Logging in before the first call turned a stale or wrong password into a hard failure on calls that would have succeeded: an instance that bypasses authentication for arr's address answers everything, and never needed the credentials at all. Authentication is now established on the first 403. The health probe was reading a 403 from `app/version` as healthy, on the reasoning that a live daemon is all the lamp claims. That is exactly the state arr cannot use, and it left the lamp green while every grab and every reaper tick failed on rejected credentials. It now lists torrents through the configured client, so the lamp fails when arr's own calls do. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>