feat: large polish pass — UX fixes, per-chat scope, restore/backup, action events

Backend
- Per-chat album scope for Immich commands (search/latest/memory/...): new
  allowed_album_ids on CommandTrackerListener, threaded listener/page kwargs
  through ProviderCommandHandler.handle; PATCH listener-scope endpoint.
- /search and /find accept a trailing page number; Immich client search_smart
  / search_metadata take a page param.
- Immich person-asset lookup switched from removed GET /api/people/{id}/assets
  to POST /api/search/metadata with personIds (fixes /person command and
  auto_organize rules silently returning zero candidates on Immich 1.106+).
- Auto_organize rule now sets the target album's thumbnail to the first added
  image when missing (falls back to any asset type); failures do not fail the
  rule. add_assets_to_album surfaces the Immich error body on non-2xx.
- EventLog.user_id / action_id / action_name columns with defensive migration
  + backfill. Status query filters by user_id directly; Immich/webhook paths
  emit user_id explicitly. action_runner writes an action_success/partial/
  failed event on each non-dry-run.
- Dashboard DELETE /api/status/events (scoped to user_id) + rendering live
  tracker/provider/action names via FK join with snapshot fallback.
- PATCH /api/users/{id} for username/role change with last-admin guard.
- Deletion protection returns structured {message, entity, blocked_by}
  (ApiError carries .blockedBy; frontend opens BlockedByModal).
- Backup prepare-restore → AppSetting markers + atomic write of
  pending_restore.json; lifespan hook applies on next startup and archives
  under data/applied_restores/. apply-restart sends SIGTERM so the lifespan
  shutdown runs; NOTIFY_BRIDGE_SUPERVISED env override gates the button.
  Manual POST /api/backup/files (same format as scheduled).
- New periodic-summary test path reuses shared collect_scheduled_assets
  (limit=0) so test and future production code go through one primitive.
- Per-receiver locale for Telegram test messages (resolves
  TelegramChat.language_override per chat instead of applying the first
  receiver's locale to everyone).
- Bounded concurrency (semaphores) in NotificationDispatcher._preload_asset_data
  and _refresh_telegram_chat_titles; chat title sweep extended to 24h since
  save_chat_from_webhook covers active chats opportunistically.
- Telegram poller detects the \"webhook is active\" 409 and auto-calls
  deleteWebhook for bots whose DB update_mode is polling (throttled per bot).
- TelegramClient.get_chat added (CLAUDE.md rule 6); set_album_thumbnail added.
- Seeds: rename \"Default Commands\" → \"Default Immich Commands\";
  track_assets_removed default False.

Frontend
- Global provider selector visible when there is only one provider.
- Clear-events button + i18n + ConfirmModal on the dashboard; new icons/
  labels/filters/colors for action_success / action_partial / action_failed.
- Auto-select first available tracking/template/command/config + bot on
  create forms (trackers, command-trackers, targets, template/command
  configs).
- Telegram target disable_url_preview defaults to true.
- BlockedByModal wired into 8 deletion flows; fetchAuth helper for
  multipart/binary calls (reuses api()'s refresh + ApiError mapping).
- Immich tracker 'Checking links' parallelised (concurrency cap 6).
- Backup page: pending-restore banner + Apply-now / Apply-later modal,
  restarting overlay polling /api/health, manual 'Create backup' button.
- Command-trackers listener row gets an 'Edit album scope' modal with
  inherit/explicit multiselect.
- Users page: Edit user modal (username + role).
- parseDate helper for consistent UTC date rendering.

Migrations / schema
- event_log: + user_id, action_id, action_name (+ backfill user_id from
  notification_tracker).
- command_tracker_listener: + allowed_album_ids.

packages/server/src/notify_bridge_server/api/backup.py

@@ -1,10 +1,13 @@
 """Configuration backup/restore API (admin only)."""
 
+import asyncio
 import json
 import logging
+import os
+import signal
 from datetime import datetime, timezone
 
-from fastapi import APIRouter, Depends, HTTPException, UploadFile, File, Query
+from fastapi import APIRouter, BackgroundTasks, Depends, HTTPException, UploadFile, File, Query
 from fastapi.responses import JSONResponse
 from sqlmodel.ext.asyncio.session import AsyncSession
 
@@ -16,10 +19,24 @@ from ..services.backup_schema import (
     ALL_CATEGORIES, BackupCategory, BackupFile, ConflictMode, SecretsMode,
 )
 from ..services.backup_service import (
-    cleanup_old_backups, export_backup, import_backup, list_backup_files,
-    validate_backup,
+    cleanup_old_backups, export_backup, export_backup_to_file, import_backup,
+    list_backup_files, validate_backup,
 )
 
+# Pending-restore marker keys (single source of truth consumed at startup)
+PENDING_RESTORE_PATH_KEY = "pending_restore_path"
+PENDING_RESTORE_CONFLICT_KEY = "pending_restore_conflict_mode"
+PENDING_RESTORE_UPLOADED_AT_KEY = "pending_restore_uploaded_at"
+PENDING_RESTORE_UPLOADED_BY_KEY = "pending_restore_uploaded_by"
+
+
+def _pending_restore_path():
+    return app_config.data_dir / "pending_restore.json"
+
+
+def _applied_restores_dir():
+    return app_config.data_dir / "applied_restores"
+
 _LOGGER = logging.getLogger(__name__)
 
 router = APIRouter(prefix="/api/backup", tags=["backup"])
@@ -131,6 +148,188 @@ async def import_config(
     return result.model_dump()
 
