilment/${mine.request.id}/attempts`, selfFulfiller)).statusCode).toBe(200);
+        expect((await inject('GET', `/book-request-fulfilment/${mine.request.id}/attempts`, otherSelfFulfiller)).statusCode).toBe(403);
+
+        // And the ordinary requester is refused by the guard rather than by the row check.
+        expect((await inject('GET', `/book-request-fulfilment/${mine.request.id}/attempts`, requester)).statusCode).toBe(403);
+      },
+      SCENARIO_TIMEOUT_MS,
+    );
+
+    it(
+      'answers 404 for a fulfilment attempt against a download that belongs to another request',
+      async () => {
+        const mine = await submitOk(selfFulfiller, { selfServe: true });
+        const theirs = await submitOk(otherSelfFulfiller, { selfServe: true });
+
+        const [foreign] = await ctx.db
+          .insert(schema.bookRequestDownloads)
+          .values({
+            requestId: theirs.request.id,
+            source: 'magnet',
+            status: 'needs_review',
+            releaseTitle: 'Foreign attempt',
+          })
+          .returning({ id: schema.bookRequestDownloads.id });
+
+        const response = await inject('POST', `/book-request-fulfilment/${mine.request.id}/downloads/${foreign.id}/select-unit`, selfFulfiller, {
+          unitIndex: 0,
+        });
+
+        expect(response.statusCode).toBe(404);
+      },
+      SCENARIO_TIMEOUT_MS,
+    );
+  });
+
+  describe('self-serve constraints', () => {
+    it(
+      'refuses self-serve to somebody without the permission, with a code the form can translate',
+      async () => {
+        const response = await submit(requester, { selfServe: true });
+
+        expect(response.statusCode).toBe(403);
+        expect(response.json()).toMatchObject({ errorCode: 'SUBMIT_SELF_FULFIL_FORBIDDEN' });
+      },
+      SCENARIO_TIMEOUT_MS,
+    );
+
+    it(
+      'caps how many self-serve requests one person may have in flight, and says what the cap is',
+      async () => {
+        const capped = await createUserAndLogin(ctx, { permissions: SELF_FULFIL_PERMISSIONS });
+        await grantLibraryAccess(ctx, capped.userId, library.libraryId, 'viewer');
+
+        // Sequential rather than concurrent: the cap is claimed under an advisory lock, and the
+        // point here is the refusal rather than the race, which has its own unit coverage.
+        for (let index = 0; index < 10; index++) {
+          const allowed = await submit(capped, { selfServe: true });
+          expect(allowed.statusCode).toBe(201);
+        }
+
+        const refused = await submit(capped, { selfServe: true });
+
+        // 403 rather than 400: the refusal is about what this person may do, not what they sent.
+        expect(refused.statusCode).toBe(403);
+        expect(refused.json()).toMatchObject({ errorCode: 'SUBMIT_SELF_SERVE_LIMIT', errorMeta: { limit: 10 } });
+      },
+      SCENARIO_TIMEOUT_MS,
+    );
+  });
+
+  describe('delegated attribution', () => {
+    it(
+      'files on somebody else’s behalf for a moderator and records who actually did it',
+      async () => {
+        const response = await submit(moderator, { userId: requester.userId });
+
+        expect(response.statusCode).toBe(201);
+        const { request } = response.json() as BookRequestSubmitResult;
+        expect(request.userId).toBe(requester.userId);
+        expect(request.requesterUsername).toBe(requester.username);
+
+        const [row] = await ctx.db
+          .select({ createdByUserId: schema.bookRequests.createdByUserId })
+          .from(schema.bookRequests)
+          .where(eq(schema.bookRequests.id, request.id))
+          .limit(1);
+        expect(row?.createdByUserId).toBe(moderator.userId);
+      },
+      SCENARIO_TIMEOUT_MS,
+    );
+
+    it(
+      'refuses to file on somebody else’s behalf without the moderator permission',
+      async () => {
+        const response = await submit(requester, { userId: secondRequester.userId });
+
+        expect(response.statusCode).toBe(403);
+        expect(response.json()).toMatchObject({ errorCode: 'SUBMIT_ON_BEHALF_FORBIDDEN' });
+      },
+      SCENARIO_TIMEOUT_MS,
+    );
+
+    it(
+      'refuses an unknown requester rather than filing the request against nobody',
+      async () => {
+        const response = await submit(moderator, { userId: 9_999_999 });
+
+        expect(response.statusCode).toBe(404);
+        expect(response.json()).toMatchObject({ errorCode: 'SUBMIT_ON_BEHALF_UNKNOWN_USER' });
+      },
+      SCENARIO_TIMEOUT_MS,
+    );
+  });
+
+  describe('subscriptions', () => {
+    it(
+      'lets a subscriber leave a request they joined, and refuses the requester their own',
+      async () => {
+        const title = `Unsubscribe E2E ${randomUUID()}`;
+        const { request } = await submitOk(requester, { title });
+        await submitOk(secondRequester, { title });
+
+        // Leaving is only for somebody who joined: the owner has nothing to leave.
+        expect((await inject('DELETE', `/book-requests/${request.id}/subscription`, requester)).statusCode).toBe(400);
+
+        expect((await inject('DELETE', `/book-requests/${request.id}/subscription`, secondRequester)).statusCode).toBe(204);
+        // Leaving costs the caller their view of the request, which is the whole point of leaving.
+        expect((await inject('GET', `/book-requests/${request.id}`, secondRequester)).statusCode).toBe(403);
+
+        const remaining = await ctx.db
+          .select({ userId: schema.bookRequestSubscribers.userId })
+          .from(schema.bookRequestSubscribers)
+          .where(and(eq(schema.bookRequestSubscribers.requestId, request.id), eq(schema.bookRequestSubscribers.userId, secondRequester.userId)));
+        expect(remaining).toHaveLength(0);
+      },
+      SCENARIO_TIMEOUT_MS,
+    );
+
+    it(
+      'answers 404 when there was no subscription to leave',
+      async () => {
+        const { request } = await submitOk(requester);
+
+        expect((await inject('DELETE', `/book-requests/${request.id}/subscription`, moderator)).statusCode).toBe(404);
+      },
+      SCENARIO_TIMEOUT_MS,
+    );
+  });
+
+  describe('bulk actions', () => {
+    it(
+      'rejects a selection with one shared reason and reports the rows it could not reach',
+      async () => {
+        const first = await submitOk(requester);
+        const second = await submitOk(requester);
+        const settled = await submitOk(requester);
+        expect((await inject('POST', `/book-requests/${settled.request.id}/cancel`, requester)).statusCode).toBe(200);
+
+        const response = await inject('POST', '/admin/book-requests/reject', moderator, {
+          ids: [first.request.id, second.request.id, settled.request.id],
+          decisionNote: 'Not available anywhere right now',
+        });
+
+        expect(response.statusCode).toBe(200);
+        const result = response.json() as BookRequestBulkResult;
+        expect(result.updated.map((item) => item.id).sort()).toEqual([first.request.id, second.request.id].sort());
+        expect(result.updated.every((item) => item.status === 'rejected')).toBe(true);
+        expect(result.updated.every((item) => item.decisionNote === 'Not available anywhere right now')).toBe(true);
+        // A cancelled request is not pending, so it falls out rather than failing the whole batch.
