An ownership safety fix. No new features.
What changed
A download Protectarr has only just noticed is no longer treated as a download nobody owns.
Until now, a scan that saw a release before the owning application had published it to its queue concluded that nothing owned it. In allowlist or either mode that could remove it from qBittorrent, deleting the data with no blocklist entry and no replacement search, while the application sat waiting for an import that was never coming.
The window is real and was measured against Sonarr 4.0.20 and Radarr 6.4.4:
- a grabbed release reaches qBittorrent ~5 seconds before the application's queue publishes it
- against Protectarr's 20-second scan, that is roughly one grab in four landing inside the gap
That is consistent with the behaviour some operators will have seen: one release handled correctly and a near-identical one deleted outright, with nothing in the configuration to explain the difference.
The two changes
Uncertainty is written down first. A download nothing claims and nothing remembers is recorded as provisional before anything is decided about it. A crash or a restart mid-scan now leaves it protected rather than forgotten.
Direct removal requires a fresh check, made for that attempt:
- every configured application reachable
- every one asked to re-read its download client, and confirmed finished
- no live queue claim for that exact torrent
- no retained grab event naming that exact torrent
Anything that fails leaves the download alone. An application down, a refresh that did not complete, a queue or history that could not be read: an answer that could not be obtained is not an answer.
What Protectarr will and will not claim
The strongest statement it now makes before removing a download directly is:
after synchronising every application and checking current queue and retained history, no current ownership could be established
It does not claim the download was never owned. Deleting a series or movie erases its history while the torrent keeps downloading, so absence of evidence genuinely is not evidence here.
Accordingly, if an application's history says it grabbed the release, that is remembered and the download is protected from direct removal from then on, even though there is no queue record to hand it back through. A later check finding nothing does not withdraw what was already seen.
Cost
One refresh per application per scan, not per download, and none at all on a scan where nothing reaches that point. Ten downloads across five applications costs 5 refresh commands; fifty downloads still costs 5.
Unchanged
- Downloads an application genuinely owns: removal, blocklisting, verification and replacement searches.
- Orphan handling and its dwell.
- The v0.9.1 protection for downloads whose stored ownership names an application.
- The v0.9.2 rule that an "unknown download" queue entry is not ownership.
arr_tracked, the default mode, which has never removed anything directly.
Notes
- No configuration changes. No migration.
- README screenshots still show v0.9.0; patch releases do not regenerate them.
ghcr.io/irnutsmurt/protectarr:0.9.3