From 4620978dcee974b873ebca4801e32356c8186623 Mon Sep 17 00:00:00 2001
From: Justin Visser <justinfvisser@gmail.com>
Date: Tue, 3 Mar 2026 17:36:43 +0100
Subject: [PATCH 01/15] feat(ingestion,frontend): add live scholar progress
 counter to dashboard
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Emit scholar_progress SSE events during two-pass ingestion so the
Activity Monitor shows "X / N visited · Y finished · Z new publications"
in real time instead of static post-run counts.

- scholar_processing: add on_progress callback to _run_first_pass and
  _run_depth_pass; build _emit closure in run_scholar_iteration that
  publishes visited/finished/total via run_events; batch-emit scholars
  finished in first pass before depth pass; skip emission on abort/cancel
- run_status store: add scholarProgress state, reset on stream open and
  reset(); subscribe to scholar_progress SSE events with safe parsing
- DashboardPage: show live counter during run, fall back to static text
  when run is not active or no progress received yet

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 app/services/ingestion/scholar_processing.py | 29 ++++++++++++++++++++
 frontend/src/pages/DashboardPage.vue         | 13 +++++++--
 frontend/src/stores/run_status.ts            | 16 +++++++++++
 3 files changed, 55 insertions(+), 3 deletions(-)

diff --git a/app/services/ingestion/scholar_processing.py b/app/services/ingestion/scholar_processing.py
index f41d904..7867014 100644
--- a/app/services/ingestion/scholar_processing.py
+++ b/app/services/ingestion/scholar_processing.py
@@ -3,6 +3,7 @@ from __future__ import annotations
 import asyncio
 import logging
 import random
+from collections.abc import Callable, Coroutine
 from datetime import UTC, datetime
 from typing import Any
 
@@ -274,6 +275,7 @@ async def _run_first_pass(
     request_delay_seconds: int,
     queue_delay_seconds: int,
     progress: RunProgress,
+    on_progress: Callable[[int, int], Coroutine[Any, Any, None]] | None = None,
 ) -> dict[int, int]:
     first_pass_cstarts: dict[int, int] = {}
     for index, scholar in enumerate(scholars):
@@ -310,6 +312,8 @@ async def _run_first_pass(
                 scholars_remaining=len(scholars) - index - 1,
             )
             return first_pass_cstarts
+        if on_progress is not None:
+            await on_progress(1, 0)
         resume_cstart = outcome.result_entry.get("continuation_cstart")
         if resume_cstart is not None and int(resume_cstart) > start_cstart:
             first_pass_cstarts[int(scholar.id)] = int(resume_cstart)
@@ -330,6 +334,7 @@ async def _run_depth_pass(
     auto_queue_continuations: bool,
     queue_delay_seconds: int,
     progress: RunProgress,
+    on_progress: Callable[[int, int], Coroutine[Any, Any, None]] | None = None,
 ) -> None:
     for index, scholar in enumerate(scholars):
         resume_cstart = first_pass_cstarts.get(int(scholar.id))
@@ -367,6 +372,8 @@ async def _run_depth_pass(
                 scholars_remaining=len(scholars) - index - 1,
             )
             break
+        if on_progress is not None:
+            await on_progress(0, 1)
 
 
 async def run_scholar_iteration(
@@ -387,6 +394,8 @@ async def run_scholar_iteration(
     auto_queue_continuations: bool,
     queue_delay_seconds: int,
 ) -> RunProgress:
+    from app.services.runs.events import run_events
+
     progress = RunProgress()
     scholar_kwargs: dict[str, Any] = {
         "request_delay_seconds": request_delay_seconds,
@@ -396,6 +405,21 @@ async def run_scholar_iteration(
         "rate_limit_backoff_seconds": rate_limit_backoff_seconds,
         "page_size": page_size,
     }
+
+    visited = 0
+    finished = 0
+    total = len(scholars)
+
+    async def _emit(v: int = 0, f: int = 0) -> None:
+        nonlocal visited, finished
+        visited += v
+        finished += f
+        await run_events.publish(
+            run.id,
+            "scholar_progress",
+            {"visited": visited, "finished": finished, "total": total},
+        )
+
     first_pass_cstarts = await _run_first_pass(
         db_session,
         scholars=scholars,
@@ -407,8 +431,12 @@ async def run_scholar_iteration(
         request_delay_seconds=request_delay_seconds,
         queue_delay_seconds=queue_delay_seconds,
         progress=progress,
+        on_progress=_emit,
     )
     remaining_max = max(max_pages_per_scholar - 1, 0)
+    scholars_finished_in_first_pass = len(scholars) - len(first_pass_cstarts)
+    if scholars_finished_in_first_pass > 0:
+        await _emit(f=scholars_finished_in_first_pass)
     if remaining_max <= 0:
         return progress
     await _run_depth_pass(
@@ -424,5 +452,6 @@ async def run_scholar_iteration(
         auto_queue_continuations=auto_queue_continuations,
         queue_delay_seconds=queue_delay_seconds,
         progress=progress,
+        on_progress=_emit,
     )
     return progress
diff --git a/frontend/src/pages/DashboardPage.vue b/frontend/src/pages/DashboardPage.vue
index fbd0b4c..d5a82ee 100644
--- a/frontend/src/pages/DashboardPage.vue
+++ b/frontend/src/pages/DashboardPage.vue
@@ -486,9 +486,16 @@ watch(
                       </RouterLink>
                     </div>
                     <p class="mt-2 text-sm text-secondary">
-                      Started {{ formatDate(displayedLatestRun.start_dt) }}. Processed
-                      {{ displayedLatestRun.scholar_count }} scholars and discovered
-                      {{ displayedLatestRun.new_publication_count }} new publications.
+                      Started {{ formatDate(displayedLatestRun.start_dt) }}.
+                      <template v-if="runStatus.isLikelyRunning && runStatus.scholarProgress">
+                        {{ runStatus.scholarProgress.visited }} / {{ runStatus.scholarProgress.total }} visited
+                        · {{ runStatus.scholarProgress.finished }} finished
+                        · {{ displayedLatestRun.new_publication_count }} new publications.
+                      </template>
+                      <template v-else>
+                        Processed {{ displayedLatestRun.scholar_count }} scholars and discovered
+                        {{ displayedLatestRun.new_publication_count }} new publications.
+                      </template>
                     </p>
                   </div>
                   <AppEmptyState
diff --git a/frontend/src/stores/run_status.ts b/frontend/src/stores/run_status.ts
index 4b0238e..952c607 100644
--- a/frontend/src/stores/run_status.ts
+++ b/frontend/src/stores/run_status.ts
@@ -168,6 +168,7 @@ export const useRunStatusStore = defineStore("runStatus", {
     lastErrorRequestId: null as string | null,
     lastSyncAt: null as number | null,
     livePublications: [] as Array<PublicationItem>,
+    scholarProgress: null as { visited: number; finished: number; total: number } | null,
   }),
   getters: {
     isRunActive(state): boolean {
@@ -257,6 +258,7 @@ export const useRunStatusStore = defineStore("runStatus", {
         }
         activeStreamRunId = targetRunId;
         this.livePublications = [];
+        this.scholarProgress = null;
         eventSource = new EventSource(`/api/v1/runs/${targetRunId}/stream`);
         eventSource.addEventListener("publication_discovered", (e) => {
           try {
@@ -312,6 +314,19 @@ export const useRunStatusStore = defineStore("runStatus", {
             console.error("Failed to parse SSE event", err);
           }
         });
+        eventSource.addEventListener("scholar_progress", (e) => {
+          try {
+            const data = JSON.parse(e.data);
+            const visited = typeof data.visited === "number" ? Math.max(0, Math.trunc(data.visited)) : null;
+            const finished = typeof data.finished === "number" ? Math.max(0, Math.trunc(data.finished)) : null;
+            const total = typeof data.total === "number" ? Math.max(1, Math.trunc(data.total)) : null;
+            if (visited !== null && finished !== null && total !== null) {
+              this.scholarProgress = { visited, finished, total };
+            }
+          } catch (err) {
+            console.error("Failed to parse SSE event", err);
+          }
+        });
         eventSource.onerror = () => {
           // Reconnecting is handled automatically by EventSource,
           // but if it's permanently closed, we could do something here.
@@ -491,6 +506,7 @@ export const useRunStatusStore = defineStore("runStatus", {
       this.lastSyncAt = null;
       this.safetyState = createDefaultSafetyState();
       this.livePublications = [];
+      this.scholarProgress = null;
     },
   },
 });

From 2c591a0ca33b43f08d47a8d8205dde65ecd8cd0f Mon Sep 17 00:00:00 2001
From: Justin Visser <justinfvisser@gmail.com>
Date: Tue, 3 Mar 2026 18:37:53 +0100
Subject: [PATCH 02/15] fix(ingestion,frontend): show live counter immediately
 on run start
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two issues with the initial implementation:
- Counter only appeared after the first SSE event arrived (scholarProgress null
  kept the v-else static template showing until a scholar completed)
- First events were often dropped because the EventSource hadn't subscribed yet