+        expect(result.failed.map((failure) => failure.id)).toEqual([settled.request.id]);
+        expect(result.failed[0]?.reason).toBeTruthy();
+      },
+      SCENARIO_TIMEOUT_MS,
+    );
+
+    it(
+      'refuses bulk rejection to anybody who cannot moderate',
+      async () => {
+        const { request } = await submitOk(requester);
+
+        const response = await inject('POST', '/admin/book-requests/reject', requester, { ids: [request.id] });
+
+        expect(response.statusCode).toBe(403);
+        expect(await statusOf(request.id)).toBe('pending');
+      },
+      SCENARIO_TIMEOUT_MS,
+    );
+  });
+
+  describe('listing', () => {
+    it(
+      'narrows the queue to self-served rows server-side, and to the ones that went through approval',
+      async () => {
+        const queued = await submitOk(requester);
+        const served = await submitOk(selfFulfiller, { selfServe: true });
+
+        const selfServed = await inject('GET', '/admin/book-requests?selfServe=true&limit=100', moderator);
+        expect(selfServed.statusCode).toBe(200);
+        const selfServedIds = (selfServed.json() as BookRequestPage).items.map((item) => item.id);
+        expect(selfServedIds).toContain(served.request.id);
+        expect(selfServedIds).not.toContain(queued.request.id);
+
+        const approvedPath = await inject('GET', '/admin/book-requests?selfServe=false&limit=100', moderator);
+        const approvedPathIds = (approvedPath.json() as BookRequestPage).items.map((item) => item.id);
+        expect(approvedPathIds).toContain(queued.request.id);
+        expect(approvedPathIds).not.toContain(served.request.id);
+      },
+      SCENARIO_TIMEOUT_MS,
+    );
+
+    it(
+      'refuses a filter value that is neither true nor false rather than silently ignoring it',
+      async () => {
+        const response = await inject('GET', '/admin/book-requests?selfServe=maybe', moderator);
+
+        expect(response.statusCode).toBe(400);
+      },
+      SCENARIO_TIMEOUT_MS,
+    );
+  });
+
+  describe('held imports', () => {
+    it(
+      'discards a held import, removing the dock entry and failing the request',
+      async () => {
+        const { request } = await submitOk(selfFulfiller, { selfServe: true });
+        const dockRow = await createBookDockRow(ctx, { uploadedBy: selfFulfiller.userId });
+
+        await ctx.db
+          .update(schema.bookRequests)
+          .set({ status: 'needs_review', bookDockFileId: dockRow.id })
+          .where(eq(schema.bookRequests.id, request.id));
+        await ctx.db.insert(schema.bookRequestDownloads).values({
+          requestId: request.id,
+          source: 'magnet',
+          status: 'needs_review',
+          releaseTitle: 'Held attempt',
+          bookDockFileId: dockRow.id,
+        });
+
+        const response = await inject('POST', `/book-request-fulfilment/${request.id}/discard-import`, selfFulfiller);
+
+        expect(response.statusCode).toBe(200);
+        expect((response.json() as BookRequestItem).status).toBe('failed');
+
+        const dockRows = await ctx.db
+          .select({ id: schema.bookDockFiles.id })
+          .from(schema.bookDockFiles)
+          .where(eq(schema.bookDockFiles.id, dockRow.id));
+        expect(dockRows).toHaveLength(0);
+      },
+      SCENARIO_TIMEOUT_MS,
+    );
+
+    it(
+      'refuses to discard an import on a request that is not waiting for review',
+      async () => {
+        const { request } = await submitOk(selfFulfiller, { selfServe: true });
+
+        const response = await inject('POST', `/book-request-fulfilment/${request.id}/discard-import`, selfFulfiller);
+
+        expect(response.statusCode).toBe(400);
+        expect(await statusOf(request.id)).toBe('approved');
+      },
+      SCENARIO_TIMEOUT_MS,
+    );
+
+    it(
+      'lets a moderator discard a pipeline import without separate Book Dock permission',
+      async () => {
+        const { request } = await submitOk(requester);
+        const dockRow = await createBookDockRow(ctx, { uploadedBy: requester.userId });
+
+        await ctx.db
+          .update(schema.bookRequests)
+          .set({ status: 'needs_review', bookDockFileId: dockRow.id })
+          .where(eq(schema.bookRequests.id, request.id));
+        await ctx.db.insert(schema.bookRequestDownloads).values({
+          requestId: request.id,
+          source: 'magnet',
+          status: 'needs_review',
+          releaseTitle: 'Held moderator attempt',
+          bookDockFileId: dockRow.id,
+        });
+
+        const response = await inject('POST', `/admin/book-requests/${request.id}/discard-import`, moderator);
+
+        expect(response.statusCode).toBe(200);
+        expect((response.json() as BookRequestItem).status).toBe('failed');
+        expect(
+          await ctx.db.select({ id: schema.bookDockFiles.id }).from(schema.bookDockFiles).where(eq(schema.bookDockFiles.id, dockRow.id)),
+        ).toHaveLength(0);
+      },
+      SCENARIO_TIMEOUT_MS,
+    );
+  });
+
+  describe('indexer plugin routes', () => {
+    /**
+     * The highest-privilege routes in the feature: an installed plugin runs in this process with
+     * this process's reach. Their gate is a hand-rolled superuser check rather than the permission
+     * guard, so the authorization matrix has no dimension that can see it.
+     */
+    it(
+      'refuses all three plugin routes to an operator who holds ManageAppSettings but is not a superuser',
+      async () => {
+        expect((await inject('POST', '/admin/request-indexers/plugins/inspect', settingsAdmin, {})).statusCode).toBe(403);
+        expect((await inject('POST', '/admin/request-indexers/plugins', settingsAdmin, {})).statusCode).toBe(403);
+        expect((await inject('DELETE', '/admin/request-indexers/plugins/demo-tracker', settingsAdmin)).statusCode).toBe(403);
+      },
+      SCENARIO_TIMEOUT_MS,
+    );
+
+    it(
+      'still refuses somebody with no settings permission at all, at the guard rather than the gate',
+      async () => {
+        expect((await inject('POST', '/admin/request-indexers/plugins/inspect', requester, {})).statusCode).toBe(403);
+        expect((await inject('DELETE', '/admin/request-indexers/plugins/demo-tracker', requester)).statusCode).toBe(403);
+      },
+      SCENARIO_TIMEOUT_MS,
+    );
+
+    /**
+     * A superuser gets past the gate. The refusal that follows is the upload check, which is the
+     * point: it proves the 403s above came from the superuser gate and not from a missing body.