 
+# ---------------------------------------------------------------------------
+# Pending restore (prepare → apply on next restart)
+# ---------------------------------------------------------------------------
+
+async def _set_app_setting(session: AsyncSession, key: str, value: str) -> None:
+    row = await session.get(AppSetting, key)
+    if row:
+        row.value = value
+    else:
+        row = AppSetting(key=key, value=value)
+    session.add(row)
+
+
+async def _clear_pending_restore_markers(session: AsyncSession) -> None:
+    for key in (
+        PENDING_RESTORE_PATH_KEY,
+        PENDING_RESTORE_CONFLICT_KEY,
+        PENDING_RESTORE_UPLOADED_AT_KEY,
+        PENDING_RESTORE_UPLOADED_BY_KEY,
+    ):
+        row = await session.get(AppSetting, key)
+        if row:
+            await session.delete(row)
+
+
+@router.post("/prepare-restore")
+async def prepare_restore(
+    file: UploadFile = File(...),
+    conflict_mode: ConflictMode = Query(default=ConflictMode.SKIP),
+    user: User = Depends(require_admin),
+    session: AsyncSession = Depends(get_session),
+):
+    """Stage a backup for restore on next backend restart.
+
+    Validates the uploaded file, writes it to ``data/pending_restore.json``,
+    and persists marker settings so startup will apply it atomically.
+    """
+    content = await file.read()
+    if len(content) > MAX_UPLOAD_SIZE:
+        raise HTTPException(status_code=400, detail="File too large (max 10 MB)")
+
+    try:
+        raw = json.loads(content)
+    except json.JSONDecodeError as e:
+        raise HTTPException(status_code=400, detail=f"Invalid JSON: {e}")
+
+    validation = validate_backup(raw)
+    if not validation.valid:
+        raise HTTPException(
+            status_code=400,
+            detail=f"Invalid backup: {'; '.join(validation.errors)}",
+        )
+
+    pending_path = _pending_restore_path()
+    pending_path.parent.mkdir(parents=True, exist_ok=True)
+    # Atomic write: write to tmp then rename, so a crash mid-write never
+    # leaves a truncated pending_restore.json that would break startup apply.
+    tmp_path = pending_path.with_suffix(pending_path.suffix + ".tmp")
+    tmp_path.write_text(json.dumps(raw), encoding="utf-8")
+    os.replace(tmp_path, pending_path)
+
+    now_iso = datetime.now(timezone.utc).isoformat()
+    await _set_app_setting(session, PENDING_RESTORE_PATH_KEY, str(pending_path))
+    await _set_app_setting(session, PENDING_RESTORE_CONFLICT_KEY, conflict_mode.value)
+    await _set_app_setting(session, PENDING_RESTORE_UPLOADED_AT_KEY, now_iso)
+    await _set_app_setting(session, PENDING_RESTORE_UPLOADED_BY_KEY, user.username)
+    await session.commit()
+
+    return {
+        "pending": True,
+        "uploaded_at": now_iso,
+        "uploaded_by": user.username,
+        "conflict_mode": conflict_mode.value,
+        "validation": validation.model_dump(),
+        "supervised": _is_supervised(),
+    }
+
+
+@router.get("/pending-restore")
+async def get_pending_restore(
+    user: User = Depends(require_admin),
+    session: AsyncSession = Depends(get_session),
+):
+    """Return current pending-restore state, or null if none."""
+    path_row = await session.get(AppSetting, PENDING_RESTORE_PATH_KEY)
+    if not path_row or not path_row.value:
+        return {"pending": False, "supervised": _is_supervised()}
+
+    conflict_row = await session.get(AppSetting, PENDING_RESTORE_CONFLICT_KEY)
+    uploaded_at_row = await session.get(AppSetting, PENDING_RESTORE_UPLOADED_AT_KEY)
+    uploaded_by_row = await session.get(AppSetting, PENDING_RESTORE_UPLOADED_BY_KEY)
+    return {
+        "pending": True,
+        "uploaded_at": uploaded_at_row.value if uploaded_at_row else None,
+        "uploaded_by": uploaded_by_row.value if uploaded_by_row else None,
+        "conflict_mode": (conflict_row.value if conflict_row else ConflictMode.SKIP.value),
+        "supervised": _is_supervised(),
+    }
+
+
+@router.delete("/pending-restore")
+async def cancel_pending_restore(
+    user: User = Depends(require_admin),
+    session: AsyncSession = Depends(get_session),
+):
+    """Cancel a pending restore."""
+    pending_path = _pending_restore_path()
+    if pending_path.exists():
+        pending_path.unlink()
+    await _clear_pending_restore_markers(session)
+    await session.commit()
+    return {"cancelled": True}
+
+
+def _is_supervised() -> bool:
+    """Heuristic: is this process managed by something that will respawn it?
+
+    Priority order:
+    1. Explicit operator override: ``NOTIFY_BRIDGE_SUPERVISED`` env var or
+       the ``supervised`` AppSetting (values: ``true``/``false``/``auto``).
+       ``auto`` (or unset) falls through to the detection heuristic.
+    2. Heuristic: look at common container/service-manager env vars.
+
+    Used by the frontend to decide whether to offer "Restart now" — a bad
+    guess here is a foot-gun (process exits, stays dead), so err on the side
+    of false when unsure.
+    """
+    override = os.environ.get("NOTIFY_BRIDGE_SUPERVISED", "").strip().lower()
+    if override in ("true", "1", "yes", "on"):
+        return True
+    if override in ("false", "0", "no", "off"):
+        return False
+
+    for var in ("CONTAINER", "DOCKER_CONTAINER", "KUBERNETES_SERVICE_HOST",
+                "INVOCATION_ID", "PM2_HOME"):
+        if os.environ.get(var):
+            return True
+    if os.path.exists("/.dockerenv"):
+        return True
+    return False
+
+
+@router.post("/apply-restart")
+async def apply_and_restart(
+    background_tasks: BackgroundTasks,
+    user: User = Depends(require_admin),
+    session: AsyncSession = Depends(get_session),
+):
+    """Trigger a graceful exit so the supervisor respawns and applies the pending restore.
+
+    Only allowed when a pending restore is staged AND the process is supervised.
+    """
+    path_row = await session.get(AppSetting, PENDING_RESTORE_PATH_KEY)
+    if not path_row or not path_row.value:
+        raise HTTPException(status_code=409, detail="No pending restore to apply")
+    if not _is_supervised():
+        raise HTTPException(
+            status_code=409,
+            detail=(
+                "This process is not supervised. Restart the backend manually to apply "
+                "the pending restore, or use the Cancel button."
+            ),
+        )
+
+    async def _shutdown_soon() -> None:
+        # Small delay so the HTTP response flushes before the signal fires.
+        await asyncio.sleep(0.5)
+        _LOGGER.warning("Admin triggered restart to apply pending restore")
+        # SIGTERM lets uvicorn run its normal graceful shutdown:
+        # drain in-flight requests, fire the lifespan shutdown hooks
+        # (close_http_session, scheduler.shutdown), then exit. The
+        # supervisor respawns, and startup applies the pending restore.
+        try:
+            os.kill(os.getpid(), signal.SIGTERM)
+        except Exception:  # noqa: BLE001 — last-resort fallback on platforms that reject SIGTERM
+            _LOGGER.exception("SIGTERM delivery failed; falling back to os._exit")
+            os._exit(0)
+
+    background_tasks.add_task(_shutdown_soon)
+    return {"restart_requested": True}
+
+
 # ---------------------------------------------------------------------------
 # Scheduled backup settings
 # ---------------------------------------------------------------------------
@@ -205,6 +404,37 @@ async def get_backup_files(
     return list_backup_files(_backup_dir())
 
 
+@router.post("/files")
+async def create_manual_backup(
+    secrets_mode: SecretsMode = Query(default=SecretsMode.EXCLUDE),
+    user: User = Depends(require_admin),
+    session: AsyncSession = Depends(get_session),
+):
+    """Create a backup file in the backups directory (manual checkpoint).
+
+    Produces the same JSON format as scheduled backups, saved under
+    ``data/backups/backup-<timestamp>.json``. Retention is managed by the
+    existing scheduled-backup settings (``backup_retention_count``).
+    """
+    backup_dir = _backup_dir()
+    filepath = await export_backup_to_file(session, user.id, backup_dir, secrets_mode)
+    # Apply the same retention as scheduled backups if configured.
+    retention_row = await session.get(AppSetting, "backup_retention_count")
+    if retention_row and retention_row.value:
+        try:
+            retention = int(retention_row.value)
+            if retention > 0:
+                cleanup_old_backups(backup_dir, keep=retention)
+        except ValueError:
+            pass
+    stat = filepath.stat()
+    return {
+        "filename": filepath.name,
+        "size": stat.st_size,
+        "created_at": datetime.fromtimestamp(stat.st_mtime, tz=timezone.utc).isoformat(),
+    }
+
+
 @router.get("/files/{filename}")
 async def download_backup_file(
     filename: str,

packages/server/src/notify_bridge_server/api/command_trackers.py

@@ -42,6 +42,11 @@ class CommandTrackerUpdate(BaseModel):
 class ListenerCreate(BaseModel):
     listener_type: str
     listener_id: int
+    allowed_album_ids: list[str] | None = None
+
+
+class ListenerUpdate(BaseModel):
+    allowed_album_ids: list[str] | None = None
 
 
 # --- Command Tracker CRUD ---
@@ -299,6 +304,7 @@ async def add_listener(
         command_tracker_id=tracker_id,
         listener_type=body.listener_type,
         listener_id=body.listener_id,
+        allowed_album_ids=body.allowed_album_ids,
     )
     session.add(listener)
     await session.commit()
@@ -316,6 +322,30 @@ async def add_listener(
     return await _listener_response(session, listener)
 
 
+@router.patch("/{tracker_id}/listeners/{listener_id}")
+async def update_listener(
+    tracker_id: int,
+    listener_id: int,
+    body: ListenerUpdate,
+    user: User = Depends(get_current_user),
+    session: AsyncSession = Depends(get_session),
+):
+    """Update a listener's per-chat settings (currently just allowed_album_ids)."""
+    await _get_user_tracker(session, tracker_id, user.id)
+    listener = await session.get(CommandTrackerListener, listener_id)
+    if not listener or listener.command_tracker_id != tracker_id:
+        raise HTTPException(status_code=404, detail="Listener not found")
+    # Empty list means "no albums" which is rarely useful; treat as null (inherit).
+    if body.allowed_album_ids is not None and len(body.allowed_album_ids) == 0:
+        listener.allowed_album_ids = None
+    else:
+        listener.allowed_album_ids = body.allowed_album_ids
+    session.add(listener)
+    await session.commit()
+    await session.refresh(listener)
+    return await _listener_response(session, listener)
+
+
 @router.delete("/{tracker_id}/listeners/{listener_id}", status_code=status.HTTP_204_NO_CONTENT)
 async def remove_listener(
     tracker_id: int,
@@ -394,6 +424,7 @@ async def _listener_response(session: AsyncSession, l: CommandTrackerListener) -
         "command_tracker_id": l.command_tracker_id,
         "listener_type": l.listener_type,
         "listener_id": l.listener_id,
+        "allowed_album_ids": l.allowed_album_ids,
         "name": name,
         "created_at": l.created_at.isoformat(),
     }

packages/server/src/notify_bridge_server/api/delete_protection.py

@@ -19,10 +19,22 @@ from ..database.models import (
 
 
 def raise_if_used(consumers: list[str], entity_name: str) -> None:
-    """Raise 409 Conflict if the entity has consumers."""
+    """Raise 409 Conflict if the entity has consumers.
+
+    Produces a human-readable summary string (kept as the primary ``detail``)
+    plus a structured ``blocked_by`` list so the frontend can render a
+    clickable warning modal.
+    """
     if consumers:
-        detail = f"Cannot delete {entity_name}: used by {len(consumers)} consumer(s). " + "; ".join(consumers)
-        raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail=detail)
+        summary = f"Cannot delete {entity_name}: used by {len(consumers)} consumer(s)."
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail={
+                "message": summary,
+                "entity": entity_name,
+                "blocked_by": consumers,
+            },
+        )
 
 
 async def check_service_provider(session: AsyncSession, provider_id: int) -> list[str]:

packages/server/src/notify_bridge_server/api/status.py

@@ -3,12 +3,14 @@
 from datetime import datetime, timedelta, timezone
 
 from fastapi import APIRouter, Depends, Query
+from sqlalchemy import delete as sa_delete
 from sqlmodel import func, select
 from sqlmodel.ext.asyncio.session import AsyncSession
 
 from ..auth.dependencies import get_current_user
 from ..database.engine import get_session
 from ..database.models import (
+    Action,
     CommandConfig,
     CommandTemplateConfig,
     CommandTracker,
@@ -54,12 +56,10 @@ async def get_status(
         select(func.count()).select_from(NotificationTarget).where(NotificationTarget.user_id == user.id)
     )).one()
 