Fix:
- Backend: emit an initial scholar_progress kickoff event (0/0/N) at the
  start of run_scholar_iteration so the frontend receives total early
- Frontend: gate on isLikelyRunning alone (not scholarProgress); use optional
  chaining with fallbacks so "0 / … visited · 0 finished" shows immediately
  when a run starts, before any SSE events arrive

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 app/services/ingestion/scholar_processing.py | 1 +
 frontend/src/pages/DashboardPage.vue         | 6 +++---
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/app/services/ingestion/scholar_processing.py b/app/services/ingestion/scholar_processing.py
index 7867014..1735915 100644
--- a/app/services/ingestion/scholar_processing.py
+++ b/app/services/ingestion/scholar_processing.py
@@ -420,6 +420,7 @@ async def run_scholar_iteration(
             {"visited": visited, "finished": finished, "total": total},
         )
 
+    await _emit()
     first_pass_cstarts = await _run_first_pass(
         db_session,
         scholars=scholars,
diff --git a/frontend/src/pages/DashboardPage.vue b/frontend/src/pages/DashboardPage.vue
index d5a82ee..8623927 100644
--- a/frontend/src/pages/DashboardPage.vue
+++ b/frontend/src/pages/DashboardPage.vue
@@ -487,9 +487,9 @@ watch(
                     </div>
                     <p class="mt-2 text-sm text-secondary">
                       Started {{ formatDate(displayedLatestRun.start_dt) }}.
-                      <template v-if="runStatus.isLikelyRunning && runStatus.scholarProgress">
-                        {{ runStatus.scholarProgress.visited }} / {{ runStatus.scholarProgress.total }} visited
-                        · {{ runStatus.scholarProgress.finished }} finished
+                      <template v-if="runStatus.isLikelyRunning">
+                        {{ runStatus.scholarProgress?.visited ?? 0 }} / {{ runStatus.scholarProgress?.total ?? '…' }} visited
+                        · {{ runStatus.scholarProgress?.finished ?? 0 }} finished
                         · {{ displayedLatestRun.new_publication_count }} new publications.
                       </template>
                       <template v-else>

From a72151cfdcaa8f2043764096e7c9c0fd1fdc9a7f Mon Sep 17 00:00:00 2001
From: Justin Visser <justinfvisser@gmail.com>
Date: Tue, 3 Mar 2026 23:02:37 +0100
Subject: [PATCH 03/15] feat(frontend): show run and cancel buttons to all
 users

Remove the auth.isAdmin guard from the Start check and Cancel check
buttons in the Activity Monitor. Admin-only route links (check history,
diagnostics) are unchanged.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 frontend/src/pages/DashboardPage.vue | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/frontend/src/pages/DashboardPage.vue b/frontend/src/pages/DashboardPage.vue
index 8623927..c7da221 100644
--- a/frontend/src/pages/DashboardPage.vue
+++ b/frontend/src/pages/DashboardPage.vue
@@ -404,7 +404,7 @@ watch(
                     </div>
                     <div class="flex items-center gap-2">
                       <AppButton
-                        v-if="auth.isAdmin && runStatus.isLikelyRunning"
+                        v-if="runStatus.isLikelyRunning"
                         variant="danger"
                         :disabled="!activeRunId || isCancelAnimating"
                         @click="onCancelRun"
@@ -420,7 +420,6 @@ watch(
                         </span>
                       </AppButton>
                       <AppButton
-                        v-if="auth.isAdmin"
                         :disabled="isStartBlocked"
                         :title="startCheckDisabledReason || undefined"
                         :class="isStartCheckAnimating ? 'shadow-[0_0_0_1px_var(--color-state-info-border)]' : ''"

From 0d955c31dcef6dcf6b02960ee7d7470def1cf076 Mon Sep 17 00:00:00 2001
From: Justin Visser <justinfvisser@gmail.com>
Date: Wed, 4 Mar 2026 02:17:18 +0100
Subject: [PATCH 04/15] feat(settings): hours interval, pdf queue for all
 users, fix users tab loading

- Convert check interval setting from minutes to hours in the UI
- Show PDF queue tab to all authenticated users (not admin-only); requeue
  actions remain admin-only in both backend and frontend
- Fix users tab not loading on first visit by removing the AsyncStateGate
  wrapper that prevented child component refs from being populated before
  onMounted fired

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 app/api/routers/admin_dbops.py                |  6 +--
 .../features/settings/SettingsAdminPanel.vue  | 48 +++++++------------
 .../components/AdminPdfQueueSection.vue       |  6 ++-
 frontend/src/pages/SettingsPage.vue           | 29 +++++++----
 4 files changed, 43 insertions(+), 46 deletions(-)

diff --git a/app/api/routers/admin_dbops.py b/app/api/routers/admin_dbops.py
index 0f4d1f6..ce63ea2 100644
--- a/app/api/routers/admin_dbops.py
+++ b/app/api/routers/admin_dbops.py
@@ -5,7 +5,7 @@ import logging
 from fastapi import APIRouter, Depends, Path, Query, Request
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.api.deps import get_api_admin_user
+from app.api.deps import get_api_admin_user, get_api_current_user
 from app.api.errors import ApiException
 from app.api.responses import success_payload
 from app.api.schemas import (
@@ -185,7 +185,7 @@ async def get_pdf_queue(
     offset: int | None = Query(default=None, ge=0),
     status: str | None = Query(default=None),
     db_session: AsyncSession = Depends(get_db_session),
-    admin_user: User = Depends(get_api_admin_user),
+    current_user: User = Depends(get_api_current_user),
 ):
     normalized_status = (status or "").strip().lower() or None
     resolved_page, resolved_limit, resolved_offset = _resolve_pdf_queue_paging(
@@ -204,7 +204,7 @@ async def get_pdf_queue(
         logger,
         "info",
         "api.admin.db.pdf_queue_listed",
-        admin_user_id=int(admin_user.id),
+        user_id=int(current_user.id),
         page=int(resolved_page),
         page_size=int(resolved_limit),
         offset=int(resolved_offset),
diff --git a/frontend/src/features/settings/SettingsAdminPanel.vue b/frontend/src/features/settings/SettingsAdminPanel.vue
index b306d1e..6e7e326 100644
--- a/frontend/src/features/settings/SettingsAdminPanel.vue
+++ b/frontend/src/features/settings/SettingsAdminPanel.vue
@@ -1,7 +1,7 @@
 <script setup lang="ts">
-import { onMounted, ref, watch } from "vue";
+import { onMounted, watch } from "vue";
+import { ref } from "vue";
 
-import AsyncStateGate from "@/components/patterns/AsyncStateGate.vue";
 import RequestStateAlerts from "@/components/patterns/RequestStateAlerts.vue";
 import AdminIntegritySection from "@/features/settings/components/AdminIntegritySection.vue";
 import AdminPdfQueueSection from "@/features/settings/components/AdminPdfQueueSection.vue";
@@ -18,7 +18,6 @@ const props = defineProps<{
   section: "users" | "integrity" | "repairs" | "pdf";
 }>();
 
-const loading = ref(true);
 const { errorMessage, errorRequestId, successMessage, clearAlerts, assignError } = useRequestState();
 
 const usersRef = ref<InstanceType<typeof AdminUsersSection> | null>(null);
@@ -26,34 +25,21 @@ const integrityRef = ref<InstanceType<typeof AdminIntegritySection> | null>(null
 const repairsRef = ref<InstanceType<typeof AdminRepairsSection> | null>(null);
 const pdfQueueRef = ref<InstanceType<typeof AdminPdfQueueSection> | null>(null);
 
-async function refreshForSection(): Promise<void> {
-  if (props.section === SECTION_USERS && usersRef.value) {
-    await usersRef.value.load();
-    return;
-  }
-  if (props.section === SECTION_INTEGRITY && integrityRef.value) {
-    await integrityRef.value.load();
-    return;
-  }
-  if (props.section === SECTION_REPAIRS) {
-    await usersRef.value?.load();
-    await repairsRef.value?.load();
-    return;
-  }
-  if (props.section === SECTION_PDF && pdfQueueRef.value) {
-    await pdfQueueRef.value.load();
-  }
-}
-
 async function loadSection(): Promise<void> {
-  loading.value = true;
   clearAlerts();
   try {
-    await refreshForSection();
+    if (props.section === SECTION_USERS && usersRef.value) {
+      await usersRef.value.load();
+    } else if (props.section === SECTION_INTEGRITY && integrityRef.value) {
+      await integrityRef.value.load();
+    } else if (props.section === SECTION_REPAIRS) {
+      await usersRef.value?.load();
+      await repairsRef.value?.load();
+    } else if (props.section === SECTION_PDF && pdfQueueRef.value) {
+      await pdfQueueRef.value.load();
+    }
   } catch (error) {
     assignError(error, "Unable to load admin data.");
-  } finally {
-    loading.value = false;
   }
 }
 
@@ -72,11 +58,9 @@ watch(() => props.section, loadSection);
       @dismiss-success="successMessage = null"
     />
 