+     */
+    it(
+      'lets a superuser past the gate and then refuses the request for carrying no plugin file',
+      async () => {
+        const response = await inject('DELETE', '/admin/request-indexers/plugins/no-such-plugin', superuser);
+
+        expect(response.statusCode).not.toBe(403);
+      },
+      SCENARIO_TIMEOUT_MS,
+    );
+  });
+
+  describe('request contract', () => {
+    /**
+     * `forbidNonWhitelisted` is assumed by every DTO in this feature, and an unknown field
+     * arriving as a silent no-op would make a client-side rename fail as wrong data rather than
+     * as an error. One probe, because it is a global pipe setting rather than a per-route one.
+     */
+    it(
+      'refuses a body carrying a field no DTO declares',
+      async () => {
+        const response = await ctx.app.inject({
+          method: 'POST',
+          url: '/api/v1/book-requests',
+          headers: authHeader(requester.accessToken),
+          payload: { title: `Whitelist E2E ${randomUUID()}`, mediaKind: 'ebook', notAField: 'nope' },
+        });
+
+        expect(response.statusCode).toBe(400);
+      },
+      SCENARIO_TIMEOUT_MS,
+    );
+
+    it(
+      'stores the format preference and note the request form now sends',
+      async () => {
+        const { request } = await submitOk(requester, { preferredFormats: ['epub', 'azw3'], note: 'Unabridged if possible' });
+
+        expect(request.preferredFormats).toEqual(['epub', 'azw3']);
+        expect(request.note).toBe('Unabridged if possible');
+      },
+      SCENARIO_TIMEOUT_MS,
+    );
+
+    it(
+      'refuses a destination library the requester cannot reach',
+      async () => {
+        const response = await submit(requester, { targetLibraryId: otherLibrary.libraryId });
+
+        expect(response.statusCode).toBe(403);
+        expect(response.json()).toMatchObject({ errorCode: 'SUBMIT_LIBRARY_FORBIDDEN' });
+      },
+      SCENARIO_TIMEOUT_MS,
+    );
+  });
+});
diff --git a/server/test/e2e/authorization-matrix/route-inventory/manifest.json b/server/test/e2e/authorization-matrix/route-inventory/manifest.json
index 6d65a8807..5b7f626fd 100644
--- a/server/test/e2e/authorization-matrix/route-inventory/manifest.json
+++ b/server/test/e2e/authorization-matrix/route-inventory/manifest.json
@@ -1,14 +1,14 @@
 {
-  "totalRoutes": 376,
+  "totalRoutes": 452,
   "byPermission": {
-    "(none)": 166,
+    "(none)": 167,
     "Permission.ManageMetadataConfig": 34,
     "Permission.EmailSend": 30,
-    "Permission.LibraryEditMetadata": 33,
-    "Permission.BookDockAccess": 16,
-    "Permission.ManageAppSettings": 22,
-    "Permission.ManageLibraries": 14,
-    "Permission.ManageUsers": 11,
+    "Permission.LibraryEditMetadata": 34,
+    "Permission.BookDockAccess": 17,
+    "Permission.ManageAppSettings": 39,
+    "Permission.ManageLibraries": 17,
+    "Permission.ManageUsers": 13,
     "Permission.ManageEmail": 8,
     "Permission.KoboSync": 7,
     "Permission.NotificationAccess": 6,
@@ -17,17 +17,20 @@
     "Permission.OpdsAccess": 4,
     "Permission.ViewAuditLog": 1,
     "Permission.ViewUserActivity": 6,
-    "Permission.LibraryDeleteBooks": 1,
+    "Permission.LibraryDeleteBooks": 10,
     "Permission.LibraryDownload": 1,
     "Permission.LibraryUpload": 2,
     "Permission.ManageBookDock": 3,
     "Permission.ManageIcons": 1,
     "Permission.HardcoverSync": 1,
     "Permission.ReadwiseSync": 1,
-    "Permission.StorygraphSync": 1
+    "Permission.StorygraphSync": 1,
+    "Permission.BookRequestAccess": 25,
+    "Permission.ManageBookRequests": 20,
+    "Permission.BookRequestSelfFulfill": 11
   },
   "byLibraryAccess": {
-    "'viewer'": 3,
+    "'viewer'": 4,
     "'editor'": 1
   },
   "routeChunks": [
diff --git a/server/test/e2e/authorization-matrix/route-inventory/routes-05.json b/server/test/e2e/authorization-matrix/route-inventory/routes-05.json
index 1399fee52..22854ef75 100644
--- a/server/test/e2e/authorization-matrix/route-inventory/routes-05.json
+++ b/server/test/e2e/authorization-matrix/route-inventory/routes-05.json
@@ -594,7 +594,7 @@
     "httpMethod": "GET",
     "path": "/scanner/libraries/:id/scan-history",
     "permissions": ["Permission.ManageLibraries"],
-    "libraryAccess": ["viewer"],
+    "libraryAccess": ["'viewer'"],
     "isPublic": false,
     "allowDefault": false,
     "useGuards": []
diff --git a/server/test/e2e/authorization-matrix/route-inventory/routes-06.json b/server/test/e2e/authorization-matrix/route-inventory/routes-06.json
index 8e63e16b3..7975bba2b 100644
--- a/server/test/e2e/authorization-matrix/route-inventory/routes-06.json
+++ b/server/test/e2e/authorization-matrix/route-inventory/routes-06.json
@@ -479,6 +479,30 @@
     "allowDefault": false,
     "useGuards": []
   },
+  {
+    "file": "server/src/modules/user/user.controller.ts",
+    "className": "UserController",
+    "methodName": "summary",
+    "httpMethod": "GET",
+    "path": "/users/summary",
+    "permissions": ["Permission.ManageUsers"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/user/user.controller.ts",
+    "className": "UserController",
+    "methodName": "findNeedingAttention",
+    "httpMethod": "GET",
+    "path": "/users/attention",
+    "permissions": ["Permission.ManageUsers"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
   {
     "file": "server/src/modules/user/user.controller.ts",
     "className": "UserController",
diff --git a/server/test/e2e/authorization-matrix/route-inventory/routes-08.json b/server/test/e2e/authorization-matrix/route-inventory/routes-08.json
index 8e95a1a46..5aa4c67fe 100644
--- a/server/test/e2e/authorization-matrix/route-inventory/routes-08.json
+++ b/server/test/e2e/authorization-matrix/route-inventory/routes-08.json
@@ -190,5 +190,870 @@
     "isPublic": false,
     "allowDefault": false,
     "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/book-request.controller.ts",
+    "className": "BookRequestController",
+    "methodName": "submit",
+    "httpMethod": "POST",
+    "path": "/book-requests",
+    "permissions": ["Permission.BookRequestAccess"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/book-request.controller.ts",
+    "className": "BookRequestController",
+    "methodName": "listMine",
+    "httpMethod": "GET",
+    "path": "/book-requests",
+    "permissions": ["Permission.BookRequestAccess"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/book-request.controller.ts",
+    "className": "BookRequestController",
+    "methodName": "getSummary",
+    "httpMethod": "GET",
+    "path": "/book-requests/summary",
+    "permissions": ["Permission.BookRequestAccess"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/book-request.controller.ts",