-    # Build events query with filters
-    events_query = (
-        select(EventLog)
-        .join(NotificationTracker, EventLog.tracker_id == NotificationTracker.id)
-        .where(NotificationTracker.user_id == user.id)
-    )
+    # Build events query with filters.  EventLog.user_id is the owner column;
+    # action events (event_type starts with "action_") have tracker_id NULL but
+    # user_id set, so we filter by user_id directly.
+    events_query = select(EventLog).where(EventLog.user_id == user.id)
 
     if event_type:
         events_query = events_query.where(EventLog.event_type == event_type)
@@ -69,6 +69,7 @@ async def get_status(
         events_query = events_query.where(
             EventLog.collection_name.contains(search)
             | EventLog.tracker_name.contains(search)
+            | EventLog.action_name.contains(search)
             | EventLog.provider_name.contains(search)
         )
 
@@ -84,6 +85,65 @@ async def get_status(
 
     events_query = events_query.offset(offset).limit(limit)
     recent_events = await session.exec(events_query)
+    event_rows = recent_events.all()
+
+    # Resolve live tracker names from FK (fall back to stored snapshot when deleted)
+    tracker_ids = {e.tracker_id for e in event_rows if e.tracker_id is not None}
+    tracker_name_map: dict[int, str] = {}
+    if tracker_ids:
+        tracker_rows = (await session.exec(
+            select(NotificationTracker.id, NotificationTracker.name).where(
+                NotificationTracker.id.in_(tracker_ids)
+            )
+        )).all()
+        tracker_name_map = {tid: tname for tid, tname in tracker_rows}
+
+    # Resolve live provider names similarly
+    provider_ids = {e.provider_id for e in event_rows if e.provider_id is not None}
+    provider_name_map: dict[int, str] = {}
+    if provider_ids:
+        provider_rows = (await session.exec(
+            select(ServiceProvider.id, ServiceProvider.name).where(
+                ServiceProvider.id.in_(provider_ids)
+            )
+        )).all()
+        provider_name_map = {pid: pname for pid, pname in provider_rows}
+
+    # Resolve live action names so renames are reflected; fall back to snapshot.
+    action_ids = {e.action_id for e in event_rows if e.action_id is not None}
+    action_name_map: dict[int, str] = {}
+    if action_ids:
+        action_rows = (await session.exec(
+            select(Action.id, Action.name).where(Action.id.in_(action_ids))
+        )).all()
+        action_name_map = {aid: aname for aid, aname in action_rows}
+
+    def _display_tracker_name(e: EventLog) -> str:
+        if e.tracker_id is not None and e.tracker_id in tracker_name_map:
+            return tracker_name_map[e.tracker_id]
+        return f"(deleted) {e.tracker_name}" if e.tracker_name else "(deleted)"
+
+    def _display_provider_name(e: EventLog) -> str:
+        if e.provider_id is not None and e.provider_id in provider_name_map:
+            return provider_name_map[e.provider_id]
+        return e.provider_name or ""
+
+    def _display_action_name(e: EventLog) -> str:
+        if e.action_id is not None and e.action_id in action_name_map:
+            return action_name_map[e.action_id]
+        if e.action_name:
+            return f"(deleted) {e.action_name}"
+        return ""
+
+    def _display_subject(e: EventLog) -> str:
+        """The primary label shown on the event row.
+
+        For action events the ``collection_name`` stores the action name;
+        use the live-resolved action name when available so renames show.
+        """
+        if e.action_id is not None or (e.event_type or "").startswith("action_"):
+            return _display_action_name(e) or e.collection_name
+        return e.collection_name
 
     return {
         "providers": providers_count,
@@ -94,19 +154,43 @@ async def get_status(
             {
                 "id": e.id,
                 "event_type": e.event_type,
-                "collection_name": e.collection_name,
-                "tracker_name": e.tracker_name or "",
-                "provider_name": e.provider_name or "",
+                "collection_name": _display_subject(e),
+                "tracker_name": _display_tracker_name(e),
+                "action_id": e.action_id,
+                "action_name": _display_action_name(e),
+                "provider_name": _display_provider_name(e),
                 "provider_id": e.provider_id,
                 "assets_count": e.assets_count or 0,
                 "created_at": e.created_at.isoformat() + ("Z" if not e.created_at.tzinfo else ""),
                 "details": e.details or {},
             }
-            for e in recent_events.all()
+            for e in event_rows
         ],
     }
 
 
+@router.delete("/events")
+async def clear_events(
+    user: User = Depends(get_current_user),
+    session: AsyncSession = Depends(get_session),
+    older_than_days: int | None = Query(None, ge=0),
+):
+    """Delete all event log entries for the current user.
+
+    Optionally keep events newer than `older_than_days` days.
+    """
+    stmt = sa_delete(EventLog).where(EventLog.user_id == user.id)
+    if older_than_days is not None:
+        cutoff = datetime.now(timezone.utc) - timedelta(days=older_than_days)
+        stmt = stmt.where(EventLog.created_at < cutoff)
+
+    # Use session.execute() for DELETE (consistent with other endpoints and
+    # avoids sqlmodel wrapping a CursorResult that may drop rowcount).
+    result = await session.execute(stmt)
+    await session.commit()
+    return {"deleted": result.rowcount or 0}
+
+
 @router.get("/counts")
 async def get_nav_counts(
     user: User = Depends(get_current_user),
@@ -192,8 +276,7 @@ async def get_event_chart(
             EventLog.event_type,
             func.count().label("total"),
         )
-        .join(NotificationTracker, EventLog.tracker_id == NotificationTracker.id)
-        .where(NotificationTracker.user_id == user.id, EventLog.created_at >= cutoff)
+        .where(EventLog.user_id == user.id, EventLog.created_at >= cutoff)
     )
 
     if event_type:
@@ -204,6 +287,7 @@ async def get_event_chart(
         query = query.where(
             EventLog.collection_name.contains(search)
             | EventLog.tracker_name.contains(search)
+            | EventLog.action_name.contains(search)
             | EventLog.provider_name.contains(search)
         )
 

packages/server/src/notify_bridge_server/api/template_configs.py

@@ -162,8 +162,9 @@ async def get_template_variables(
         "city": "City name",
         "state": "State/region name",
         "country": "Country name",
-        "file_size": "File size in bytes (null if unknown)",
-        "oversized": "Whether video exceeds the target's size limit (boolean, videos only)",
+        "file_size": "Original asset size in bytes (null if unknown)",
+        "playback_size": "Size in bytes of the media we actually upload — for Immich videos this is the transcoded /video/playback (null for photos or when unknown)",
+        "oversized": "Whether the asset's playback_size exceeds the target's size limit (boolean, videos only)",
         "public_url": "Per-asset public share URL (empty if no album link)",
         "url": "Public viewer URL (if shared)",
         "download_url": "Direct download URL (if shared)",

packages/server/src/notify_bridge_server/api/users.py

@@ -69,6 +69,45 @@ async def create_user(
     return {"id": user.id, "username": user.username, "role": user.role}
 
 
+@router.patch("/{user_id}")
+async def update_user(
+    user_id: int,
+    body: UserUpdate,
+    admin: User = Depends(require_admin),
+    session: AsyncSession = Depends(get_session),
+):
+    """Update username and/or role for a user (admin only)."""
+    user = await session.get(User, user_id)
+    if not user:
+        raise HTTPException(status_code=404, detail="User not found")
+
+    if body.username is not None and body.username != user.username:
+        new_username = body.username.strip()
+        if not new_username:
+            raise HTTPException(status_code=400, detail="Username cannot be empty")
+        dup = await session.exec(select(User).where(User.username == new_username))
+        if dup.first():
+            raise HTTPException(status_code=409, detail="Username already exists")
+        user.username = new_username
+
+    if body.role is not None and body.role != user.role:
+        if body.role not in ("admin", "user"):
+            raise HTTPException(status_code=400, detail="Invalid role")
+        # Prevent demoting the last admin
+        if user.role == "admin" and body.role != "admin":
+            admins = (await session.exec(
+                select(User).where(User.role == "admin")
+            )).all()
+            if len(admins) <= 1:
+                raise HTTPException(status_code=400, detail="Cannot demote the last admin")
+        user.role = body.role
+
+    session.add(user)
+    await session.commit()
+    await session.refresh(user)
+    return {"id": user.id, "username": user.username, "role": user.role}
+
+
 class ResetPasswordRequest(BaseModel):
     new_password: str
 

packages/server/src/notify_bridge_server/api/webhooks.py

@@ -147,6 +147,7 @@ async def _dispatch_webhook_event(
             # Log event
             extra_details = {k: v for k, v in event.extra.items() if k in detail_keys}
             session.add(EventLog(
+                user_id=tracker.user_id,
                 tracker_id=tracker.id,
                 tracker_name=tracker.name,
                 provider_id=provider_id,

packages/server/src/notify_bridge_server/commands/base.py

@@ -6,7 +6,10 @@ from abc import ABC, abstractmethod
 from dataclasses import dataclass, field
 from typing import Any
 