-    <AsyncStateGate :loading="loading" :loading-lines="10" :show-empty="false">
-      <AdminUsersSection v-if="props.section === SECTION_USERS || props.section === SECTION_REPAIRS" v-show="props.section === SECTION_USERS" ref="usersRef" />
-      <AdminIntegritySection v-if="props.section === SECTION_INTEGRITY" ref="integrityRef" />
-      <AdminRepairsSection v-if="props.section === SECTION_REPAIRS" ref="repairsRef" :users="usersRef?.users ?? []" />
-      <AdminPdfQueueSection v-if="props.section === SECTION_PDF" ref="pdfQueueRef" />
-    </AsyncStateGate>
+    <AdminUsersSection v-if="props.section === SECTION_USERS || props.section === SECTION_REPAIRS" v-show="props.section === SECTION_USERS" ref="usersRef" />
+    <AdminIntegritySection v-if="props.section === SECTION_INTEGRITY" ref="integrityRef" />
+    <AdminRepairsSection v-if="props.section === SECTION_REPAIRS" ref="repairsRef" :users="usersRef?.users ?? []" />
+    <AdminPdfQueueSection v-if="props.section === SECTION_PDF" ref="pdfQueueRef" />
   </section>
 </template>
diff --git a/frontend/src/features/settings/components/AdminPdfQueueSection.vue b/frontend/src/features/settings/components/AdminPdfQueueSection.vue
index fdeb98a..91ec2a9 100644
--- a/frontend/src/features/settings/components/AdminPdfQueueSection.vue
+++ b/frontend/src/features/settings/components/AdminPdfQueueSection.vue
@@ -1,5 +1,6 @@
 <script setup lang="ts">
 import { computed, ref } from "vue";
+import { useAuthStore } from "@/stores/auth";
 import AppBadge from "@/components/ui/AppBadge.vue";
 import AppButton from "@/components/ui/AppButton.vue";
 import AppCard from "@/components/ui/AppCard.vue";
@@ -17,6 +18,7 @@ import {
 import { useRequestState } from "@/composables/useRequestState";
 
 const { errorMessage, errorRequestId, successMessage, clearAlerts, assignError, setSuccess } = useRequestState();
+const auth = useAuthStore();
 
 const refreshingPdfQueue = ref(false);
 const requeueingPublicationId = ref<number | null>(null);
@@ -162,7 +164,7 @@ defineExpose({ load });
           <option value="50">50 / page</option>
           <option value="100">100 / page</option>
         </AppSelect>
-        <AppButton variant="secondary" class="!min-h-8 whitespace-nowrap !px-2.5 !py-1 !text-xs" :disabled="requeueingAllPdfs" title="Queue all missing PDFs" @click="onRequeueAllPdfs">
+        <AppButton v-if="auth.isAdmin" variant="secondary" class="!min-h-8 whitespace-nowrap !px-2.5 !py-1 !text-xs" :disabled="requeueingAllPdfs" title="Queue all missing PDFs" @click="onRequeueAllPdfs">
           {{ requeueingAllPdfs ? "Queueing..." : "Queue all" }}
         </AppButton>
         <AppRefreshButton variant="secondary" size="sm" :loading="refreshingPdfQueue" title="Refresh PDF queue" loading-title="Refreshing PDF queue" @click="refreshPdfQueue" />
@@ -194,7 +196,7 @@ defineExpose({ load });
           <td>{{ formatTimestamp(item.last_attempt_at) }}</td>
           <td>{{ formatTimestamp(item.resolved_at) }}</td>
           <td>
-            <AppButton variant="ghost" :disabled="requeueingPublicationId === item.publication_id || !canRequeuePdf(item)" @click="onRequeuePdf(item)">
+            <AppButton v-if="auth.isAdmin" variant="ghost" :disabled="requeueingPublicationId === item.publication_id || !canRequeuePdf(item)" @click="onRequeuePdf(item)">
               {{ requeueingPublicationId === item.publication_id ? "Requeueing..." : "Requeue" }}
             </AppButton>
           </td>
diff --git a/frontend/src/pages/SettingsPage.vue b/frontend/src/pages/SettingsPage.vue
index 4040f0e..e1c0e2b 100644
--- a/frontend/src/pages/SettingsPage.vue
+++ b/frontend/src/pages/SettingsPage.vue
@@ -47,7 +47,7 @@ const savingScholarHttp = ref(false);
 const updatingPassword = ref(false);
 
 const autoRunEnabled = ref(false);
-const runIntervalMinutes = ref("60");
+const runIntervalHours = ref("1");
 const requestDelaySeconds = ref("2");
 const navVisiblePages = ref<string[]>([]);
 const openalexApiKey = ref("");
@@ -77,13 +77,13 @@ const tabItems = computed<AppTabItem[]>(() => {
   const tabs: AppTabItem[] = [
     { id: TAB_CHECKING, label: "Checking" },
     { id: TAB_ACCOUNT, label: "Account" },
+    { id: TAB_ADMIN_PDF, label: "PDF Queue" },
   ];
   if (auth.isAdmin) {
     tabs.push(
       { id: TAB_ADMIN_USERS, label: "Users" },
       { id: TAB_ADMIN_INTEGRITY, label: "Integrity" },
       { id: TAB_ADMIN_REPAIRS, label: "Repairs" },
-      { id: TAB_ADMIN_PDF, label: "PDF Queue" },
       { id: TAB_ADMIN_INTEGRATIONS, label: "Integrations" },
     );
   }
@@ -138,7 +138,7 @@ function hydrateSettings(settings: UserSettings): void {
   manualRunAllowed.value = Boolean(settings.policy?.manual_run_allowed ?? true);
 
   autoRunEnabled.value = Boolean(settings.auto_run_enabled) && automationAllowed.value;
-  runIntervalMinutes.value = String(settings.run_interval_minutes);
+  runIntervalHours.value = String(Number(settings.run_interval_minutes) / 60);
   requestDelaySeconds.value = String(settings.request_delay_seconds);
   navVisiblePages.value = normalizeUserNavVisiblePages(settings.nav_visible_pages);
 
@@ -168,6 +168,18 @@ function parseBoundedInteger(value: string, label: string, minimum: number): num
   return parsed;
 }
 
+function parseHoursToMinutes(value: string, minMinutes: number): number {
+  const hours = Number(value);
+  if (!Number.isFinite(hours) || hours <= 0) {
+    throw new Error("Check interval must be a positive number of hours.");
+  }
+  const minutes = Math.round(hours * 60);
+  if (minutes < minMinutes) {
+    throw new Error(`Check interval must be at least ${minMinutes / 60} hours.`);
+  }
+  return minutes;
+}
+
 async function loadSettings(): Promise<void> {
   loading.value = true;
   errorMessage.value = null;
@@ -225,9 +237,8 @@ async function onSaveSettings(): Promise<void> {
   try {
     const payload: UserSettingsUpdate = {
       auto_run_enabled: autoRunEnabled.value,
-      run_interval_minutes: parseBoundedInteger(
-        runIntervalMinutes.value,
-        "Check interval (minutes)",
+      run_interval_minutes: parseHoursToMinutes(
+        runIntervalHours.value,
         minCheckIntervalMinutes.value,
       ),
       request_delay_seconds: parseBoundedInteger(
@@ -357,11 +368,11 @@ onMounted(async () => {
 
             <label class="grid gap-2 text-sm font-medium text-ink-secondary">
               <span class="inline-flex items-center gap-1">
-                Check interval (minutes)
+                Check interval (hours)
                 <AppHelpHint text="Minimum is controlled by server policy." />
               </span>
-              <AppInput v-model="runIntervalMinutes" inputmode="numeric" />
-              <span class="text-xs text-secondary">Minimum: {{ minCheckIntervalMinutes }}</span>
+              <AppInput v-model="runIntervalHours" inputmode="decimal" />
+              <span class="text-xs text-secondary">Minimum: {{ minCheckIntervalMinutes / 60 }} hours</span>
             </label>
 
             <label class="grid gap-2 text-sm font-medium text-ink-secondary">

From 813da91608b4813568bc6923efc2b1a02bfd77a4 Mon Sep 17 00:00:00 2001
From: Justin Visser <justinfvisser@gmail.com>
Date: Sat, 7 Mar 2026 14:05:39 +0100
Subject: [PATCH 05/15] fix(scholars): improve validation, fix delete, add
 status badges