+    "className": "BookRequestController",
+    "methodName": "getSourceStatus",
+    "httpMethod": "GET",
+    "path": "/book-requests/source-status",
+    "permissions": ["Permission.BookRequestAccess", "Permission.ManageAppSettings"],
+    "permissionMode": "any",
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/book-request.controller.ts",
+    "className": "BookRequestController",
+    "methodName": "getDefaultDestinations",
+    "httpMethod": "GET",
+    "path": "/book-requests/default-destinations",
+    "permissions": ["Permission.BookRequestAccess"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/book-request.controller.ts",
+    "className": "BookRequestController",
+    "methodName": "checkAvailability",
+    "httpMethod": "POST",
+    "path": "/book-requests/availability",
+    "permissions": ["Permission.BookRequestAccess"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/book-request.controller.ts",
+    "className": "BookRequestController",
+    "methodName": "getOne",
+    "httpMethod": "GET",
+    "path": "/book-requests/:id",
+    "permissions": ["Permission.BookRequestAccess"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/book-request.controller.ts",
+    "className": "BookRequestController",
+    "methodName": "dismissMany",
+    "httpMethod": "POST",
+    "path": "/book-requests/dismiss",
+    "permissions": ["Permission.BookRequestAccess"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/book-request.controller.ts",
+    "className": "BookRequestController",
+    "methodName": "dismiss",
+    "httpMethod": "POST",
+    "path": "/book-requests/:id/dismiss",
+    "permissions": ["Permission.BookRequestAccess"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/book-request.controller.ts",
+    "className": "BookRequestController",
+    "methodName": "restore",
+    "httpMethod": "POST",
+    "path": "/book-requests/:id/restore",
+    "permissions": ["Permission.BookRequestAccess"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/book-request.controller.ts",
+    "className": "BookRequestController",
+    "methodName": "setLanguage",
+    "httpMethod": "POST",
+    "path": "/book-requests/:id/language",
+    "permissions": ["Permission.BookRequestAccess"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/book-request.controller.ts",
+    "className": "BookRequestController",
+    "methodName": "cancel",
+    "httpMethod": "POST",
+    "path": "/book-requests/:id/cancel",
+    "permissions": ["Permission.BookRequestAccess"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/book-request.controller.ts",
+    "className": "BookRequestController",
+    "methodName": "cancelDownload",
+    "httpMethod": "POST",
+    "path": "/book-requests/:id/downloads/:downloadId/cancel",
+    "permissions": ["Permission.BookRequestAccess"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/book-request.controller.ts",
+    "className": "BookRequestController",
+    "methodName": "unsubscribe",
+    "httpMethod": "DELETE",
+    "path": "/book-requests/:id/subscription",
+    "permissions": ["Permission.BookRequestAccess"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/book-request-admin.controller.ts",
+    "className": "BookRequestAdminController",
+    "methodName": "listAll",
+    "httpMethod": "GET",
+    "path": "/admin/book-requests",
+    "permissions": ["Permission.ManageBookRequests"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/book-request-admin.controller.ts",
+    "className": "BookRequestAdminController",
+    "methodName": "listRequesters",
+    "httpMethod": "GET",
+    "path": "/admin/book-requests/requesters",
+    "permissions": ["Permission.ManageBookRequests"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/book-request-admin.controller.ts",
+    "className": "BookRequestAdminController",
+    "methodName": "listDownloadClients",
+    "httpMethod": "GET",
+    "path": "/admin/book-requests/download-clients",
+    "permissions": ["Permission.ManageBookRequests"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/book-request-admin.controller.ts",
+    "className": "BookRequestAdminController",
+    "methodName": "listReleases",
+    "httpMethod": "GET",
+    "path": "/admin/book-requests/:id/releases",
+    "permissions": ["Permission.ManageBookRequests"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/book-request-admin.controller.ts",
+    "className": "BookRequestAdminController",
+    "methodName": "searchReleases",
+    "httpMethod": "POST",
+    "path": "/admin/book-requests/:id/releases/search",
+    "permissions": ["Permission.ManageBookRequests"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/book-request-admin.controller.ts",
+    "className": "BookRequestAdminController",
+    "methodName": "inspectRelease",
+    "httpMethod": "POST",
+    "path": "/admin/book-requests/:id/releases/inspect",
+    "permissions": ["Permission.ManageBookRequests"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/book-request-admin.controller.ts",
+    "className": "BookRequestAdminController",
+    "methodName": "approveMany",
+    "httpMethod": "POST",
+    "path": "/admin/book-requests/approve",
+    "permissions": ["Permission.ManageBookRequests"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/book-request-admin.controller.ts",
+    "className": "BookRequestAdminController",
+    "methodName": "approve",
+    "httpMethod": "POST",
+    "path": "/admin/book-requests/:id/approve",
+    "permissions": ["Permission.ManageBookRequests"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/book-request-admin.controller.ts",
+    "className": "BookRequestAdminController",
+    "methodName": "reject",
+    "httpMethod": "POST",
+    "path": "/admin/book-requests/:id/reject",
+    "permissions": ["Permission.ManageBookRequests"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/book-request-admin.controller.ts",
+    "className": "BookRequestAdminController",
+    "methodName": "rejectMany",
+    "httpMethod": "POST",
+    "path": "/admin/book-requests/reject",
+    "permissions": ["Permission.ManageBookRequests"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/book-request-admin.controller.ts",
+    "className": "BookRequestAdminController",
+    "methodName": "remove",
+    "httpMethod": "DELETE",
+    "path": "/admin/book-requests/:id",
+    "permissions": ["Permission.ManageBookRequests"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/book-request-admin.controller.ts",
+    "className": "BookRequestAdminController",
+    "methodName": "fulfill",
+    "httpMethod": "POST",
+    "path": "/admin/book-requests/:id/fulfill",
+    "permissions": ["Permission.ManageBookRequests"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/book-request-admin.controller.ts",
