Protection — people, collections and tags

Three things stop a rule deleting something, and they work differently. This is the one part of cleanup worth reading before you switch a rule on.

Multi-user protection — somebody is part-way through it

Keeps anything one of the people you select has started and not finished. Every selected person is checked before any of the conditions below run. Somebody who has never touched a title holds nothing, so adding a person who watches little costs you nothing.

Seasons are judged one at a time. A season everyone has finished can be cleaned up while a later one is kept, which is what makes this usable on a long show rather than all-or-nothing.

Protection Mode decides how much is kept around the person mid-watch. Each option names what it keeps:

Grace after last activity (days) holds a title for a while after the watch verdict is made, so something watched last night can be rewatched, or a wrong mark undone, before it goes. It is a sliding window from the last activity, so watching it again extends it. Only the people selected above count. Someone else watching it does not extend the window.

Nothing pauses a countdown. If a queued title stops being deletable — it gets protected, or somebody watches it — its row is dropped rather than frozen, and if it ever matches again the countdown starts over from the full grace period. That is more warning than a paused clock, not less, but it does mean banked days are not kept.

Connect two watch sources. Plex plus Trakt, or Plex plus Tautulli. A second source cross-checks the first, so a missed scrobble or an hour of downtime cannot drop a show somebody is mid-way through. One source works. Movies are fine on any single source. Per-season TV needs a per-episode source — Plex history if you have it enabled, or Tautulli. Trakt alone only reports series-level, so a household on Trakt alone gets no per-season protection at all.

Protected collections — everything in this list is off limits

Anything in a protected collection is protected for everyone, whatever their watch state. Use it for watchlists and keep-lists, so one person finishing a title cannot get it deleted before somebody else has started.

Nothing here reads watch state — but the collection might. That distinction matters and has bitten before. A collection built from watch data, such as "unwatched by" or "not in progress", changes its own membership as people watch, so the protection moves with it. A title can sit in a collection you named as protected and still be queued for deletion, because it left that collection first. If you want protection that cannot move, use a collection whose membership you control by hand.

A rule refuses to run if a protected collection has been deleted. It names which one, so you fix it or remove it from the rule rather than the rule quietly protecting nothing.

Protected *arr tags — the same idea, reached by tag

Anything carrying one of these Radarr or Sonarr tags is protected for everyone. It is the catch-all beside protected collections, and it is how per-person keep lists work.

A tag that nobody has used is fine. A tag that does not exist is not. Those look identical at the item level — no title carries the label either way — so Kustos checks the *arr's own tag list, and a rule naming a tag that is not there refuses to run. That is deliberate: a missing tag is usually a typo, a rename, or a tag deleted out from under you, and all three would silently protect nothing.

With one exception, for a reason worth knowing. Sonarr and Radarr each run Housekeeping every 24 hours, and one of its steps deletes tags attached to nothing. So a per-person keep tag that Kustos created, and nobody has used yet, is removed overnight — every night. Because Kustos configured that tag itself and knows its exact spelling, a missing tag of that kind is treated as what an unused tag has always meant: it protects nothing, and the rule runs. A tag typed into a rule by hand that exists nowhere is still a typo, and still refuses.

Bypass tags are checked the other way round. A missing bypass tag means nobody bypasses protection, which errs toward keeping more, and a delete path is allowed to be wrong only in that direction.