- Extract scholar ID parsing to dedicated module with robust URL
  handling (trailing slashes, fragments, extra query params, encoded
  characters) and per-token error feedback showing why each invalid
  entry was skipped
- Wrap delete_scholar DB commit in IntegrityError handler so cascade
  failures return a proper API error instead of 500
- Add ScholarStatusBadges component showing Pending/Failed/Partial/OK
  badges on scholar rows based on baseline_completed and last_run_status
- Show Pending badge in ScholarSettingsModal for unscraped scholars
- Surface failed_count and partial_count in dashboard latest run summary
  and recent run list items
- Extend backend validator tests with edge cases (empty, whitespace,
  unicode, URL-as-ID)
- Add integration tests for DELETE 404, DELETE with cascade, and POST
  with corrupted scholar_id
- Add comprehensive frontend tests for parsing logic and component
  behavior
---
 app/api/routers/scholars.py                   |  17 +-
 app/services/scholars/application.py          |   6 +-
 .../components/ScholarBatchAdd.test.ts        | 150 +++++++++++++++++-
 .../scholars/components/ScholarBatchAdd.vue   |  64 ++++----
 .../components/ScholarSettingsModal.vue       |   9 +-
 .../components/ScholarStatusBadges.vue        |  29 ++++
 .../components/scholar-batch-parsing.ts       |  76 +++++++++
 frontend/src/pages/DashboardPage.vue          |   8 +
 frontend/src/pages/ScholarsPage.vue           |  11 +-
 tests/integration/test_api_scholars.py        | 104 ++++++++++++
 tests/unit/test_scholar_validators.py         |  28 ++++
 11 files changed, 459 insertions(+), 43 deletions(-)
 create mode 100644 frontend/src/features/scholars/components/ScholarStatusBadges.vue
 create mode 100644 frontend/src/features/scholars/components/scholar-batch-parsing.ts

diff --git a/app/api/routers/scholars.py b/app/api/routers/scholars.py
index 7bbc642..ae3c522 100644
--- a/app/api/routers/scholars.py
+++ b/app/api/routers/scholars.py
@@ -261,11 +261,18 @@ async def delete_scholar(
             code="scholar_not_found",
             message="Scholar not found.",
         )
-    await scholar_service.delete_scholar(
-        db_session,
-        profile=profile,
-        upload_dir=settings.scholar_image_upload_dir,
-    )
+    try:
+        await scholar_service.delete_scholar(
+            db_session,
+            profile=profile,
+            upload_dir=settings.scholar_image_upload_dir,
+        )
+    except scholar_service.ScholarServiceError as exc:
+        raise ApiException(
+            status_code=409,
+            code="scholar_delete_failed",
+            message=str(exc),
+        ) from exc
     structured_log(
         logger, "info", "api.scholars.deleted", user_id=current_user.id, scholar_profile_id=scholar_profile_id
     )
diff --git a/app/services/scholars/application.py b/app/services/scholars/application.py
index 028e3fc..75f5e73 100644
--- a/app/services/scholars/application.py
+++ b/app/services/scholars/application.py
@@ -125,7 +125,11 @@ async def delete_scholar(
         _safe_remove_upload(upload_root, profile.profile_image_upload_path)
 
     await db_session.delete(profile)
-    await db_session.commit()
+    try:
+        await db_session.commit()
+    except IntegrityError as exc:
+        await db_session.rollback()
+        raise ScholarServiceError("Unable to delete scholar due to a database constraint.") from exc
 
 
 async def hydrate_profile_metadata(
diff --git a/frontend/src/features/scholars/components/ScholarBatchAdd.test.ts b/frontend/src/features/scholars/components/ScholarBatchAdd.test.ts
index 2d76eac..7b25632 100644
--- a/frontend/src/features/scholars/components/ScholarBatchAdd.test.ts
+++ b/frontend/src/features/scholars/components/ScholarBatchAdd.test.ts
@@ -2,10 +2,144 @@
 import { describe, expect, it } from "vitest";
 import { mount } from "@vue/test-utils";
 import ScholarBatchAdd from "./ScholarBatchAdd.vue";
+import {
+  parseScholarIds,
+  parseScholarTokens,
+  extractScholarIdFromUrl,
+  validateTokenAsId,
+} from "./scholar-batch-parsing";
 
 const defaultProps = { saving: false, loading: false };
 
-describe("ScholarBatchAdd", () => {
+describe("parseScholarIds (unit)", () => {
+  it("parses a single bare ID", () => {
+    expect(parseScholarIds("A-UbBTPM15wL")).toEqual(["A-UbBTPM15wL"]);
+  });
+
+  it("parses multiple IDs separated by commas", () => {
+    expect(parseScholarIds("A-UbBTPM15wL, B-UbBTPM15wL")).toEqual(["A-UbBTPM15wL", "B-UbBTPM15wL"]);
+  });
+
+  it("deduplicates IDs", () => {
+    expect(parseScholarIds("A-UbBTPM15wL\nA-UbBTPM15wL")).toEqual(["A-UbBTPM15wL"]);
+  });
+
+  it("extracts ID from standard Google Scholar URL", () => {
+    expect(parseScholarIds("https://scholar.google.com/citations?hl=en&user=A-UbBTPM15wL")).toEqual(["A-UbBTPM15wL"]);
+  });
+
+  it("extracts ID from URL with trailing slash", () => {
+    expect(parseScholarIds("https://scholar.google.com/citations?user=A-UbBTPM15wL/")).toEqual(["A-UbBTPM15wL"]);
+  });
+
+  it("extracts ID from URL with fragment", () => {
+    expect(parseScholarIds("https://scholar.google.com/citations?user=A-UbBTPM15wL#section")).toEqual(["A-UbBTPM15wL"]);
+  });
+
+  it("extracts ID from URL with extra query params", () => {
+    expect(parseScholarIds("https://scholar.google.com/citations?hl=en&user=A-UbBTPM15wL&view_op=list_works&sortby=pubdate")).toEqual(["A-UbBTPM15wL"]);
+  });
+
+  it("handles URL-encoded characters in non-ID parts", () => {
+    expect(parseScholarIds("https://scholar.google.com/citations?hl=en&user=A-UbBTPM15wL&label=%E4%B8%AD%E6%96%87")).toEqual(["A-UbBTPM15wL"]);
+  });
+
+  it("rejects malformed IDs (too short)", () => {
+    expect(parseScholarIds("ABC123")).toEqual([]);
+  });
+
+  it("rejects malformed IDs (too long)", () => {
+    expect(parseScholarIds("ABCDEF1234567")).toEqual([]);
+  });
+
+  it("rejects IDs with special characters", () => {
+    expect(parseScholarIds("ABCDEF12345!")).toEqual([]);
+  });
+
+  it("rejects IDs with embedded whitespace", () => {
+    expect(parseScholarIds("ABC DEF12345")).toEqual([]);
+  });
+
+  it("handles mixed valid and invalid tokens", () => {
+    expect(parseScholarIds("A-UbBTPM15wL, invalid, B-UbBTPM15wL")).toEqual(["A-UbBTPM15wL", "B-UbBTPM15wL"]);
+  });
+
+  it("returns empty array for empty string", () => {
+    expect(parseScholarIds("")).toEqual([]);
+  });
+
+  it("returns empty array for whitespace only", () => {
+    expect(parseScholarIds("   ")).toEqual([]);
+  });
+});
+
+describe("extractScholarIdFromUrl", () => {
+  it("returns null for non-URL strings", () => {
+    expect(extractScholarIdFromUrl("not-a-url")).toBeNull();
+  });
+
+  it("returns null for URL without user param", () => {
+    expect(extractScholarIdFromUrl("https://scholar.google.com/citations?hl=en")).toBeNull();
+  });
+
+  it("extracts from URL with trailing slashes", () => {
+    expect(extractScholarIdFromUrl("https://scholar.google.com/citations?user=A-UbBTPM15wL///")).toBe("A-UbBTPM15wL");
+  });
+
+  it("strips fragment before parsing", () => {
+    expect(extractScholarIdFromUrl("https://scholar.google.com/citations?user=A-UbBTPM15wL#foo")).toBe("A-UbBTPM15wL");
+  });
+
+  it("returns null when user param is invalid length", () => {
+    expect(extractScholarIdFromUrl("https://scholar.google.com/citations?user=short")).toBeNull();
+  });
+});
+
+describe("validateTokenAsId", () => {
+  it("returns null for valid 12-char ID", () => {
+    expect(validateTokenAsId("ABCDEF123456")).toBeNull();
+  });
+
+  it("detects wrong length", () => {
+    expect(validateTokenAsId("ABC")).toContain("12 characters");
+  });
+
+  it("detects invalid characters", () => {
+    expect(validateTokenAsId("ABCDEF12345!")).toContain("invalid characters");
+  });
+
+  it("detects whitespace", () => {
+    expect(validateTokenAsId("ABC DEF12345")).toContain("whitespace");
+  });
+
+  it("detects empty input", () => {
+    expect(validateTokenAsId("")).toContain("empty");
+  });
+});
+
+describe("parseScholarTokens (per-token errors)", () => {
+  it("marks invalid tokens with error messages", () => {
+    const tokens = parseScholarTokens("A-UbBTPM15wL, short, B-UbBTPM15wL");
+    expect(tokens).toHaveLength(3);
+    expect(tokens[0].id).toBe("A-UbBTPM15wL");
+    expect(tokens[0].error).toBeNull();
+    expect(tokens[1].id).toBeNull();
+    expect(tokens[1].error).toContain("12 characters");
+    expect(tokens[2].id).toBe("B-UbBTPM15wL");
+  });
+
+  it("marks duplicate tokens", () => {
+    const tokens = parseScholarTokens("A-UbBTPM15wL, A-UbBTPM15wL");
+    expect(tokens[1].error).toBe("duplicate");
+  });
+
+  it("marks bad URL tokens", () => {
+    const tokens = parseScholarTokens("https://scholar.google.com/citations?hl=en");
+    expect(tokens[0].error).toContain("could not extract");
+  });
+});
+
+describe("ScholarBatchAdd (component)", () => {
   it("renders the heading and input", () => {
     const wrapper = mount(ScholarBatchAdd, { props: defaultProps });
     expect(wrapper.text()).toContain("Add Scholar Profiles");
@@ -73,4 +207,18 @@ describe("ScholarBatchAdd", () => {
     const wrapper = mount(ScholarBatchAdd, { props: { ...defaultProps, saving: true } });
     expect(wrapper.text()).toContain("Adding...");
   });
+
+  it("shows validation errors for invalid tokens", async () => {
+    const wrapper = mount(ScholarBatchAdd, { props: defaultProps });
+    await wrapper.find("textarea").setValue("A-UbBTPM15wL, bad!");
+    const errors = wrapper.find("[data-testid='validation-errors']");
+    expect(errors.exists()).toBe(true);
+  });
+
+  it("shows skipped count alongside valid count", async () => {
+    const wrapper = mount(ScholarBatchAdd, { props: defaultProps });
+    await wrapper.find("textarea").setValue("A-UbBTPM15wL, tooshort");
+    expect(wrapper.text()).toContain("1 valid");
+    expect(wrapper.text()).toContain("1 skipped");
+  });
 });
diff --git a/frontend/src/features/scholars/components/ScholarBatchAdd.vue b/frontend/src/features/scholars/components/ScholarBatchAdd.vue
index bfafbda..60f89b9 100644
--- a/frontend/src/features/scholars/components/ScholarBatchAdd.vue
+++ b/frontend/src/features/scholars/components/ScholarBatchAdd.vue
@@ -3,6 +3,7 @@ import { computed, ref } from "vue";
 import AppButton from "@/components/ui/AppButton.vue";
 import AppCard from "@/components/ui/AppCard.vue";
 import AppHelpHint from "@/components/ui/AppHelpHint.vue";
+import { parseScholarTokens } from "./scholar-batch-parsing";
 