+    "className": "BookRequestAdminController",
+    "methodName": "getReview",
+    "httpMethod": "GET",
+    "path": "/admin/book-requests/:id/review",
+    "permissions": ["Permission.ManageBookRequests"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/book-request-admin.controller.ts",
+    "className": "BookRequestAdminController",
+    "methodName": "forceFile",
+    "httpMethod": "POST",
+    "path": "/admin/book-requests/:id/force-file",
+    "permissions": ["Permission.ManageBookRequests"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/book-request-admin.controller.ts",
+    "className": "BookRequestAdminController",
+    "methodName": "discardImport",
+    "httpMethod": "POST",
+    "path": "/admin/book-requests/:id/discard-import",
+    "permissions": ["Permission.ManageBookRequests"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/book-request-admin.controller.ts",
+    "className": "BookRequestAdminController",
+    "methodName": "grab",
+    "httpMethod": "POST",
+    "path": "/admin/book-requests/:id/grab",
+    "permissions": ["Permission.ManageBookRequests"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/book-request-admin.controller.ts",
+    "className": "BookRequestAdminController",
+    "methodName": "attempts",
+    "httpMethod": "GET",
+    "path": "/admin/book-requests/:id/attempts",
+    "permissions": ["Permission.ManageBookRequests"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/book-request-admin.controller.ts",
+    "className": "BookRequestAdminController",
+    "methodName": "seedStatus",
+    "httpMethod": "GET",
+    "path": "/admin/book-requests/:id/seed",
+    "permissions": ["Permission.ManageBookRequests"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/book-request-admin.controller.ts",
+    "className": "BookRequestAdminController",
+    "methodName": "selectReleaseUnit",
+    "httpMethod": "POST",
+    "path": "/admin/book-requests/:id/downloads/:downloadId/select-unit",
+    "permissions": ["Permission.ManageBookRequests"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/book-request-admin.controller.ts",
+    "className": "BookRequestAdminController",
+    "methodName": "removeDownload",
+    "httpMethod": "POST",
+    "path": "/admin/book-requests/:id/downloads/:downloadId/remove",
+    "permissions": ["Permission.ManageBookRequests"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/book-request-automation.controller.ts",
+    "className": "BookRequestAutomationController",
+    "methodName": "get",
+    "httpMethod": "GET",
+    "path": "/admin/book-request-automation",
+    "permissions": ["Permission.ManageAppSettings"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/book-request-automation.controller.ts",
+    "className": "BookRequestAutomationController",
+    "methodName": "update",
+    "httpMethod": "PUT",
+    "path": "/admin/book-request-automation",
+    "permissions": ["Permission.ManageAppSettings"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/download-clients/download-client.controller.ts",
+    "className": "DownloadClientController",
+    "methodName": "findAll",
+    "httpMethod": "GET",
+    "path": "/admin/download-clients",
+    "permissions": ["Permission.ManageAppSettings"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/download-clients/download-client.controller.ts",
+    "className": "DownloadClientController",
+    "methodName": "findOne",
+    "httpMethod": "GET",
+    "path": "/admin/download-clients/:id",
+    "permissions": ["Permission.ManageAppSettings"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/download-clients/download-client.controller.ts",
+    "className": "DownloadClientController",
+    "methodName": "create",
+    "httpMethod": "POST",
+    "path": "/admin/download-clients",
+    "permissions": ["Permission.ManageAppSettings"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/download-clients/download-client.controller.ts",
+    "className": "DownloadClientController",
+    "methodName": "update",
+    "httpMethod": "PUT",
+    "path": "/admin/download-clients/:id",
+    "permissions": ["Permission.ManageAppSettings"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/download-clients/download-client.controller.ts",
+    "className": "DownloadClientController",
+    "methodName": "remove",
+    "httpMethod": "DELETE",
+    "path": "/admin/download-clients/:id",
+    "permissions": ["Permission.ManageAppSettings"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/download-clients/download-client.controller.ts",
+    "className": "DownloadClientController",
+    "methodName": "test",
+    "httpMethod": "POST",
+    "path": "/admin/download-clients/:id/test",
+    "permissions": ["Permission.ManageAppSettings"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/download-clients/download-client.controller.ts",
+    "className": "DownloadClientController",
+    "methodName": "testPathMapping",
+    "httpMethod": "POST",
+    "path": "/admin/download-clients/:id/test-path-mapping",
+    "permissions": ["Permission.ManageAppSettings"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/indexers/indexer.controller.ts",
+    "className": "IndexerController",
+    "methodName": "findAll",
+    "httpMethod": "GET",
+    "path": "/admin/request-indexers",
+    "permissions": ["Permission.ManageAppSettings"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/indexers/indexer.controller.ts",
+    "className": "IndexerController",
+    "methodName": "listAdapters",
+    "httpMethod": "GET",
+    "path": "/admin/request-indexers/adapters",
+    "permissions": ["Permission.ManageAppSettings"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/indexers/indexer.controller.ts",
+    "className": "IndexerController",
+    "methodName": "findOne",
+    "httpMethod": "GET",
+    "path": "/admin/request-indexers/:id",
+    "permissions": ["Permission.ManageAppSettings"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/indexers/indexer.controller.ts",
+    "className": "IndexerController",
+    "methodName": "create",
+    "httpMethod": "POST",
+    "path": "/admin/request-indexers",
+    "permissions": ["Permission.ManageAppSettings"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/indexers/indexer.controller.ts",
+    "className": "IndexerController",
+    "methodName": "update",
+    "httpMethod": "PUT",
+    "path": "/admin/request-indexers/:id",
+    "permissions": ["Permission.ManageAppSettings"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/indexers/indexer.controller.ts",
+    "className": "IndexerController",
+    "methodName": "remove",
+    "httpMethod": "DELETE",
+    "path": "/admin/request-indexers/:id",
+    "permissions": ["Permission.ManageAppSettings"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/indexers/indexer.controller.ts",