-from ..database.models import CommandConfig, CommandTracker, ServiceProvider, TelegramBot
+from ..database.models import (
+    CommandConfig, CommandTracker, CommandTrackerListener,
+    ServiceProvider, TelegramBot,
+)
 
 
 @dataclass(frozen=True)
@@ -51,6 +54,9 @@ class ProviderCommandHandler(ABC):
         bot: TelegramBot,
         tracker: CommandTracker,
         config: CommandConfig,
+        *,
+        listener: CommandTrackerListener | None = None,
+        page: int = 1,
     ) -> CommandResponse | None:
         """Handle a provider-specific command for a single tracker.
 

packages/server/src/notify_bridge_server/commands/gitea_handler.py

@@ -77,6 +77,9 @@ class GiteaCommandHandler(ProviderCommandHandler):
         bot: TelegramBot,
         tracker: CommandTracker,
         config: CommandConfig,
+        *,
+        listener: Any = None,
+        page: int = 1,
     ) -> CommandResponse | None:
         fn = _TEXT_COMMANDS.get(cmd)
         if fn is None:

packages/server/src/notify_bridge_server/commands/handler.py

@@ -95,7 +95,7 @@ def _render_cmd_template(
 async def _resolve_command_context(
     bot: TelegramBot,
 ) -> tuple[
-    list[tuple[CommandTracker, CommandConfig, ServiceProvider]],
+    list[tuple[CommandTracker, CommandConfig, ServiceProvider, CommandTrackerListener]],
     dict[int, dict[str, dict[str, str]]],
 ]:
     """Resolve all enabled command trackers, configs, and providers for a bot.
@@ -148,7 +148,7 @@ async def _resolve_command_context(
         else:
             providers_by_id = {}
 
-        tuples: list[tuple[CommandTracker, CommandConfig, ServiceProvider]] = []
+        tuples: list[tuple[CommandTracker, CommandConfig, ServiceProvider, CommandTrackerListener]] = []
         for listener in listeners:
             tracker = trackers_by_id.get(listener.command_tracker_id)
             if not tracker or not tracker.enabled:
@@ -159,12 +159,12 @@ async def _resolve_command_context(
             provider = providers_by_id.get(tracker.provider_id)
             if not provider:
                 continue
-            tuples.append((tracker, config, provider))
+            tuples.append((tracker, config, provider, listener))
 
         # Load command template slots per config (not merged)
         templates_by_config_id: dict[int, dict[str, dict[str, str]]] = {}
         seen_config_ids: set[int] = set()
-        for _, config, _ in tuples:
+        for _, config, _, _ in tuples:
             cfg_id = config.command_template_config_id
             if cfg_id and cfg_id not in seen_config_ids:
                 seen_config_ids.add(cfg_id)
@@ -204,7 +204,7 @@ def _merge_all_templates(
 
 
 def _merge_enabled_commands(
-    ctx: list[tuple[CommandTracker, CommandConfig, ServiceProvider]],
+    ctx: list[tuple[CommandTracker, CommandConfig, ServiceProvider, CommandTrackerListener]],
 ) -> tuple[list[str], dict[str, Any]]:
     """Merge enabled_commands (union) and rate_limits from all configs.
 
@@ -215,7 +215,7 @@ def _merge_enabled_commands(
 
     enabled: set[str] = set()
     merged_limits: dict[str, int] = {}
-    for _, config, _ in ctx:
+    for _, config, _, _ in ctx:
         enabled.update(config.enabled_commands or [])
         for category, cooldown in (config.rate_limits or {}).items():
             if category not in merged_limits:
@@ -278,8 +278,16 @@ async def handle_command(
     # Provider-specific dispatch — per-tracker
     from .dispatch import get_handler
 
+    # For paginated commands (/search, /find) a trailing integer means page,
+    # not count. Preserve count_override meaning for all other commands.
+    paginated_cmds = {"search", "find"}
+    page = 1
+    if cmd in paginated_cmds and count_override:
+        page = max(1, count_override)
+        count_override = None
+
     responses: list[CommandResponse] = []
-    for tracker, config, provider in ctx_tuples:
+    for tracker, config, provider, listener in ctx_tuples:
         if len(responses) >= _MAX_RESPONSES_PER_COMMAND:
             _LOGGER.warning(
                 "Truncated command responses at %d for bot %d cmd /%s",
@@ -298,6 +306,7 @@ async def handle_command(
         result = await handler.handle(
             cmd, args, count, locale, response_mode,
             provider, tracker_templates, bot, tracker, config,
+            listener=listener, page=page,
         )
         if result is not None:
             responses.append(result)

packages/server/src/notify_bridge_server/commands/immich/handler.py

@@ -6,7 +6,7 @@ import logging
 from typing import Any
 
 from ...database.models import (
-    CommandConfig, CommandTracker,
+    CommandConfig, CommandTracker, CommandTrackerListener,
     ServiceProvider, TelegramBot,
 )
 from ...services import make_immich_provider
@@ -78,6 +78,9 @@ class ImmichCommandHandler(ProviderCommandHandler):
         bot: TelegramBot,
         tracker: CommandTracker,
         config: CommandConfig,
+        *,
+        listener: CommandTrackerListener | None = None,
+        page: int = 1,
     ) -> CommandResponse | None:
         if cmd == "status":
             ctx = await _cmd_status(provider, locale)
@@ -96,6 +99,7 @@ class ImmichCommandHandler(ProviderCommandHandler):
             return await _cmd_immich(
                 cmd, args, count, locale, response_mode,
                 provider, cmd_templates,
+                listener=listener, page=page,
             )
         return None
 
@@ -104,13 +108,25 @@ async def _cmd_immich(
     cmd: str, args: str, count: int, locale: str,
     response_mode: str, provider: ServiceProvider,
     cmd_templates: dict[str, dict[str, str]],
+    *,
+    listener: CommandTrackerListener | None = None,
+    page: int = 1,
 ) -> CommandResponse | None:
     """Handle commands that need Immich API access and may return media."""
     notification_trackers = await get_trackers_for_provider(provider.id)
 
     all_album_ids: list[str] = []
+    seen: set[str] = set()
     for t in notification_trackers:
-        all_album_ids.extend(t.collection_ids or [])
+        for aid in (t.collection_ids or []):
+            if aid not in seen:
+                seen.add(aid)
+                all_album_ids.append(aid)
+
+    # Per-chat album scope: intersect with listener.allowed_album_ids when set.
+    if listener is not None and listener.allowed_album_ids is not None:
+        allowed = set(listener.allowed_album_ids)
+        all_album_ids = [aid for aid in all_album_ids if aid in allowed]
 
     ext_domain = (provider.config.get("external_domain") or provider.config.get("url", "")).rstrip("/")
 
@@ -135,9 +151,9 @@ async def _cmd_immich(
     result: str | dict[str, Any] | None = None
 
     if cmd == "search":
-        result = await cmd_search(client, args, all_album_ids, count, locale, response_mode, cmd_templates, asset_public_urls=asset_public_urls)
+        result = await cmd_search(client, args, all_album_ids, count, locale, response_mode, cmd_templates, asset_public_urls=asset_public_urls, page=page)
     elif cmd == "find":
-        result = await cmd_find(client, args, all_album_ids, count, locale, response_mode, cmd_templates, asset_public_urls=asset_public_urls)
+        result = await cmd_find(client, args, all_album_ids, count, locale, response_mode, cmd_templates, asset_public_urls=asset_public_urls, page=page)
     elif cmd == "person":
         result = await cmd_person(client, args, count, locale, response_mode, cmd_templates, asset_public_urls=asset_public_urls)
     elif cmd == "place":

packages/server/src/notify_bridge_server/commands/immich/search.py

@@ -25,11 +25,12 @@ async def cmd_search(
     locale: str, response_mode: str,
     cmd_templates: dict[str, dict[str, str]],
     asset_public_urls: dict[str, str] | None = None,
+    page: int = 1,
 ) -> str | dict[str, Any]:
     """Handle /search command."""
     if not args:
         return _render_cmd_template(cmd_templates, "no_results", locale, {"command": "search", "query": ""})
-    assets = await client.search_smart(args, album_ids=all_album_ids, limit=count)
+    assets = await client.search_smart(args, album_ids=all_album_ids, limit=count, page=page)
     _enrich_assets(assets, asset_public_urls or {})
     return _format_assets(assets, "search", args, locale, response_mode, client, cmd_templates)
 