 defineProps<{
   saving: boolean;
@@ -15,38 +16,13 @@ const emit = defineEmits<{
 
 const scholarBatchInput = ref("");
 
-const SCHOLAR_ID_PATTERN = /^[a-zA-Z0-9_-]{12}$/;
-const URL_USER_PARAM_PATTERN = /(?:\?|&)user=([a-zA-Z0-9_-]{12})(?:&|#|$)/i;
-
-function parseScholarIds(raw: string): string[] {
-  const ordered: string[] = [];
-  const seen = new Set<string>();
-  const tokens = raw.split(/[\s,;]+/).map((v) => v.trim()).filter((v) => v.length > 0);
-  for (const token of tokens) {
-    let candidate: string | null = null;
-    if (SCHOLAR_ID_PATTERN.test(token)) candidate = token;
-    if (!candidate) {
-      const directParamMatch = token.match(URL_USER_PARAM_PATTERN);
-      if (directParamMatch) candidate = directParamMatch[1];
-    }
-    if (!candidate && token.includes("scholar.google")) {
-      try {
-        const parsed = new URL(token);
-        const userParam = parsed.searchParams.get("user");
-        if (userParam && SCHOLAR_ID_PATTERN.test(userParam)) candidate = userParam;
-      } catch (_error) { /* Ignore non-URL tokens. */ }
-    }
-    if (!candidate || seen.has(candidate)) continue;
-    seen.add(candidate);
-    ordered.push(candidate);
-  }
-  return ordered;
-}
-
-const parsedBatchCount = computed(() => parseScholarIds(scholarBatchInput.value).length);
+const parsedTokens = computed(() => parseScholarTokens(scholarBatchInput.value));
+const validIds = computed(() => parsedTokens.value.filter((t) => t.id !== null));
+const invalidTokens = computed(() => parsedTokens.value.filter((t) => t.id === null));
+const parsedBatchCount = computed(() => validIds.value.length);
 
 function onSubmit(): void {
-  const ids = parseScholarIds(scholarBatchInput.value);
+  const ids = validIds.value.map((t) => t.id!);
   if (ids.length > 0) {
     emit("add-scholars", ids);
     scholarBatchInput.value = "";
@@ -76,11 +52,33 @@ function onSubmit(): void {
         />
       </label>
 
