docs(arr-chain): Prowlarr feed contract cracked, qB PBKDF2 persistence recipe, chain proof

serverAppConfigs-docs/log.md

@@ -11,6 +11,39 @@ timestamp: 2026-09-14
 
 # Bundle Change Log
 
+## 2026-08-30 (late) — download chain proven end to end; qB credentials persisted
+- **Cracked the arr↔Prowlarr feed contract**: route is `/{indexerId}/api`
+  (Prowlarr `NewznabController`; absolute `/api/v1/indexer/{id}/newznab`),
+  auth = the Prowlarr **global** key. The previously hand-rolled
+  `/torznab/{id}/feed` paths were Forms-auth catch-alls returning
+  `302 → /login` — which the arrs XML-parsed as "unexpected token '/'".
+  A source-verified librarian answer settled it in one shot.
+- **Re-pointed all four arr indexer rows** (Radarr→YTS id7,
+  Sonarr/Lidarr→Nyaa id4, Readarr→Byrutor id3) via each app's own API;
+  every PUT passed the app's live connection validator (202); RSS enabled.
+- **First real grab**: `MoviesSearch` → 3 YTS releases → *The Dark Knight
+  (2008) 2160p* (7.5 GiB) → qBittorrent 100 % → **imported**
+  (`hasFile: true`, 8,078,103,833 B at `/movies/The Dark Knight (2008)`,
+  hardlinked from the shared `/mnt/entropy` filesystem), queue empty.
+- **Prowlarr Application auto-sync found broken by version skew**
+  (`Unable to cast object of type 'NzbDrone.Core.Thing…'` against Radarr
+  6.3) — the manual rows are the integration; documented.
+- **qBittorrent permanent credentials installed**: the WebUI temp password
+  rotated on every boot (it had silently broken the arr clients once this
+  session). qb5 removed the API password endpoint and the lscr image has
+  no env support — wrote `WebUI\Password_PBKDF2` (source-verified
+  `base64(salt):base64(PBKDF2-HMAC-SHA512/100k)` form) into the conf with
+  the container stopped; login survives `podman restart` (204). All arr
+  download clients updated to it; value kept host-local in
+  `/home/dank/.qbpass` (0600), never in git.
+- **Readarr parked with reason**: abandoned upstream; its qB client cannot
+  authenticate against qB 5 while three sibling apps pass with identical
+  credentials. Indexer row healthy; books pipeline awaits a successor.
+- **Docs**: rewrote `Dankserver/prowlarr.md` (live wiring + six verified
+  gotchas incl. the joiner bug and the 302-masquerading-as-auth failure)
+  and `Dankserver/qbittorrent.md` (persistent-credential recipe, Referer
+  CSRF note).
+
 ## 2026-08-29 (late) — guarded-host sign-in fixed end to end
 - **Diagnosed** both user symptoms: `Invalid next URL` = the flow being entered with an absolute cross-host `next=` (open-redirect guard rejects at completion); phone "hostname could not be found" = the public DNS zone had **no `auth` A record** (added via Porkbun API, `auth A 71.227.227.172 TTL 300`).
 - **Disproved meta-header routing** live (full meta-header set still 404s; matching `Host` alone answers). The 2026.8 embedded outpost routes solely on the original `Host` vs each proxy provider's `external_host`.