@@ -39,11 +40,12 @@ async def cmd_find(
     locale: str, response_mode: str,
     cmd_templates: dict[str, dict[str, str]],
     asset_public_urls: dict[str, str] | None = None,
+    page: int = 1,
 ) -> str | dict[str, Any]:
     """Handle /find command."""
     if not args:
         return _render_cmd_template(cmd_templates, "no_results", locale, {"command": "find", "query": ""})
-    assets = await client.search_metadata(args, album_ids=all_album_ids, limit=count)
+    assets = await client.search_metadata(args, album_ids=all_album_ids, limit=count, page=page)
     _enrich_assets(assets, asset_public_urls or {})
     return _format_assets(assets, "find", args, locale, response_mode, client, cmd_templates)
 

packages/server/src/notify_bridge_server/commands/nut_handler.py

@@ -52,6 +52,9 @@ class NutCommandHandler(ProviderCommandHandler):
         bot: TelegramBot,
         tracker: CommandTracker,
         config: CommandConfig,
+        *,
+        listener: Any = None,
+        page: int = 1,
     ) -> CommandResponse | None:
         fn = _TEXT_COMMANDS.get(cmd)
         if fn is None:

packages/server/src/notify_bridge_server/commands/planka_handler.py

@@ -69,6 +69,9 @@ class PlankaCommandHandler(ProviderCommandHandler):
         bot: TelegramBot,
         tracker: CommandTracker,
         config: CommandConfig,
+        *,
+        listener: Any = None,
+        page: int = 1,
     ) -> CommandResponse | None:
         fn = _TEXT_COMMANDS.get(cmd)
         if fn is None:

packages/server/src/notify_bridge_server/database/migrations.py

@@ -84,11 +84,26 @@ async def migrate_schema(engine: AsyncEngine) -> None:
                 ("provider_id", "ALTER TABLE event_log ADD COLUMN provider_id INTEGER"),
                 ("provider_name", "ALTER TABLE event_log ADD COLUMN provider_name TEXT DEFAULT ''"),
                 ("assets_count", "ALTER TABLE event_log ADD COLUMN assets_count INTEGER DEFAULT 0"),
+                ("user_id", "ALTER TABLE event_log ADD COLUMN user_id INTEGER"),
+                ("action_id", "ALTER TABLE event_log ADD COLUMN action_id INTEGER"),
+                ("action_name", "ALTER TABLE event_log ADD COLUMN action_name TEXT DEFAULT ''"),
             ]:
                 if not await _has_column(conn, "event_log", col):
                     await conn.execute(text(sql))
                     logger.info("Added %s column to event_log table", col)
 
+            # Backfill user_id from notification_tracker for legacy rows.
+            # Safe to run repeatedly: only touches rows where user_id is still NULL.
+            await conn.execute(text("""
+                UPDATE event_log
+                SET user_id = (
+                    SELECT user_id FROM notification_tracker
+                    WHERE notification_tracker.id = event_log.notification_tracker_id
+                )
+                WHERE event_log.user_id IS NULL
+                  AND event_log.notification_tracker_id IS NOT NULL
+            """))
+
         # Add commands_config to telegram_bot if missing
         if await _has_table(conn, "telegram_bot"):
             if not await _has_column(conn, "telegram_bot", "commands_config"):
@@ -129,6 +144,14 @@ async def migrate_schema(engine: AsyncEngine) -> None:
                 )
                 logger.info("Added command_template_config_id column to command_config table")
 
+        # Add allowed_album_ids (per-chat album scope) to command_tracker_listener
+        if await _has_table(conn, "command_tracker_listener"):
+            if not await _has_column(conn, "command_tracker_listener", "allowed_album_ids"):
+                await conn.execute(
+                    text("ALTER TABLE command_tracker_listener ADD COLUMN allowed_album_ids TEXT")
+                )
+                logger.info("Added allowed_album_ids column to command_tracker_listener table")
+
         # Add date_only_format to template_config if missing
         if await _has_table(conn, "template_config"):
             if not await _has_column(conn, "template_config", "date_only_format"):

packages/server/src/notify_bridge_server/database/models.py

@@ -467,6 +467,11 @@ class CommandTrackerListener(SQLModel, table=True):
     )
     listener_type: str  # e.g. "telegram_bot"
     listener_id: int
+    # Optional per-chat album scope. None = inherit from tracker (use all).
+    # When set, only these album/collection ids are queryable from this chat.
+    allowed_album_ids: list[str] | None = Field(
+        default=None, sa_column=Column(JSON, nullable=True),
+    )
     created_at: datetime = Field(default_factory=_utcnow)
 
 
@@ -476,6 +481,10 @@ class EventLog(SQLModel, table=True):
     __tablename__ = "event_log"
 
     id: int | None = Field(default=None, primary_key=True)
+    # Owner. Indexed for the dashboard events query.  Nullable only because
+    # historical rows (pre-user_id column) may have no owner; new rows always
+    # set this directly.
+    user_id: int | None = Field(default=None, foreign_key="user.id", index=True)
     # Python attr stays as tracker_id for backward compat; DB column is notification_tracker_id
     tracker_id: int | None = Field(
         default=None,
@@ -484,6 +493,13 @@ class EventLog(SQLModel, table=True):
         sa_column_kwargs={"name": "notification_tracker_id"},
     )
     tracker_name: str = Field(default="")
+    # Links an event back to an Action when the event was emitted by the
+    # action runner (``event_type`` starts with ``action_``).  Null for
+    # notification-tracker events.
+    action_id: int | None = Field(
+        default=None, foreign_key="action.id", index=True,
+    )
+    action_name: str = Field(default="")
     provider_id: int | None = Field(default=None, index=True)
     provider_name: str = Field(default="")
     event_type: str = Field(index=True)

packages/server/src/notify_bridge_server/database/seeds.py

@@ -110,6 +110,10 @@ async def _seed_provider_command_template(
         await session.flush()
     else:
         config = configs[0]
+        if config.name != name or config.description != description:
+            config.name = name
+            config.description = description
+            session.add(config)
 
     for locale in ("en", "ru"):
         slots = load_default_command_templates(locale, provider_type=provider_type)
@@ -166,7 +170,7 @@ async def _seed_default_command_templates() -> None:
     engine = get_engine()
     async with AsyncSession(engine) as session:
         await _seed_provider_command_template(
-            session, "immich", "Default Commands", "Default Immich command templates",
+            session, "immich", "Default Immich Commands", "Default Immich command templates",
         )
         await _seed_provider_command_template(
             session, "gitea", "Default Gitea Commands", "Default Gitea command templates",
@@ -242,7 +246,7 @@ async def _seed_default_tracking_configs() -> None:
                 "provider_type": "immich",
                 "name": "Default Immich",
                 "track_assets_added": True,
-                "track_assets_removed": True,
+                "track_assets_removed": False,
                 "track_collection_renamed": True,
                 "track_collection_deleted": True,
                 "track_sharing_changed": False,
@@ -251,7 +255,7 @@ async def _seed_default_tracking_configs() -> None:
                 "provider_type": "google_photos",
                 "name": "Default Google Photos",
                 "track_assets_added": True,
-                "track_assets_removed": True,
+                "track_assets_removed": False,
                 "track_collection_renamed": True,
                 "track_collection_deleted": True,
                 "track_sharing_changed": False,

packages/server/src/notify_bridge_server/main.py

@@ -66,6 +66,9 @@ async def lifespan(app: FastAPI):
     await migrate_user_token_version(engine)
     from .database.seeds import seed_all
     await seed_all()
+    # Apply any pending restore staged via /api/backup/prepare-restore
+    from .services.pending_restore import apply_pending_restore_if_any
+    await apply_pending_restore_if_any()
     # Configure webhook secret from DB setting (falls back to env var)
     from sqlmodel.ext.asyncio.session import AsyncSession as _AS
     from .api.app_settings import get_setting as _get_setting

packages/server/src/notify_bridge_server/services/action_runner.py

@@ -16,6 +16,7 @@ from ..database.models import (
     Action,
     ActionExecution,
     ActionRule,
+    EventLog,
     ServiceProvider,
 )
 
@@ -115,13 +116,42 @@ async def run_action(
             execution.error = action_result.error or ""
             session.add(execution)
 
-        # Update action last_run metadata (skip for dry runs)
+        # Update action last_run metadata + emit a dashboard EventLog row
+        # (skip both for dry runs — dashboards should not count previews).
         if not is_dry_run:
             action = await session.get(Action, action_id)
             if action:
                 action.last_run_at = datetime.now(timezone.utc)
                 action.last_run_status = execution.status if execution else ""
                 session.add(action)
+                provider = await session.get(ServiceProvider, action.provider_id)
+                status_str = execution.status if execution else "success"
+                event_type = f"action_{status_str}"  # action_success|partial|failed
+                session.add(EventLog(
+                    user_id=action.user_id,
+                    tracker_id=None,
+                    tracker_name="",
+                    action_id=action.id,
+                    action_name=action.name,
+                    provider_id=provider.id if provider else None,
+                    provider_name=(provider.name if provider else "") or "",
+                    event_type=event_type,
+                    collection_id=str(action.id),
+                    # ``collection_name`` is what the dashboard row shows as the
+                    # event subject; use the action name so the row is readable
+                    # without a separate action_name renderer.
+                    collection_name=action.name,
+                    assets_count=action_result.total_items_affected,
+                    details={
+                        "action_type": action.action_type,
+                        "trigger": trigger,
+                        "rules_processed": action_result.rules_processed,
+                        "rules_succeeded": action_result.rules_succeeded,
+                        "rules_failed": action_result.rules_failed,
+                        "error": action_result.error or "",
+                        "execution_id": execution_id,
+                    },
+                ))
 
         await session.commit()
 

packages/server/src/notify_bridge_server/services/notifier.py

@@ -298,13 +298,82 @@ async def send_to_receiver(target: NotificationTarget, receiver_config: dict, me
 
 
 async def send_test_notification(target: NotificationTarget, locale: str = "en") -> dict:
-    """Send a simple test message. For broadcast targets, fans out to all children."""
+    """Send a simple test message. For broadcast targets, fans out to all children.
+
+    For Telegram targets, per-receiver locale (TargetReceiver.locale or
+    TelegramChat.language_override/language_code) is resolved individually so
+    each chat receives the message in its own configured language.
+    """
     if target.type == "broadcast":
         return await _send_broadcast_test(target, locale)
+    if target.type == "telegram":
+        return await _send_telegram_test_per_receiver(target, default_locale=locale)
     message = _get_test_message(locale, target.type)
     return await send_to_target(target, message)
 