-      <div class="flex flex-wrap items-center justify-between gap-2">
+      <div v-if="parsedTokens.length > 0" class="space-y-1">
         <p class="text-xs text-secondary">
-          Parsed IDs: <strong class="text-ink-primary">{{ parsedBatchCount }}</strong>
+          <strong class="text-ink-primary">{{ parsedBatchCount }}</strong> valid ID{{ parsedBatchCount === 1 ? "" : "s" }}
+          <template v-if="invalidTokens.length > 0">
+            · <span class="text-state-warning-text">{{ invalidTokens.length }} skipped</span>
+          </template>
         </p>
-        <AppButton type="submit" :disabled="saving || loading">
+        <ul v-if="invalidTokens.length > 0" class="space-y-0.5" data-testid="validation-errors">
+          <li
+            v-for="item in invalidTokens.slice(0, 5)"
+            :key="item.index"
+            class="text-xs text-state-warning-text"
+          >
+            #{{ item.index }}: {{ item.error }}
+            <code class="ml-1 break-all text-ink-muted">{{ item.raw.length > 60 ? item.raw.slice(0, 57) + "..." : item.raw }}</code>
+          </li>
+          <li v-if="invalidTokens.length > 5" class="text-xs text-state-warning-text">
+            +{{ invalidTokens.length - 5 }} more skipped
+          </li>
+        </ul>
+      </div>
+      <div v-else class="text-xs text-secondary">
+        Parsed IDs: <strong class="text-ink-primary">0</strong>
+      </div>
+
+      <div class="flex flex-wrap items-center justify-end gap-2">
+        <AppButton type="submit" :disabled="saving || loading || parsedBatchCount === 0">
           {{ saving ? "Adding..." : "Add scholars" }}
         </AppButton>
       </div>
diff --git a/frontend/src/features/scholars/components/ScholarSettingsModal.vue b/frontend/src/features/scholars/components/ScholarSettingsModal.vue
index 4a129f8..511bf66 100644
--- a/frontend/src/features/scholars/components/ScholarSettingsModal.vue
+++ b/frontend/src/features/scholars/components/ScholarSettingsModal.vue
@@ -47,7 +47,14 @@ function scholarPublicationsRoute(profile: ScholarProfile): { name: string; quer
           :image-url="scholar.profile_image_url"
         />
         <div class="min-w-0 space-y-1">
-          <p class="truncate text-sm font-semibold text-ink-primary">{{ scholarLabel(scholar) }}</p>
+          <p class="truncate text-sm font-semibold text-ink-primary">
+            {{ scholarLabel(scholar) }}
+            <span
+              v-if="!scholar.baseline_completed"
+              class="ml-1.5 inline-flex items-center rounded-full bg-amber-50 px-1.5 py-0.5 text-[10px] font-medium text-amber-700 ring-1 ring-inset ring-amber-600/20 dark:bg-amber-950 dark:text-amber-400 dark:ring-amber-400/20"
+              title="This scholar hasn't been scraped yet. Publications will appear after the next run."
+            >Pending</span>
+          </p>
           <p class="text-xs text-secondary">ID: <code>{{ scholar.scholar_id }}</code></p>
           <div class="flex flex-wrap items-center gap-3">
             <RouterLink :to="scholarPublicationsRoute(scholar)" class="link-inline text-xs">
diff --git a/frontend/src/features/scholars/components/ScholarStatusBadges.vue b/frontend/src/features/scholars/components/ScholarStatusBadges.vue
new file mode 100644
index 0000000..5460658
--- /dev/null
+++ b/frontend/src/features/scholars/components/ScholarStatusBadges.vue
@@ -0,0 +1,29 @@
+<script setup lang="ts">
+defineProps<{
+  baselineCompleted: boolean;
+  lastRunStatus: string | null;
+}>();
+</script>
+
+<template>
+  <span
+    v-if="!baselineCompleted"
+    class="ml-1.5 inline-flex items-center rounded-full bg-amber-50 px-1.5 py-0.5 text-[10px] font-medium text-amber-700 ring-1 ring-inset ring-amber-600/20 dark:bg-amber-950 dark:text-amber-400 dark:ring-amber-400/20"
+    title="This scholar hasn't been scraped yet. Publications will appear after the next run."
+  >Pending</span>
+  <span
+    v-if="lastRunStatus === 'failed'"
+    class="ml-1.5 inline-flex items-center rounded-full bg-red-50 px-1.5 py-0.5 text-[10px] font-medium text-red-700 ring-1 ring-inset ring-red-600/20 dark:bg-red-950 dark:text-red-400 dark:ring-red-400/20"
+    title="The last scrape run for this scholar failed."
+  >Failed</span>
+  <span
+    v-else-if="lastRunStatus === 'partial'"
+    class="ml-1.5 inline-flex items-center rounded-full bg-amber-50 px-1.5 py-0.5 text-[10px] font-medium text-amber-700 ring-1 ring-inset ring-amber-600/20 dark:bg-amber-950 dark:text-amber-400 dark:ring-amber-400/20"
+    title="The last scrape run for this scholar completed with partial results."
+  >Partial</span>
+  <span
+    v-else-if="lastRunStatus === 'success'"
+    class="ml-1.5 inline-flex items-center rounded-full bg-green-50 px-1.5 py-0.5 text-[10px] font-medium text-green-700 ring-1 ring-inset ring-green-600/20 dark:bg-green-950 dark:text-green-400 dark:ring-green-400/20"
+    title="The last scrape run for this scholar completed successfully."
+  >OK</span>
+</template>
diff --git a/frontend/src/features/scholars/components/scholar-batch-parsing.ts b/frontend/src/features/scholars/components/scholar-batch-parsing.ts
new file mode 100644
index 0000000..45baba7
--- /dev/null
+++ b/frontend/src/features/scholars/components/scholar-batch-parsing.ts
@@ -0,0 +1,76 @@
+const SCHOLAR_ID_PATTERN = /^[a-zA-Z0-9_-]{12}$/;
+
+export interface ParsedToken {
+  index: number;
+  raw: string;
+  id: string | null;
+  error: string | null;
+}
+
+export function extractScholarIdFromUrl(token: string): string | null {
+  const cleaned = token.replace(/\/+$/, "").replace(/#.*$/, "");
+  try {
+    const parsed = new URL(cleaned);
+    const userParam = parsed.searchParams.get("user");
+    if (!userParam) return null;
+    const decoded = decodeURIComponent(userParam).trim();
+    if (SCHOLAR_ID_PATTERN.test(decoded)) return decoded;
+    return null;
+  } catch {
+    return null;
+  }
+}
+
+export function validateTokenAsId(token: string): string | null {
+  const trimmed = token.trim();
+  if (!trimmed) return "empty input";
+  if (/\s/.test(trimmed)) return "contains whitespace";
+  if (trimmed.length !== 12) return `must be 12 characters (got ${trimmed.length})`;
+  if (!/^[a-zA-Z0-9_-]+$/.test(trimmed)) {
+    return "contains invalid characters (only a-z, A-Z, 0-9, _ and - allowed)";
+  }
+  return null;
+}
+
+export function parseScholarTokens(raw: string): ParsedToken[] {
+  const tokens = raw.split(/[\s,;]+/).map((v) => v.trim()).filter((v) => v.length > 0);
+  const results: ParsedToken[] = [];
+  const seen = new Set<string>();
+
+  for (let i = 0; i < tokens.length; i++) {
+    const token = tokens[i];
+
+    if (SCHOLAR_ID_PATTERN.test(token)) {
+      if (seen.has(token)) {
+        results.push({ index: i + 1, raw: token, id: null, error: "duplicate" });
+        continue;
+      }
+      seen.add(token);
+      results.push({ index: i + 1, raw: token, id: token, error: null });
+      continue;
+    }
+
+    if (token.includes("scholar.google") || token.startsWith("http")) {
+      const extracted = extractScholarIdFromUrl(token);
+      if (extracted) {
+        if (seen.has(extracted)) {
+          results.push({ index: i + 1, raw: token, id: null, error: "duplicate" });
+          continue;
+        }
+        seen.add(extracted);
+        results.push({ index: i + 1, raw: token, id: extracted, error: null });
+        continue;
+      }
+      results.push({ index: i + 1, raw: token, id: null, error: "could not extract scholar ID from URL" });
+      continue;
+    }
+
+    const reason = validateTokenAsId(token);
+    results.push({ index: i + 1, raw: token, id: null, error: reason ?? "invalid scholar ID" });
+  }
+  return results;
+}
+
+export function parseScholarIds(raw: string): string[] {
+  return parseScholarTokens(raw).filter((t) => t.id !== null).map((t) => t.id!);
+}
diff --git a/frontend/src/pages/DashboardPage.vue b/frontend/src/pages/DashboardPage.vue
index c7da221..3f7df35 100644
--- a/frontend/src/pages/DashboardPage.vue
+++ b/frontend/src/pages/DashboardPage.vue
@@ -494,6 +494,11 @@ watch(
                       <template v-else>
                         Processed {{ displayedLatestRun.scholar_count }} scholars and discovered
                         {{ displayedLatestRun.new_publication_count }} new publications.
+                        <template v-if="displayedLatestRun.failed_count > 0 || displayedLatestRun.partial_count > 0">
+                          <span class="text-state-warning-text">
+                            {{ displayedLatestRun.failed_count > 0 ? `${displayedLatestRun.failed_count} failed` : "" }}{{ displayedLatestRun.failed_count > 0 && displayedLatestRun.partial_count > 0 ? ", " : "" }}{{ displayedLatestRun.partial_count > 0 ? `${displayedLatestRun.partial_count} partial` : "" }}.
+                          </span>
+                        </template>
                       </template>
                     </p>
                   </div>
@@ -527,6 +532,9 @@ watch(
                         </div>
                         <span class="text-xs text-secondary">
                           {{ formatDate(run.start_dt) }} • {{ run.new_publication_count }} new
+                          <template v-if="run.failed_count > 0">
+                            • <span class="text-state-warning-text">{{ run.failed_count }} failed</span>
+                          </template>
                         </span>
                       </li>
                     </ul>
diff --git a/frontend/src/pages/ScholarsPage.vue b/frontend/src/pages/ScholarsPage.vue
index 16b2a96..29541d9 100644
--- a/frontend/src/pages/ScholarsPage.vue
+++ b/frontend/src/pages/ScholarsPage.vue
@@ -31,6 +31,7 @@ import ScholarAvatar from "@/features/scholars/components/ScholarAvatar.vue";
 import ScholarBatchAdd from "@/features/scholars/components/ScholarBatchAdd.vue";
 import ScholarNameSearch from "@/features/scholars/components/ScholarNameSearch.vue";
 import ScholarSettingsModal from "@/features/scholars/components/ScholarSettingsModal.vue";
+import ScholarStatusBadges from "@/features/scholars/components/ScholarStatusBadges.vue";
 import { ApiRequestError } from "@/lib/api/errors";
 import { useRunStatusStore } from "@/stores/run_status";
 
@@ -505,7 +506,10 @@ watch(
                     <div class="flex items-start gap-3">
                       <ScholarAvatar :label="item.display_name" :scholar-id="item.scholar_id" :image-url="item.profile_image_url" />
                       <div class="min-w-0 flex-1 space-y-1">
-                        <p class="truncate text-sm font-semibold text-ink-primary">{{ scholarLabel(item) }}</p>
+                        <p class="truncate text-sm font-semibold text-ink-primary">
+                          {{ scholarLabel(item) }}
+                          <ScholarStatusBadges :baseline-completed="item.baseline_completed" :last-run-status="item.last_run_status" />
+                        </p>
                         <div class="flex flex-wrap items-center gap-3">
                           <RouterLink :to="scholarPublicationsRoute(item)" class="link-inline text-xs">Publications</RouterLink>
                           <a :href="scholarProfileUrl(item.scholar_id)" target="_blank" rel="noreferrer" class="link-inline text-xs">Open profile</a>
@@ -529,7 +533,10 @@ watch(
                           <div class="flex items-start gap-3">
                             <ScholarAvatar :label="item.display_name" :scholar-id="item.scholar_id" :image-url="item.profile_image_url" />
                             <div class="grid min-w-0 gap-1">
-                              <strong class="truncate text-ink-primary">{{ scholarLabel(item) }}</strong>
+                              <strong class="truncate text-ink-primary">
+                                {{ scholarLabel(item) }}
+                                <ScholarStatusBadges :baseline-completed="item.baseline_completed" :last-run-status="item.last_run_status" />
+                              </strong>
                               <div class="flex flex-wrap items-center gap-3">
                                 <RouterLink :to="scholarPublicationsRoute(item)" class="link-inline text-xs">Publications</RouterLink>
                                 <a :href="scholarProfileUrl(item.scholar_id)" target="_blank" rel="noreferrer" class="link-inline text-xs">Open profile</a>
diff --git a/tests/integration/test_api_scholars.py b/tests/integration/test_api_scholars.py
index 0d6f3a0..1fd8ba9 100644
--- a/tests/integration/test_api_scholars.py
+++ b/tests/integration/test_api_scholars.py
@@ -70,6 +70,110 @@ async def test_api_scholars_crud_flow(db_session: AsyncSession) -> None:
     assert delete_response.json()["data"]["message"] == "Scholar deleted."
 