+    "className": "IndexerController",
+    "methodName": "test",
+    "httpMethod": "POST",
+    "path": "/admin/request-indexers/:id/test",
+    "permissions": ["Permission.ManageAppSettings"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/book-request-self-fulfil.controller.ts",
+    "className": "BookRequestSelfFulfilController",
+    "methodName": "listDownloadClients",
+    "httpMethod": "GET",
+    "path": "/book-request-fulfilment/download-clients",
+    "permissions": ["Permission.BookRequestAccess", "Permission.BookRequestSelfFulfill"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/book-request-self-fulfil.controller.ts",
+    "className": "BookRequestSelfFulfilController",
+    "methodName": "listReleases",
+    "httpMethod": "GET",
+    "path": "/book-request-fulfilment/:id/releases",
+    "permissions": ["Permission.BookRequestAccess", "Permission.BookRequestSelfFulfill"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/book-request-self-fulfil.controller.ts",
+    "className": "BookRequestSelfFulfilController",
+    "methodName": "searchReleases",
+    "httpMethod": "POST",
+    "path": "/book-request-fulfilment/:id/releases/search",
+    "permissions": ["Permission.BookRequestAccess", "Permission.BookRequestSelfFulfill"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/book-request-self-fulfil.controller.ts",
+    "className": "BookRequestSelfFulfilController",
+    "methodName": "inspectRelease",
+    "httpMethod": "POST",
+    "path": "/book-request-fulfilment/:id/releases/inspect",
+    "permissions": ["Permission.BookRequestAccess", "Permission.BookRequestSelfFulfill"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/book-request-self-fulfil.controller.ts",
+    "className": "BookRequestSelfFulfilController",
+    "methodName": "grab",
+    "httpMethod": "POST",
+    "path": "/book-request-fulfilment/:id/grab",
+    "permissions": ["Permission.BookRequestAccess", "Permission.BookRequestSelfFulfill"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/book-request-self-fulfil.controller.ts",
+    "className": "BookRequestSelfFulfilController",
+    "methodName": "attempts",
+    "httpMethod": "GET",
+    "path": "/book-request-fulfilment/:id/attempts",
+    "permissions": ["Permission.BookRequestAccess", "Permission.BookRequestSelfFulfill"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/book-request-self-fulfil.controller.ts",
+    "className": "BookRequestSelfFulfilController",
+    "methodName": "seedStatus",
+    "httpMethod": "GET",
+    "path": "/book-request-fulfilment/:id/seed",
+    "permissions": ["Permission.BookRequestAccess", "Permission.BookRequestSelfFulfill"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/book-request-self-fulfil.controller.ts",
+    "className": "BookRequestSelfFulfilController",
+    "methodName": "getReview",
+    "httpMethod": "GET",
+    "path": "/book-request-fulfilment/:id/review",
+    "permissions": ["Permission.BookRequestAccess", "Permission.BookRequestSelfFulfill"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/book-request-self-fulfil.controller.ts",
+    "className": "BookRequestSelfFulfilController",
+    "methodName": "forceFile",
+    "httpMethod": "POST",
+    "path": "/book-request-fulfilment/:id/force-file",
+    "permissions": ["Permission.BookRequestAccess", "Permission.BookRequestSelfFulfill"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/book-request-self-fulfil.controller.ts",
+    "className": "BookRequestSelfFulfilController",
+    "methodName": "discardImport",
+    "httpMethod": "POST",
+    "path": "/book-request-fulfilment/:id/discard-import",
+    "permissions": ["Permission.BookRequestAccess", "Permission.BookRequestSelfFulfill"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-request/book-request-self-fulfil.controller.ts",
+    "className": "BookRequestSelfFulfilController",
+    "methodName": "selectReleaseUnit",
+    "httpMethod": "POST",
+    "path": "/book-request-fulfilment/:id/downloads/:downloadId/select-unit",
+    "permissions": ["Permission.BookRequestAccess", "Permission.BookRequestSelfFulfill"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/maintenance/missing-resources.controller.ts",
+    "className": "MissingResourcesController",
+    "methodName": "getSummary",
+    "httpMethod": "GET",
+    "path": "/maintenance/missing-resources",
+    "permissions": ["Permission.LibraryDeleteBooks"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/maintenance/missing-resources.controller.ts",
+    "className": "MissingResourcesController",
+    "methodName": "getSweep",
+    "httpMethod": "GET",
+    "path": "/maintenance/missing-resources/sweep",
+    "permissions": ["Permission.LibraryDeleteBooks"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/maintenance/missing-resources.controller.ts",
+    "className": "MissingResourcesController",
+    "methodName": "startSweep",
+    "httpMethod": "POST",
+    "path": "/maintenance/missing-resources/sweep",
+    "permissions": ["Permission.LibraryDeleteBooks"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/maintenance/missing-resources.controller.ts",
+    "className": "MissingResourcesController",
+    "methodName": "listMissingBooks",
+    "httpMethod": "GET",
+    "path": "/maintenance/missing-resources/books",
+    "permissions": ["Permission.LibraryDeleteBooks"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/maintenance/missing-resources.controller.ts",
+    "className": "MissingResourcesController",
+    "methodName": "listBrokenCovers",
+    "httpMethod": "GET",
+    "path": "/maintenance/missing-resources/broken-covers",
+    "permissions": ["Permission.LibraryDeleteBooks"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/maintenance/missing-resources.controller.ts",
+    "className": "MissingResourcesController",
+    "methodName": "listOrphanedCoverDirs",
+    "httpMethod": "GET",
+    "path": "/maintenance/missing-resources/orphaned-covers",
+    "permissions": ["Permission.LibraryDeleteBooks"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/maintenance/missing-resources.controller.ts",
+    "className": "MissingResourcesController",
+    "methodName": "cleanMissingBooks",
+    "httpMethod": "POST",
+    "path": "/maintenance/missing-resources/books/clean",
+    "permissions": ["Permission.LibraryDeleteBooks"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/maintenance/missing-resources.controller.ts",
+    "className": "MissingResourcesController",
+    "methodName": "cleanBrokenCovers",
+    "httpMethod": "POST",
+    "path": "/maintenance/missing-resources/broken-covers/clean",