 
+async def _send_telegram_test_per_receiver(
+    target: NotificationTarget, default_locale: str = "en",
+) -> dict:
+    """Send a test message to each Telegram receiver in its own resolved locale."""
+    from notify_bridge_core.notifications.telegram.client import TelegramClient
+
+    from ..database.models import TargetReceiver, TelegramChat
+    from .http_session import get_http_session
+
+    bot_token = target.config.get("bot_token")
+    bot_id = target.config.get("bot_id")
+    disable_preview = target.config.get("disable_url_preview", False)
+    if not bot_token:
+        return {"success": False, "error": "Missing bot_token"}
+
+    engine = get_engine()
+    async with AsyncSession(engine) as session:
+        recv_rows = (await session.exec(
+            select(TargetReceiver).where(
+                TargetReceiver.target_id == target.id,
+                TargetReceiver.enabled == True,
+            )
+        )).all()
+        if not recv_rows:
+            return {"success": False, "error": "No receivers configured"}
+
+        # Resolve per-receiver locale
+        chat_ids = [str(r.config.get("chat_id", "")) for r in recv_rows if r.config.get("chat_id")]
+        chat_locale_map: dict[str, str] = {}
+        if bot_id and chat_ids:
+            chat_rows = (await session.exec(
+                select(TelegramChat).where(
+                    TelegramChat.bot_id == bot_id,
+                    TelegramChat.chat_id.in_(chat_ids),
+                )
+            )).all()
+            for chat in chat_rows:
+                override = (
+                    getattr(chat, "language_override", "") or
+                    getattr(chat, "language_code", "") or ""
+                )
+                if override:
+                    chat_locale_map[chat.chat_id] = override[:2].lower()
+
+    http = await get_http_session()
+    client = TelegramClient(http, bot_token)
+    results: list[dict] = []
+    for r in recv_rows:
+        chat_id = str(r.config.get("chat_id", ""))
+        if not chat_id:
+            continue
+        explicit = getattr(r, "locale", "") or ""
+        locale = explicit or chat_locale_map.get(chat_id) or default_locale
+        message = _get_test_message(locale[:2].lower(), "telegram")
+        results.append(await client.send_message(
+            chat_id=chat_id,
+            text=message,
+            disable_web_page_preview=bool(disable_preview),
+        ))
+    return _aggregate(results)
+
+
 async def _send_broadcast_test(target: NotificationTarget, locale: str) -> dict:
     """Send test notifications to all child targets of a broadcast target."""
     child_ids = target.config.get("child_target_ids", [])

packages/server/src/notify_bridge_server/services/pending_restore.py

@@ -0,0 +1,162 @@
+"""Startup hook that applies a pending restore prepared via the backup API.
+
+When an admin uploads a backup via /api/backup/prepare-restore, the file is
+staged at data/pending_restore.json and marker rows are written to AppSetting.
+This module is invoked during app startup (after migrations + seeds) to
+atomically apply that pending restore — if present — before the server begins
+serving requests.
+
+If the apply fails, the pending file is kept so the operator can inspect it
+and markers are updated to record the last error. On success, the staged file
+is archived under data/applied_restores/<timestamp>.json and markers are
+cleared.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import shutil
+from datetime import datetime, timezone
+
+from sqlmodel.ext.asyncio.session import AsyncSession
+
+from ..api.backup import (
+    PENDING_RESTORE_CONFLICT_KEY,
+    PENDING_RESTORE_PATH_KEY,
+    PENDING_RESTORE_UPLOADED_AT_KEY,
+    PENDING_RESTORE_UPLOADED_BY_KEY,
+    _applied_restores_dir,
+    _pending_restore_path,
+)
+from ..database.engine import get_engine
+from ..database.models import AppSetting
+from .backup_schema import BackupFile, ConflictMode
+from .backup_service import import_backup
+
+_LOGGER = logging.getLogger(__name__)
+
+PENDING_RESTORE_LAST_ERROR_KEY = "pending_restore_last_error"
+PENDING_RESTORE_LAST_APPLIED_KEY = "pending_restore_last_applied"
+
+
+async def apply_pending_restore_if_any() -> None:
+    """Apply a staged restore if one exists. Idempotent and safe to call at startup."""
+    engine = get_engine()
+    async with AsyncSession(engine) as session:
+        path_row = await session.get(AppSetting, PENDING_RESTORE_PATH_KEY)
+        if not path_row or not path_row.value:
+            return
+
+        pending_path = _pending_restore_path()
+        if not pending_path.exists():
+            _LOGGER.warning(
+                "Pending-restore marker present but file missing at %s — clearing marker",
+                pending_path,
+            )
+            await _clear_markers(session)
+            await session.commit()
+            return
+
+        conflict_row = await session.get(AppSetting, PENDING_RESTORE_CONFLICT_KEY)
+        conflict_mode = ConflictMode(conflict_row.value) if conflict_row and conflict_row.value else ConflictMode.SKIP
+        uploaded_by_row = await session.get(AppSetting, PENDING_RESTORE_UPLOADED_BY_KEY)
+        uploaded_by = uploaded_by_row.value if uploaded_by_row else "admin"
+
+        try:
+            raw = json.loads(pending_path.read_text(encoding="utf-8"))
+            backup = BackupFile.model_validate(raw)
+        except Exception as err:  # noqa: BLE001
+            _LOGGER.exception("Pending-restore file unreadable")
+            await _record_error(session, f"Unreadable backup: {err}")
+            await session.commit()
+            return
+
+        # Resolve the target user: first admin (restore is cross-user).
+        # The backup carries its own user_id per-record, so this is mostly
+        # used for provenance.
+        from sqlmodel import select
+        from ..database.models import User
+        admin_row = (await session.exec(select(User).where(User.role == "admin"))).first()
+        if not admin_row:
+            _LOGGER.error("No admin user found; refusing to apply pending restore")
+            await _record_error(session, "No admin user available to own the restore")
+            await session.commit()
+            return
+
+        try:
+            result = await import_backup(session, admin_row.id, backup, conflict_mode)
+        except Exception as err:  # noqa: BLE001
+            _LOGGER.exception("Pending-restore apply failed")
+            await _record_error(session, str(err))
+            await session.commit()
+            return
+
+        # Archive the file
+        archive_dir = _applied_restores_dir()
+        archive_dir.mkdir(parents=True, exist_ok=True)
+        ts = datetime.now(timezone.utc).strftime("%Y-%m-%dT%H-%M-%S")
+        archived_name = f"applied-{ts}.json"
+        try:
+            shutil.move(str(pending_path), str(archive_dir / archived_name))
+        except Exception as err:  # noqa: BLE001
+            _LOGGER.warning("Could not archive applied restore file: %s", err)
+            # Still consider the apply a success; just best-effort cleanup
+            try:
+                pending_path.unlink()
+            except Exception:
+                pass
+
+        await _clear_markers(session)
+        applied_summary = {
+            "applied_at": datetime.now(timezone.utc).isoformat(),
+            "uploaded_by": uploaded_by,
+            "archived_file": archived_name,
+            "stats": result.model_dump() if hasattr(result, "model_dump") else {},
+        }
+        await _set_setting(
+            session,
+            PENDING_RESTORE_LAST_APPLIED_KEY,
+            json.dumps(applied_summary, default=str),
+        )
+        # Clear any prior error marker.
+        err_row = await session.get(AppSetting, PENDING_RESTORE_LAST_ERROR_KEY)
+        if err_row:
+            await session.delete(err_row)
+        await session.commit()
+        _LOGGER.info(
+            "Applied pending restore (uploaded by %s): %s",
+            uploaded_by, applied_summary["stats"],
+        )
+
+
+async def _clear_markers(session: AsyncSession) -> None:
+    for key in (
+        PENDING_RESTORE_PATH_KEY,
+        PENDING_RESTORE_CONFLICT_KEY,
+        PENDING_RESTORE_UPLOADED_AT_KEY,
+        PENDING_RESTORE_UPLOADED_BY_KEY,
+    ):
+        row = await session.get(AppSetting, key)
+        if row:
+            await session.delete(row)
+
+
+async def _record_error(session: AsyncSession, message: str) -> None:
+    await _set_setting(
+        session,
+        PENDING_RESTORE_LAST_ERROR_KEY,
+        json.dumps({
+            "at": datetime.now(timezone.utc).isoformat(),
+            "message": message[:2048],
+        }),
+    )
+
+
+async def _set_setting(session: AsyncSession, key: str, value: str) -> None:
+    row = await session.get(AppSetting, key)
+    if row:
+        row.value = value
+    else:
+        row = AppSetting(key=key, value=value)
+    session.add(row)

packages/server/src/notify_bridge_server/services/sample_context.py

@@ -29,7 +29,8 @@ _SAMPLE_ASSET = {
     "public_url": "https://immich.example.com/share/abc123/photos/a1b2c3d4-e5f6-7890-abcd-ef1234567890",
     "download_url": "https://immich.example.com/api/assets/abc123/original",
     "photo_url": "https://immich.example.com/api/assets/abc123/thumbnail",
-    "file_size": 3_500_000,  # 3.5 MB
+    "file_size": 3_500_000,  # 3.5 MB — original asset bytes
+    "playback_size": None,  # photos are sent as-is, no transcoded variant
     "oversized": False,
 }
 