 
+@pytest.mark.integration
+@pytest.mark.db
+@pytest.mark.asyncio
+async def test_api_delete_scholar_returns_404_for_nonexistent(db_session: AsyncSession) -> None:
+    await insert_user(
+        db_session,
+        email="api-delete-404@example.com",
+        password="api-password",
+    )
+
+    client = TestClient(app)
+    login_user(client, email="api-delete-404@example.com", password="api-password")
+    headers = api_csrf_headers(client)
+
+    response = client.delete("/api/v1/scholars/999999", headers=headers)
+    assert response.status_code == 404
+    assert response.json()["error"]["code"] == "scholar_not_found"
+
+
+@pytest.mark.integration
+@pytest.mark.db
+@pytest.mark.asyncio
+async def test_api_delete_scholar_cascades_linked_publications(db_session: AsyncSession) -> None:
+    user_id = await insert_user(
+        db_session,
+        email="api-delete-cascade@example.com",
+        password="api-password",
+    )
+    scholar_result = await db_session.execute(
+        text(
+            """
+            INSERT INTO scholar_profiles (user_id, scholar_id, display_name, is_enabled)
+            VALUES (:user_id, :scholar_id, :display_name, true)
+            RETURNING id
+            """
+        ),
+        {"user_id": user_id, "scholar_id": "delCASCADE01", "display_name": "Cascade Test"},
+    )
+    scholar_profile_id = int(scholar_result.scalar_one())
+    pub_result = await db_session.execute(
+        text(
+            """
+            INSERT INTO publications (fingerprint_sha256, title_raw, title_normalized, citation_count)
+            VALUES (:fingerprint, :title_raw, :title_normalized, 0)
+            RETURNING id
+            """
+        ),
+        {
+            "fingerprint": f"{(user_id + 7000):064x}",
+            "title_raw": "Cascade Publication",
+            "title_normalized": "cascadepublication",
+        },
+    )
+    publication_id = int(pub_result.scalar_one())
+    await db_session.execute(
+        text(
+            """
+            INSERT INTO scholar_publications (scholar_profile_id, publication_id, is_read)
+            VALUES (:scholar_profile_id, :publication_id, false)
+            """
+        ),
+        {"scholar_profile_id": scholar_profile_id, "publication_id": publication_id},
+    )
+    await db_session.commit()
+
+    client = TestClient(app)
+    login_user(client, email="api-delete-cascade@example.com", password="api-password")
+    headers = api_csrf_headers(client)
+
+    delete_response = client.delete(f"/api/v1/scholars/{scholar_profile_id}", headers=headers)
+    assert delete_response.status_code == 200
+    assert delete_response.json()["data"]["message"] == "Scholar deleted."
+
+    link_result = await db_session.execute(
+        text("SELECT count(*) FROM scholar_publications WHERE scholar_profile_id = :id"),
+        {"id": scholar_profile_id},
+    )
+    assert int(link_result.scalar_one()) == 0
+
+
+@pytest.mark.integration
+@pytest.mark.db
+@pytest.mark.asyncio
+async def test_api_create_scholar_rejects_corrupted_id(db_session: AsyncSession) -> None:
+    await insert_user(
+        db_session,
+        email="api-bad-id@example.com",
+        password="api-password",
+    )
+
+    client = TestClient(app)
+    login_user(client, email="api-bad-id@example.com", password="api-password")
+    headers = api_csrf_headers(client)
+
+    for bad_id in ["short", "ABCDEF12345!", "", "   ", "AB CD EF1234"]:
+        response = client.post(
+            "/api/v1/scholars",
+            json={"scholar_id": bad_id},
+            headers=headers,
+        )
+        assert response.status_code == 400, f"Expected 400 for scholar_id={bad_id!r}"
+        assert response.json()["error"]["code"] == "invalid_scholar"
+
+
 @pytest.mark.integration
 @pytest.mark.db
 @pytest.mark.asyncio
diff --git a/tests/unit/test_scholar_validators.py b/tests/unit/test_scholar_validators.py
index 460b315..185d805 100644
--- a/tests/unit/test_scholar_validators.py
+++ b/tests/unit/test_scholar_validators.py
@@ -42,6 +42,34 @@ class TestValidateScholarId:
         with pytest.raises(ScholarServiceError, match="12"):
             validate_scholar_id("ABCDEF12345!")
 
+    def test_rejects_empty_string(self) -> None:
+        with pytest.raises(ScholarServiceError, match="12"):
+            validate_scholar_id("")
+
+    def test_rejects_whitespace_only(self) -> None:
+        with pytest.raises(ScholarServiceError, match="12"):
+            validate_scholar_id("   ")
+
+    def test_rejects_embedded_spaces(self) -> None:
+        with pytest.raises(ScholarServiceError, match="12"):
+            validate_scholar_id("ABCDEF 12345")
+
+    def test_rejects_tab_characters(self) -> None:
+        with pytest.raises(ScholarServiceError, match="12"):
+            validate_scholar_id("ABCDEF\t12345")
+
+    def test_rejects_url_as_id(self) -> None:
+        with pytest.raises(ScholarServiceError, match="12"):
+            validate_scholar_id("https://scholar.google.com/citations?user=ABCDEF123456")
+
+    def test_rejects_newline_in_id(self) -> None:
+        with pytest.raises(ScholarServiceError, match="12"):
+            validate_scholar_id("ABCDEF\n12345")
+
+    def test_rejects_unicode_characters(self) -> None:
+        with pytest.raises(ScholarServiceError, match="12"):
+            validate_scholar_id("ABCDEF12345\u00e9")
+
 
 class TestNormalizeDisplayName:
     def test_returns_stripped_name(self) -> None:

From afbb25d2178ce99d6659ef90ff9d35a2e2900bd7 Mon Sep 17 00:00:00 2001
From: Justin Visser <justinfvisser@gmail.com>
Date: Sat, 7 Mar 2026 15:32:22 +0100
Subject: [PATCH 06/15] fix(ci): use theme tokens for badges, update pdf-queue
 test

- Replace raw dark: utility variants with state-* theme tokens
  in ScholarStatusBadges and ScholarSettingsModal
- Update integration test to expect 200 for pdf-queue listing
  (endpoint now uses get_api_current_user, not admin-only)
---
 .../features/scholars/components/ScholarSettingsModal.vue | 2 +-
 .../features/scholars/components/ScholarStatusBadges.vue  | 8 ++++----
 tests/integration/test_api_admin.py                       | 7 ++++---
 3 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/frontend/src/features/scholars/components/ScholarSettingsModal.vue b/frontend/src/features/scholars/components/ScholarSettingsModal.vue
index 511bf66..77af0ac 100644
--- a/frontend/src/features/scholars/components/ScholarSettingsModal.vue
+++ b/frontend/src/features/scholars/components/ScholarSettingsModal.vue
@@ -51,7 +51,7 @@ function scholarPublicationsRoute(profile: ScholarProfile): { name: string; quer
             {{ scholarLabel(scholar) }}
             <span
               v-if="!scholar.baseline_completed"
-              class="ml-1.5 inline-flex items-center rounded-full bg-amber-50 px-1.5 py-0.5 text-[10px] font-medium text-amber-700 ring-1 ring-inset ring-amber-600/20 dark:bg-amber-950 dark:text-amber-400 dark:ring-amber-400/20"
+              class="ml-1.5 inline-flex items-center rounded-full border border-state-warning-border bg-state-warning-bg px-1.5 py-0.5 text-[10px] font-medium text-state-warning-text"
               title="This scholar hasn't been scraped yet. Publications will appear after the next run."
             >Pending</span>
           </p>
diff --git a/frontend/src/features/scholars/components/ScholarStatusBadges.vue b/frontend/src/features/scholars/components/ScholarStatusBadges.vue
index 5460658..86b2cd5 100644
--- a/frontend/src/features/scholars/components/ScholarStatusBadges.vue
+++ b/frontend/src/features/scholars/components/ScholarStatusBadges.vue
@@ -8,22 +8,22 @@ defineProps<{
 <template>
   <span
     v-if="!baselineCompleted"
-    class="ml-1.5 inline-flex items-center rounded-full bg-amber-50 px-1.5 py-0.5 text-[10px] font-medium text-amber-700 ring-1 ring-inset ring-amber-600/20 dark:bg-amber-950 dark:text-amber-400 dark:ring-amber-400/20"
+    class="ml-1.5 inline-flex items-center rounded-full border border-state-warning-border bg-state-warning-bg px-1.5 py-0.5 text-[10px] font-medium text-state-warning-text"
     title="This scholar hasn't been scraped yet. Publications will appear after the next run."
   >Pending</span>
   <span
     v-if="lastRunStatus === 'failed'"
-    class="ml-1.5 inline-flex items-center rounded-full bg-red-50 px-1.5 py-0.5 text-[10px] font-medium text-red-700 ring-1 ring-inset ring-red-600/20 dark:bg-red-950 dark:text-red-400 dark:ring-red-400/20"
+    class="ml-1.5 inline-flex items-center rounded-full border border-state-danger-border bg-state-danger-bg px-1.5 py-0.5 text-[10px] font-medium text-state-danger-text"
     title="The last scrape run for this scholar failed."
   >Failed</span>
   <span
     v-else-if="lastRunStatus === 'partial'"
-    class="ml-1.5 inline-flex items-center rounded-full bg-amber-50 px-1.5 py-0.5 text-[10px] font-medium text-amber-700 ring-1 ring-inset ring-amber-600/20 dark:bg-amber-950 dark:text-amber-400 dark:ring-amber-400/20"
+    class="ml-1.5 inline-flex items-center rounded-full border border-state-warning-border bg-state-warning-bg px-1.5 py-0.5 text-[10px] font-medium text-state-warning-text"
     title="The last scrape run for this scholar completed with partial results."
   >Partial</span>
   <span
     v-else-if="lastRunStatus === 'success'"
-    class="ml-1.5 inline-flex items-center rounded-full bg-green-50 px-1.5 py-0.5 text-[10px] font-medium text-green-700 ring-1 ring-inset ring-green-600/20 dark:bg-green-950 dark:text-green-400 dark:ring-green-400/20"
+    class="ml-1.5 inline-flex items-center rounded-full border border-state-success-border bg-state-success-bg px-1.5 py-0.5 text-[10px] font-medium text-state-success-text"
     title="The last scrape run for this scholar completed successfully."
   >OK</span>
 </template>
diff --git a/tests/integration/test_api_admin.py b/tests/integration/test_api_admin.py
index fb63f34..f80a8e3 100644
--- a/tests/integration/test_api_admin.py
+++ b/tests/integration/test_api_admin.py
@@ -340,10 +340,11 @@ async def test_api_admin_dbops_forbidden_for_non_admin_and_validates_scope(db_se
     assert forbidden_integrity.status_code == 403
     assert forbidden_integrity.json()["error"]["code"] == "forbidden"
 