+    "permissions": ["Permission.LibraryDeleteBooks", "Permission.LibraryEditMetadata"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/maintenance/missing-resources.controller.ts",
+    "className": "MissingResourcesController",
+    "methodName": "cleanOrphanedCoverDirs",
+    "httpMethod": "POST",
+    "path": "/maintenance/missing-resources/orphaned-covers/clean",
+    "permissions": ["Permission.LibraryDeleteBooks", "Permission.ManageLibraries"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/series/series.controller.ts",
+    "className": "SeriesController",
+    "methodName": "findNextBook",
+    "httpMethod": "GET",
+    "path": "/series/:seriesId/books/:bookId/next",
+    "permissions": [],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
+  },
+  {
+    "file": "server/src/modules/book-dock/book-dock.controller.ts",
+    "className": "BookDockController",
+    "methodName": "refetchMetadata",
+    "httpMethod": "POST",
+    "path": "/book-dock/files/:id/refetch-metadata",
+    "permissions": ["Permission.BookDockAccess"],
+    "libraryAccess": [],
+    "isPublic": false,
+    "allowDefault": false,
+    "useGuards": []
   }
 ]
diff --git a/server/test/e2e/authorization-matrix/route-inventory/uncovered-routes.json b/server/test/e2e/authorization-matrix/route-inventory/uncovered-routes.json
new file mode 100644
index 000000000..d5074dc57
--- /dev/null
+++ b/server/test/e2e/authorization-matrix/route-inventory/uncovered-routes.json
@@ -0,0 +1,300 @@
+[
+  "DELETE /admin/request-indexers/plugins/:type",
+  "DELETE /annotations/:annotationId",
+  "DELETE /auth/magic-links/:id",
+  "DELETE /auth/oidc/identities/:providerId",
+  "DELETE /authors/:id/image",
+  "DELETE /books/:id|:bookId/annotations/:annotationId",
+  "DELETE /books/:id|:bookId/bookmarks/:bookmarkId",
+  "DELETE /books/:id|:bookId/cover",
+  "DELETE /books/:id|:bookId/reading-attempts/:attemptId",
+  "DELETE /books/:id|:bookId/sessions/:sessionId",
+  "DELETE /books/files/:fileId",
+  "DELETE /books/files/:fileId/progress",
+  "DELETE /custom-icons/:slug",
+  "DELETE /custom-metadata/fields/:id",
+  "DELETE /custom-metadata/fields/:id/permanent",
+  "DELETE /fonts/:id",
+  "DELETE /hardcover/settings",
+  "DELETE /hardcover/sync",
+  "DELETE /kobo/:deviceToken/v1/library/tags/:tagId",
+  "DELETE /koreader/devices/:deviceId",
+  "DELETE /koreader/devices/:deviceId/file-naming-pattern",
+  "DELETE /koreader/hash-links/:hash",
+  "DELETE /koreader/unmatched-books",
+  "DELETE /koreader/unmatched-books/:hash",
+  "DELETE /libraries/:id|:libraryId",
+  "DELETE /libraries/:id|:libraryId/access/:userId",
+  "DELETE /migration/sources/:id",
+  "DELETE /server-fonts/:id",
+  "DELETE /storygraph/settings",
+  "DELETE /storygraph/sync",
+  "GET /achievements",
+  "GET /annotations",
+  "GET /annotations/:annotationId/sync-detail",
+  "GET /annotations/books",
+  "GET /annotations/export",
+  "GET /api/UserStorage/Metadata",
+  "GET /api/v3/content/:contentId/annotations",
+  "GET /app-info",
+  "GET /app-settings/cross-platform-path-sanitization",
+  "GET /app-settings/default-library-access",
+  "GET /app-settings/upload-pattern-folder",
+  "GET /audit-log/actors",
+  "GET /auth/magic-links",
+  "GET /auth/oidc/identities",
+  "GET /authors/metadata/stream",
+  "GET /book-duplicates/scans/:scanId",
+  "GET /book-duplicates/scans/:scanId/groups",
+  "GET /book-duplicates/scans/active",
+  "GET /books/:id|:bookId",
+  "GET /books/:id|:bookId/annotations",
+  "GET /books/:id|:bookId/audio-progress",
+  "GET /books/:id|:bookId/author-books",
+  "GET /books/:id|:bookId/bookmarks",
+  "GET /books/:id|:bookId/cover",
+  "GET /books/:id|:bookId/kobo-state",
+  "GET /books/:id|:bookId/metadata-from-file",
+  "GET /books/:id|:bookId/progress",
+  "GET /books/:id|:bookId/reading-attempts",
+  "GET /books/:id|:bookId/recommendations",
+  "GET /books/:id|:bookId/series-books",
+  "GET /books/:id|:bookId/sessions",
+  "GET /books/:id|:bookId/thumbnail",
+  "GET /books/:id|:bookId/write-log",
+  "GET /books/export/download",
+  "GET /books/files/:fileId/download",
+  "GET /browse-counts",
+  "GET /custom-icons",
+  "GET /custom-icons/:slug.svg",
+  "GET /custom-icons/:slug/usage",
+  "GET /custom-icons/manage",
+  "GET /custom-metadata/fields",
+  "GET /custom-metadata/fields/active",
+  "GET /dashboard/widgets/currently-reading",
+  "GET /dashboard/widgets/diversity-score",
+  "GET /dashboard/widgets/highlight-of-the-day",
+  "GET /dashboard/widgets/library-overview",
+  "GET /dashboard/widgets/long-wait",
+  "GET /dashboard/widgets/monthly-challenge",
+  "GET /dashboard/widgets/neglected-gems",
+  "GET /dashboard/widgets/reading-dna",
+  "GET /dashboard/widgets/reading-goal",
+  "GET /dashboard/widgets/reading-rhythm",
+  "GET /dashboard/widgets/reading-streak",
+  "GET /dashboard/widgets/year-projection",
+  "GET /fonts",
+  "GET /fonts/:id/file",
+  "GET /hardcover/books",
+  "GET /hardcover/books/:bookId/editions",
+  "GET /hardcover/books/:bookId/sync-state",
+  "GET /hardcover/sync/pending",
+  "GET /hardcover/sync/status",
+  "GET /hardcover/sync/stream",
+  "GET /health",
+  "GET /kobo/:deviceToken/api/UserStorage/Metadata",
+  "GET /kobo/:deviceToken/api/v3/content/:contentId/annotations",
+  "GET /kobo/history",
+  "GET /koreader/file-naming-pattern",
+  "GET /koreader/hash-links",
+  "GET /koreader/plugin-package",
+  "GET /koreader/plugin/catalog/books",
+  "GET /koreader/plugin/catalog/books/:bookId",
+  "GET /koreader/plugin/catalog/books/:bookId/thumbnail",
+  "GET /koreader/plugin/catalog/dashboard",
+  "GET /koreader/plugin/catalog/dashboard/discover",
+  "GET /koreader/plugin/catalog/dashboard/sections/:type",
+  "GET /koreader/plugin/catalog/files/:fileId/download",
+  "GET /koreader/plugin/catalog/manifest",
+  "GET /koreader/plugin/catalog/root",
+  "GET /koreader/plugin/catalog/sections/:section",
+  "GET /koreader/plugin/package",
+  "GET /koreader/plugin/version",
+  "GET /koreader/syncs/progress/:document",
+  "GET /koreader/unmatched-books",
+  "GET /koreader/users/auth",
+  "GET /libraries/:id|:libraryId",
+  "GET /libraries/:id|:libraryId/access",
+  "GET /libraries/:id|:libraryId/bulk-rename/preview",
+  "GET /libraries/:id|:libraryId/bulk-rename/status",
+  "GET /libraries/:id|:libraryId/stats",
+  "GET /metadata-fetch/stream",
+  "GET /migration/runs/:id/progress",
+  "GET /migration/runs/:id/report",
+  "GET /migration/runs/:id/report/export",
+  "GET /migration/sources/:id/path-prefixes",
+  "GET /migration/sources/:id/user-mapping-suggestions",
+  "GET /migration/state",
+  "GET /migration/supported-types",
+  "GET /migration/target-users",
+  "GET /release-notes",
+  "GET /series",
+  "GET /series/:seriesId/books",
+  "GET /server-fonts",
+  "GET /server-fonts/:id/file",
+  "GET /storygraph/books",