@@ -43,7 +44,8 @@ _SAMPLE_VIDEO_ASSET = {
     "photo_url": None,
     "public_url": "https://immich.example.com/share/abc123/photos/d4e5f6a7-b8c9-0123-defg-456789abcdef",
     "playback_url": "https://immich.example.com/api/assets/def456/video",
-    "file_size": 75_000_000,  # 75 MB — exceeds Telegram's 50 MB limit
+    "file_size": 180_000_000,  # 180 MB — original HEVC
+    "playback_size": 62_000_000,  # 62 MB transcoded — exceeds Telegram's 50 MB limit
     "oversized": True,
 }
 

packages/server/src/notify_bridge_server/services/scheduler.py

@@ -34,6 +34,9 @@ async def start_scheduler() -> None:
     # Schedule daily cleanup of old event log entries
     _schedule_event_cleanup()
 
+    # Schedule periodic Telegram chat title refresh
+    _schedule_telegram_chat_sync()
+
     # Start debounced command auto-sync scheduler
     from .command_sync import start_sync_scheduler
     start_sync_scheduler()
@@ -60,6 +63,139 @@ def _schedule_event_cleanup() -> None:
     _LOGGER.info("Scheduled daily event log cleanup at 03:00 UTC")
 
 
+# Chat-title refresh tuning.
+# Sweep runs daily as a fallback — we additionally refresh opportunistically
+# on every incoming webhook/long-poll update (``save_chat_from_webhook``), so
+# the sweep only catches chats that haven't sent anything recently.
+_CHAT_SYNC_INTERVAL_HOURS = 24
+_CHAT_SYNC_INITIAL_DELAY_SECONDS = 60
+_CHAT_SYNC_CONCURRENCY = 10
+
+
+def _schedule_telegram_chat_sync() -> None:
+    """Schedule periodic refresh of Telegram chat titles via getChat."""
+    from apscheduler.triggers.interval import IntervalTrigger
+
+    scheduler = get_scheduler()
+    job_id = "refresh_telegram_chat_titles"
+    if scheduler.get_job(job_id):
+        return
+    scheduler.add_job(
+        _refresh_telegram_chat_titles,
+        IntervalTrigger(hours=_CHAT_SYNC_INTERVAL_HOURS),
+        id=job_id,
+        replace_existing=True,
+        max_instances=1,
+        next_run_time=None,
+    )
+    # Fire once shortly after startup so stale names refresh without waiting a day.
+    from datetime import datetime, timedelta, timezone
+    scheduler.add_job(
+        _refresh_telegram_chat_titles,
+        "date",
+        run_date=datetime.now(timezone.utc) + timedelta(seconds=_CHAT_SYNC_INITIAL_DELAY_SECONDS),
+        id="refresh_telegram_chat_titles_once",
+        replace_existing=True,
+        max_instances=1,
+    )
+    _LOGGER.info(
+        "Scheduled Telegram chat title refresh every %sh (concurrency %s)",
+        _CHAT_SYNC_INTERVAL_HOURS, _CHAT_SYNC_CONCURRENCY,
+    )
+
+
+async def _refresh_telegram_chat_titles() -> None:
+    """Refresh TelegramChat.title/username via getChat for all known chats.
+
+    Runs requests in bounded parallel (``_CHAT_SYNC_CONCURRENCY``) so a fleet
+    of 50 chats finishes in ~5 round-trips instead of 50. Telegram's
+    ``getChat`` rate limit is well above 10 concurrent per bot, and the cap is
+    global across bots so we never flood the shared HTTP session.
+    """
+    import asyncio
+    from collections import defaultdict
+
+    from sqlmodel import select
+    from sqlmodel.ext.asyncio.session import AsyncSession
+
+    from notify_bridge_core.notifications.telegram.client import TelegramClient
+
+    from ..database.engine import get_engine
+    from ..database.models import TelegramBot, TelegramChat
+    from .http_session import get_http_session
+
+    engine = get_engine()
+    async with AsyncSession(engine) as session:
+        bots = (await session.exec(select(TelegramBot))).all()
+        bot_tokens = {b.id: b.token for b in bots if b.token}
+        if not bot_tokens:
+            return
+        chats = (await session.exec(select(TelegramChat))).all()
+
+    by_bot: dict[int, list[TelegramChat]] = defaultdict(list)
+    for chat in chats:
+        if chat.bot_id in bot_tokens:
+            by_bot[chat.bot_id].append(chat)
+    if not by_bot:
+        return
+
+    http = await get_http_session()
+    clients_by_bot = {
+        bot_id: TelegramClient(http, token) for bot_id, token in bot_tokens.items()
+    }
+
+    sem = asyncio.Semaphore(_CHAT_SYNC_CONCURRENCY)
+
+    async def _fetch(bot_id: int, chat: TelegramChat) -> tuple[int, dict | None, str | None]:
+        """Return (chat_row_id, info_dict_or_None, error_message_or_None)."""
+        async with sem:
+            try:
+                res = await clients_by_bot[bot_id].get_chat(chat.chat_id)
+            except Exception as err:  # noqa: BLE001
+                return chat.id, None, str(err)
+            if not res.get("success"):
+                return chat.id, None, res.get("error") or "unknown"
+            return chat.id, (res.get("result") or {}), None
+
+    tasks = [
+        _fetch(bot_id, chat)
+        for bot_id, bot_chats in by_bot.items()
+        for chat in bot_chats
+    ]
+    results = await asyncio.gather(*tasks)
+
+    refreshed = 0
+    errors = 0
+    async with AsyncSession(engine) as session:
+        for chat_id, info, err in results:
+            if err is not None or info is None:
+                errors += 1
+                if err:
+                    _LOGGER.debug("getChat failed for chat row %s: %s", chat_id, err)
+                continue
+            merged = await session.get(TelegramChat, chat_id)
+            if not merged:
+                continue
+            title = info.get("title") or (
+                (info.get("first_name", "") + " " + info.get("last_name", "")).strip()
+            )
+            changed = False
+            if title and merged.title != title:
+                merged.title = title
+                changed = True
+            new_username = info.get("username")
+            if new_username is not None and merged.username != new_username:
+                merged.username = new_username
+                changed = True
+            if changed:
+                session.add(merged)
+                refreshed += 1
+        await session.commit()
+    _LOGGER.info(
+        "Telegram chat title refresh: %s updated, %s errors", refreshed, errors
+    )
+
+
 async def _cleanup_old_events() -> None:
     """Delete EventLog entries older than 90 days."""
     from datetime import datetime, timedelta, timezone

packages/server/src/notify_bridge_server/services/telegram_poller.py

@@ -28,6 +28,16 @@ _LOGGER = logging.getLogger(__name__)
 # Track last update_id per bot to use as offset
 _last_update_id: dict[int, int] = {}
 
+# Throttle auto-reclaim attempts so we don't hammer deleteWebhook when a
+# stubborn external instance keeps re-setting the webhook.  (bot_id → unix ts)
+_last_webhook_reclaim_at: dict[int, float] = {}
+_WEBHOOK_RECLAIM_COOLDOWN_SECONDS = 60.0
+
+# Phrase Telegram uses in the 409 response description for the
+# "webhook is active" conflict.  Matched case-insensitively so we don't
+# depend on exact wording.
+_WEBHOOK_CONFLICT_PHRASE = "webhook is active"
+
 
 async def _get_bot_ids_with_active_listeners() -> set[int]:
     """Return bot IDs that have at least one active command tracker listener.
@@ -141,6 +151,64 @@ def unschedule_bot_polling(bot_id: int) -> None:
         _LOGGER.info("Stopped polling for bot %d", bot_id)
 
