Define multiline reStructuredText docstrings and item-level documentation for dataclasses, Pydantic models, and Protocols. Align agent instructions, review guidance, and development documentation.
Validation: document links, Python example syntax, docstring format, and diff checks passed. The unchanged text-only architecture documentation test passed under isolated pytest with temporary CONFIG_DIR and no application bootstrap. Normal bootstrap remains unverified because the local environment lacks moviepilot_rust; installed uv also predates the project configuration format. No product code changed.
Recover Jellyfin deletion paths from webhook payloads or bounded server-scoped caches. Avoid querying deleted items and preserve TV season/series lookup behavior.
BREAKING CHANGE: Movie and unspecified-type history queries without a destination now return no records unless match_all_versions=True is explicitly requested.
Refs #6988
Recover complete release coverage from successful local transfers and audio tags/CUE before subscription searches. Keep release-group and album boundaries, and reject completed torrent hashes before downloader submission.
Keep enabled host and clone sources in dependency recovery. Fall back to per-plugin requests while retaining ready and recovered manifest constraints, preserving original sources and cancellation ownership.
Refs #6943
The access-token endpoint accepted unlimited password attempts; the
only existing rate limiters are single-instance helpers for outbound
site requests. Add app/application/security/throttle.py, an in-memory
LoginThrottle keyed by (client address, normalized username) that locks
for 30s after five consecutive failures and doubles the lockout up to
15 minutes. The endpoint answers 429 with Retry-After while locked,
counts only real credential failures (an MFA challenge after a correct
password does not count), and clears the record on success.
X-Forwarded-For is deliberately not trusted because there is no
trusted-proxy setting; behind the bundled nginx all requests share one
address, so the key degrades to per-username throttling, which is the
dimension brute-force protection needs. Sync the dependency snapshot
and architecture metrics for the new module.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