+  "GET /storygraph/books/:bookId/editions",
+  "GET /storygraph/books/:bookId/sync-state",
+  "GET /storygraph/sync/failures",
+  "GET /storygraph/sync/pending",
+  "GET /storygraph/sync/status",
+  "GET /storygraph/sync/stream",
+  "GET /user-preferences/book-requests",
+  "GET /user-preferences/cover-search",
+  "GET /user-preferences/display",
+  "GET /user-preferences/locale",
+  "GET /user-preferences/server-fonts",
+  "GET /user-preferences/theme",
+  "GET /user-preferences/whats-new",
+  "GET /user-statistics/reading-source-distribution",
+  "GET /users/:id/content-filters",
+  "GET /users/me/content-filters",
+  "PATCH /api/v3/content/:contentId/annotations",
+  "PATCH /auth/magic-links/:id",
+  "PATCH /books/:id|:bookId/added-at",
+  "PATCH /books/:id|:bookId/annotations/:annotationId",
+  "PATCH /books/:id|:bookId/audio-progress",
+  "PATCH /books/:id|:bookId/metadata",
+  "PATCH /books/:id|:bookId/metadata-and-locks",
+  "PATCH /books/:id|:bookId/metadata-locks",
+  "PATCH /books/:id|:bookId/personal-note",
+  "PATCH /books/:id|:bookId/reading-attempts/:attemptId",
+  "PATCH /books/:id|:bookId/status",
+  "PATCH /books/files/:fileId",
+  "PATCH /custom-icons/:slug/svg",
+  "PATCH /custom-metadata/fields/:id",
+  "PATCH /custom-metadata/fields/reorder",
+  "PATCH /fonts/:id",
+  "PATCH /hardcover/books/:bookId/edition",
+  "PATCH /hardcover/books/:bookId/sync-state",
+  "PATCH /hardcover/settings",
+  "PATCH /kobo/:deviceToken/api/v3/content/:contentId/annotations",
+  "PATCH /koreader/devices/:deviceId",
+  "PATCH /koreader/hash-links/:hash",
+  "PATCH /libraries/:id|:libraryId",
+  "PATCH /libraries/:id|:libraryId/access/:userId",
+  "PATCH /readwise/settings",
+  "PATCH /server-fonts/:id",
+  "PATCH /storygraph/books/:bookId/edition",
+  "PATCH /storygraph/books/:bookId/link",
+  "PATCH /storygraph/books/:bookId/sync-state",
+  "PATCH /storygraph/settings",
+  "PATCH /users/me/reader-storage-mode",
+  "PATCH /users/me/series-collapse-preferences",
+  "PATCH /users/me/settings",
+  "PATCH /users/me/theme-storage-mode",
+  "POST /achievements/admin/backfill",
+  "POST /admin/request-indexers/plugins",
+  "POST /admin/request-indexers/plugins/inspect",
+  "POST /annotations/:annotationId/positions/retry",
+  "POST /annotations/:annotationId/restore",
+  "POST /annotations/bulk",
+  "POST /api/v3/content/checkforchanges",
+  "POST /auth/magic-links",
+  "POST /auth/magic-links/login",
+  "POST /auth/oidc/:slug/link-state",
+  "POST /auth/oidc/:slug/preview-state",
+  "POST /auth/oidc/:slug/state",
+  "POST /authors/:id/image",
+  "POST /book-dock/finalize/discard-duplicates",
+  "POST /book-dock/finalize/preview",
+  "POST /book-dock/pause",
+  "POST /book-dock/resume",
+  "POST /book-duplicates/scans",
+  "POST /books/:id|:bookId/annotations",
+  "POST /books/:id|:bookId/bookmarks",
+  "POST /books/:id|:bookId/cover",
+  "POST /books/:id|:bookId/cover/from-url",
+  "POST /books/:id|:bookId/files",
+  "POST /books/:id|:bookId/re-extract-cover",
+  "POST /books/:id|:bookId/reading-attempts",
+  "POST /books/:id|:bookId/reading-attempts/start-reread",
+  "POST /books/:id|:bookId/refresh-metadata",
+  "POST /books/:id|:bookId/rename-files",
+  "POST /books/:id|:bookId/reset-reading-state",
+  "POST /books/:id|:bookId/sessions",
+  "POST /books/:id|:bookId/write-and-rename",
+  "POST /books/bulk-edit-metadata",
+  "POST /books/bulk-set-metadata",
+  "POST /books/bulk-set-metadata-lock",
+  "POST /books/bulk-set-rating",
+  "POST /books/bulk-set-status",
+  "POST /books/bulk-update-tags",
+  "POST /books/metadata-export/download",
+  "POST /books/metadata-export/preflight",
+  "POST /collections/:id/books/jump-buckets",
+  "POST /collections/:id/books/query",
+  "POST /collections/membership",
+  "POST /custom-icons",
+  "POST /custom-icons/bulk-delete",
+  "POST /custom-icons/stage",
+  "POST /custom-metadata/fields",
+  "POST /custom-metadata/fields/:id/restore",
+  "POST /dashboard/widgets/batch",
+  "POST /fonts/upload",
+  "POST /hardcover/books/:bookId/sync",
+  "POST /hardcover/import/apply",
+  "POST /hardcover/import/preview",
+  "POST /hardcover/sync",
+  "POST /hardcover/validate-token",
+  "POST /kobo/:deviceToken/api/v3/content/checkforchanges",
+  "POST /kobo/:deviceToken/v1/library/tags/:tagId/items",
+  "POST /kobo/:deviceToken/v1/library/tags/:tagId/items/delete",
+  "POST /koreader/books/:bookId/reset-hold/release",
+  "POST /koreader/plugin/annotations",
+  "POST /koreader/plugin/annotations/exchange",
+  "POST /koreader/plugin/annotations/exchange-ack",
+  "POST /koreader/plugin/book-states",
+  "POST /koreader/plugin/bookmarks/exchange",
+  "POST /koreader/plugin/bookmarks/exchange-ack",
+  "POST /koreader/plugin/match-check",
+  "POST /koreader/plugin/page-stats",
+  "POST /koreader/plugin/progress",
+  "POST /koreader/plugin/sweeps",
+  "POST /koreader/unmatched-books/:hash/link",
+  "POST /koreader/users/create",
+  "POST /libraries/:id|:libraryId/access",
+  "POST /libraries/:id|:libraryId/books",
+  "POST /libraries/:id|:libraryId/books/jump-buckets",
+  "POST /libraries/:id|:libraryId/bulk-rename/execute",
+  "POST /libraries/:id|:libraryId/upload",
+  "POST /libraries/:id|:libraryId/write-metadata-to-files",
+  "POST /metadata-preferences/providers/:key/test",
+  "POST /migration/plans/:id/resolve-duplicates",
+  "POST /migration/plans/dry-run",
+  "POST /migration/profiles",
+  "POST /migration/runs/:id/cancel",
+  "POST /migration/runs/:id/retry",
+  "POST /migration/runs/live",
+  "POST /migration/sources",
+  "POST /migration/sources/:id/path-mappings/validate",
+  "POST /migration/sources/:id/validate",
+  "POST /migration/sources/test",
+  "POST /path",
+  "POST /readwise/validate-token",
+  "POST /server-fonts/upload",
+  "POST /smart-scopes/:id/books/jump-buckets",
+  "POST /smart-scopes/:id/books/query",
+  "POST /storygraph/books/:bookId/rematch",
+  "POST /storygraph/books/:bookId/sync",
+  "POST /storygraph/sync",
+  "POST /storygraph/validate-cookies",
+  "POST /users/shared",
+  "PUT /app-settings/cross-platform-path-sanitization",
+  "PUT /app-settings/default-library-access",
+  "PUT /app-settings/upload-pattern-folder",
+  "PUT /koreader/devices/:deviceId/file-naming-pattern",
+  "PUT /koreader/file-naming-pattern",
+  "PUT /koreader/plugin/catalog/books/:bookId/rating",
+  "PUT /koreader/plugin/catalog/books/:bookId/read-status",
+  "PUT /koreader/syncs/progress",
+  "PUT /smart-scopes/:id/kobo-sync",
+  "PUT /user-preferences/book-requests",
+  "PUT /user-preferences/cover-search",
+  "PUT /user-preferences/display",
+  "PUT /user-preferences/locale",
+  "PUT /user-preferences/server-fonts",
+  "PUT /user-preferences/theme",
+  "PUT /user-preferences/whats-new",
+  "PUT /users/:id/content-filters"
+]