 
+async def _handle_webhook_conflict(bot_id: int, bot_token: str, description: str) -> None:
+    """Reclaim a bot stuck behind an active webhook set by another instance.
+
+    Telegram's ``getUpdates`` returns 409 ``Conflict: can't use getUpdates
+    method while webhook is active`` whenever a webhook is currently
+    registered for the bot.  Since this bot row has ``update_mode="polling"``
+    in our DB (that's the only reason we're polling it), the user's intent
+    is polling, so we drop the webhook and resume.  Throttled to once per
+    minute per bot so a rival instance constantly re-registering the
+    webhook doesn't trigger a reclaim storm.
+    """
+    import time
+    now = time.time()
+    last = _last_webhook_reclaim_at.get(bot_id, 0.0)
+    if now - last < _WEBHOOK_RECLAIM_COOLDOWN_SECONDS:
+        # Already logged recently; stay quiet until cooldown expires so the
+        # user gets one clear warning line per minute, not one every 3s.
+        return
+    _last_webhook_reclaim_at[bot_id] = now
+
+    from .http_session import get_http_session
+    http = await get_http_session()
+    client = TelegramClient(http, bot_token)
+
+    # Surface which URL stole the bot so the user can tell where it came from.
+    conflicting_url = ""
+    try:
+        info = await client.get_webhook_info()
+        if info.get("success"):
+            conflicting_url = info.get("result", {}).get("url", "") or ""
+    except Exception as err:  # noqa: BLE001
+        _LOGGER.debug("getWebhookInfo during conflict recovery failed: %s", err)
+
+    _LOGGER.warning(
+        "Bot %d: webhook is active (url=%r) but this instance is in polling "
+        "mode — calling deleteWebhook to reclaim. Telegram said: %s",
+        bot_id, conflicting_url, description,
+    )
+
+    try:
+        del_result = await client.delete_webhook()
+        if del_result.get("success"):
+            _LOGGER.warning(
+                "Bot %d: webhook cleared; polling will resume on next tick",
+                bot_id,
+            )
+            # Reset offset so we don't skip updates that accumulated during the
+            # conflict window (Telegram held them until a client acknowledged).
+            _last_update_id.pop(bot_id, None)
+        else:
+            _LOGGER.error(
+                "Bot %d: deleteWebhook failed: %s",
+                bot_id, del_result.get("error"),
+            )
+    except Exception as err:  # noqa: BLE001
+        _LOGGER.error("Bot %d: deleteWebhook raised: %s", bot_id, err)
+
+
 async def _poll_bot(bot_id: int) -> None:
     """Fetch updates from Telegram and process them."""
     engine = get_engine()
@@ -167,6 +235,15 @@ async def _poll_bot(bot_id: int) -> None:
             offset=offset + 1 if offset else None, limit=50,
         )
         if not result.get("success"):
+            err_text = str(result.get("error") or "")
+            # Detect the webhook-is-active conflict: another instance (or a
+            # stale registration) owns this bot's delivery, so getUpdates
+            # returns 409 and we get zero updates forever.  Reclaim it —
+            # but only for bots the user explicitly set to polling mode.
+            if _WEBHOOK_CONFLICT_PHRASE in err_text.lower():
+                await _handle_webhook_conflict(bot_id, bot_token, err_text)
+            else:
+                _LOGGER.debug("Polling error for bot %d: %s", bot_id, err_text)
             return
         updates = result.get("result", [])
     except Exception as e:

packages/server/src/notify_bridge_server/services/test_dispatch.py

@@ -79,7 +79,8 @@ async def dispatch_test_notification(
             if locale_map:
                 template_slots = {EventType.SCHEDULED_MESSAGE.value: locale_map}
 
-    # Resolve target config + receivers (same as watcher)
+    # Resolve target config + receivers (same as watcher — this already sets
+    # each receiver.locale from TargetReceiver.locale or TelegramChat override)
     resolved = await _resolve_target(session, target)
 
     target_cfg = TargetConfig(
@@ -95,21 +96,47 @@ async def dispatch_test_notification(
         receivers=resolved["receivers"],
     )
 
+    if not template_slots:
+        return {
+            "success": False,
+            "error": (
+                f"No '{slot_name}' template defined for this target's template config "
+                f"(locale: {locale}). Add the slot under Template Configs."
+            ),
+        }
+
     # Fetch assets and build event
-    event = await _build_event(
-        provider_type=provider.type,
-        provider_config=provider_config,
-        provider_name=provider.name or provider.type,
-        tracker_name=tracker.name or "",
-        tracker_filters=dict(tracker.filters) if tracker.filters else {},
-        collection_ids=collection_ids,
-        test_type=test_type,
-        tracking_config=tracking_config,
-    )
+    try:
+        event = await _build_event(
+            provider_type=provider.type,
+            provider_config=provider_config,
+            provider_name=provider.name or provider.type,
+            tracker_name=tracker.name or "",
+            tracker_filters=dict(tracker.filters) if tracker.filters else {},
+            collection_ids=collection_ids,
+            test_type=test_type,
+            tracking_config=tracking_config,
+        )
+    except Exception as err:  # noqa: BLE001
+        _LOGGER.exception("Test dispatch event build failed")
+        return {"success": False, "error": f"Provider connection failed: {err}"}
     if event is None:
-        return {"success": False, "error": "No data returned from provider"}
+        return {
+            "success": False,
+            "error": (
+                "Provider returned no data. Check that the provider is reachable, "
+                "credentials are valid, and the tracker has collections configured."
+            ),
+        }
+    # Periodic summary only needs album stats (extra.albums), not assets — skip the asset check.
     if not event.added_assets and test_type in ("scheduled", "memory"):
-        return {"success": False, "error": "No matching assets found" + (" for today" if test_type == "memory" else "")}
+        return {
+            "success": False,
+            "error": (
+                "No matching assets found. Verify the tracker's albums contain assets "
+                "that pass the tracking config filters (favorites only, rating, asset type)."
+            ) + (" for today" if test_type == "memory" else ""),
+        }
 
     # Dispatch through the real NotificationDispatcher
     url_cache, asset_cache = await _get_telegram_caches()
@@ -136,6 +163,13 @@ async def _build_event(
     from datetime import datetime, timezone
 
     if provider_type == "immich":
+        if test_type == "periodic":
+            return await _build_immich_periodic_event(
+                provider_config=provider_config,
+                provider_name=provider_name,
+                tracker_name=tracker_name,
+                collection_ids=collection_ids,
+            )
         return await _build_immich_event(
             provider_config=provider_config,
             provider_name=provider_name,
@@ -237,6 +271,76 @@ async def _build_immich_event(
     )
 
 
+async def _build_immich_periodic_event(
+    *,
+    provider_config: dict,
+    provider_name: str,
+    tracker_name: str,
+    collection_ids: list[str],
+) -> ServiceEvent | None:
+    """Build a periodic-summary event (album stats only, no assets).
+
+    Reuses the same shared core utility (`collect_scheduled_assets`) that
+    scheduled/memory tests use, invoked with limit=0 so we get the full
+    ``collections_extra`` block (album name/url/counts/...) without selecting
+    any individual assets — which is exactly what the
+    ``periodic_summary_message`` template renders.
+    """
+    from datetime import datetime, timezone
+    from notify_bridge_core.providers.immich import ImmichServiceProvider
+    from notify_bridge_core.providers.immich.asset_utils import collect_scheduled_assets
+    from notify_bridge_core.providers.immich.models import ImmichAlbumData, SharedLinkInfo
+
+    from .http_session import get_http_session
+    http_session = await get_http_session()
+    immich = ImmichServiceProvider(
+        http_session,
+        provider_config.get("url", ""),
+        provider_config.get("api_key", ""),
+        provider_config.get("external_domain"),
+        provider_name,
+    )
+    if not await immich.connect():
+        return None
+
+    ext_domain = provider_config.get("external_domain") or provider_config.get("url", "")
+
+    albums: dict[str, ImmichAlbumData] = {}
+    shared_links: dict[str, list[SharedLinkInfo]] = {}
+    for album_id in collection_ids:
+        album = await immich.client.get_album(album_id)
+        if album:
+            albums[album_id] = album
+            shared_links[album_id] = await immich.client.get_shared_links(album_id)
+
+    # limit=0 → returns ([], collections_extra) with full per-album stats.
+    _assets, collections_extra = collect_scheduled_assets(
+        albums, shared_links, ext_domain,
+        limit=0,
+        asset_type="all",
+        favorite_only=False,
+        min_rating=0,
+        is_memory=False,
+    )
+
+    first_col = collections_extra[0] if collections_extra else {}
+    return ServiceEvent(
+        event_type=EventType.SCHEDULED_MESSAGE,
+        provider_type=ServiceProviderType.IMMICH,
+        provider_name=provider_name,
+        collection_id=collection_ids[0] if collection_ids else "",
+        collection_name=first_col.get("name", tracker_name),
+        timestamp=datetime.now(timezone.utc),
+        added_assets=[],
+        added_count=0,
+        extra={
+            "collections": collections_extra,
+            "albums": collections_extra,
+            **(first_col if first_col else {}),
+        },
+    )
+
+
 async def _build_native_memory_event(
     immich,
     ext_domain: str,

packages/server/src/notify_bridge_server/services/watcher.py

@@ -191,6 +191,7 @@ async def check_tracker(tracker_id: int) -> dict[str, Any]:
         for event in events:
             assets_count = event.added_count or event.removed_count or 0
             log = EventLog(
+                user_id=tracker.user_id,
                 tracker_id=tracker_id,
                 tracker_name=tracker.name,
                 provider_id=provider.id,