-    forbidden_pdf_queue = client.get("/api/v1/admin/db/pdf-queue")
-    assert forbidden_pdf_queue.status_code == 403
-    assert forbidden_pdf_queue.json()["error"]["code"] == "forbidden"
+    # PDF queue listing is accessible to all authenticated users (not admin-only).
+    allowed_pdf_queue = client.get("/api/v1/admin/db/pdf-queue")
+    assert allowed_pdf_queue.status_code == 200
 
+    # But requeue actions still require admin.
     forbidden_requeue = client.post(
         "/api/v1/admin/db/pdf-queue/1/requeue",
         headers=headers,

From 61ac6f206fbfd30cb2deebb572c51b350a248c31 Mon Sep 17 00:00:00 2001
From: Justin Visser <justinfvisser@gmail.com>
Date: Sat, 7 Mar 2026 15:51:48 +0100
Subject: [PATCH 07/15] fix(test): add Pinia setup and admin user to
 AdminPdfQueueSection tests

The component uses useAuthStore() which requires an active Pinia
instance, and the "Queue all" button is admin-only (v-if="auth.isAdmin").
---
 .../settings/components/AdminPdfQueueSection.test.ts         | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/frontend/src/features/settings/components/AdminPdfQueueSection.test.ts b/frontend/src/features/settings/components/AdminPdfQueueSection.test.ts
index bdd0793..c312922 100644
--- a/frontend/src/features/settings/components/AdminPdfQueueSection.test.ts
+++ b/frontend/src/features/settings/components/AdminPdfQueueSection.test.ts
@@ -1,6 +1,8 @@
 // @vitest-environment happy-dom
 import { describe, expect, it, vi, beforeEach } from "vitest";
 import { mount, flushPromises } from "@vue/test-utils";
+import { setActivePinia, createPinia } from "pinia";
+import { useAuthStore } from "@/stores/auth";
 import AdminPdfQueueSection from "./AdminPdfQueueSection.vue";
 
 vi.mock("@/features/admin_dbops", () => ({
@@ -36,6 +38,9 @@ function buildQueueItem(overrides: Record<string, unknown> = {}) {
 
 describe("AdminPdfQueueSection", () => {
   beforeEach(() => {
+    setActivePinia(createPinia());
+    const auth = useAuthStore();
+    auth.$patch({ state: "authenticated", user: { id: 1, email: "admin@test.com", is_admin: true, is_active: true } });
     mockedListQueue.mockReset();
   });
 

From 6742eff773d1a5a27e32aacafaedc3313ae9b70e Mon Sep 17 00:00:00 2001
From: Justin Visser <justinfvisser@gmail.com>
Date: Sat, 7 Mar 2026 14:03:06 +0100
Subject: [PATCH 08/15] feat(scholars): add multiselect and bulk actions
 (delete, toggle, export)

Add Set<number>-based selection state to ScholarsPage with checkboxes
in both table and card views, select-all toggle, and stale-key pruning.

Backend: POST /scholars/bulk-delete, POST /scholars/bulk-toggle, and
GET /scholars/export?ids= filter. Service functions use user-scoped
queries. Structured logging for bulk operations.

Frontend: useScholarBulkActions composable extracts selection and bulk
action logic. AppSelect-based action dropdown with dynamic options.
Delete prompts window.confirm; enable/disable applies immediately.
Export downloads filtered JSON.

Includes integration tests for all bulk endpoints and frontend unit
tests for selection toggle, select-all, and stale pruning.
---
 app/api/routers/scholars.py                   |  66 ++++++
 app/api/schemas/scholars.py                   |  27 +++
 app/services/portability/exporting.py         |  18 +-
 app/services/scholars/application.py          |  51 +++++
 .../composables/useScholarBulkActions.test.ts | 112 ++++++++++
 .../composables/useScholarBulkActions.ts      | 195 ++++++++++++++++++
 frontend/src/features/scholars/index.ts       |  26 ++-
 frontend/src/pages/ScholarsPage.vue           | 174 +++++++++-------
 tests/integration/test_api_scholars_bulk.py   | 140 +++++++++++++
 9 files changed, 730 insertions(+), 79 deletions(-)
 create mode 100644 frontend/src/features/scholars/composables/useScholarBulkActions.test.ts
 create mode 100644 frontend/src/features/scholars/composables/useScholarBulkActions.ts
 create mode 100644 tests/integration/test_api_scholars_bulk.py

diff --git a/app/api/routers/scholars.py b/app/api/routers/scholars.py
index ae3c522..85c4b99 100644
--- a/app/api/routers/scholars.py
+++ b/app/api/routers/scholars.py
@@ -23,6 +23,9 @@ from app.api.schemas import (
     DataImportEnvelope,
     DataImportRequest,
     MessageEnvelope,
+    ScholarBulkCountEnvelope,
+    ScholarBulkIdsRequest,
+    ScholarBulkToggleRequest,
     ScholarCreateRequest,
     ScholarEnvelope,
     ScholarImageUrlUpdateRequest,
@@ -42,6 +45,15 @@ logger = logging.getLogger(__name__)
 router = APIRouter(prefix="/scholars", tags=["api-scholars"])
 
 
+def _parse_ids_param(ids: str | None) -> list[int] | None:
+    if not ids:
+        return None
+    parts = [p.strip() for p in ids.split(",") if p.strip()]
+    if not parts:
+        return None
+    return [int(p) for p in parts]
+
+
 @router.get(
     "",
     response_model=ScholarsListEnvelope,
@@ -69,16 +81,70 @@ async def list_scholars(
 )
 async def export_scholars_and_publications(
     request: Request,
+    ids: str | None = Query(None, description="Comma-separated scholar profile IDs to export"),
     db_session: AsyncSession = Depends(get_db_session),
     current_user: User = Depends(get_api_current_user),
 ):
+    scholar_profile_ids = _parse_ids_param(ids)
     data = await import_export_service.export_user_data(
         db_session,
         user_id=current_user.id,
+        scholar_profile_ids=scholar_profile_ids,
     )
     return success_payload(request, data=data)
 
 
+@router.post(
+    "/bulk-delete",
+    response_model=ScholarBulkCountEnvelope,
+)
+async def bulk_delete_scholars(
+    payload: ScholarBulkIdsRequest,
+    request: Request,
+    db_session: AsyncSession = Depends(get_db_session),
+    current_user: User = Depends(get_api_current_user),
+):
+    deleted_count = await scholar_service.bulk_delete_scholars(
+        db_session,
+        user_id=current_user.id,
+        scholar_profile_ids=payload.scholar_profile_ids,
+        upload_dir=settings.scholar_image_upload_dir,
+    )
+    structured_log(
+        logger, "info", "scholars.bulk_delete",
+        user_id=current_user.id,
+        requested_ids=payload.scholar_profile_ids,
+        deleted_count=deleted_count,
+    )
+    return success_payload(request, data={"deleted_count": deleted_count, "updated_count": 0})
+
+
+@router.post(
+    "/bulk-toggle",
+    response_model=ScholarBulkCountEnvelope,
+)
+async def bulk_toggle_scholars(
+    payload: ScholarBulkToggleRequest,
+    request: Request,
+    db_session: AsyncSession = Depends(get_db_session),
+    current_user: User = Depends(get_api_current_user),
+):
+    updated_count = await scholar_service.bulk_toggle_scholars(
+        db_session,
+        user_id=current_user.id,
+        scholar_profile_ids=payload.scholar_profile_ids,
+        is_enabled=payload.is_enabled,
+    )
+    structured_log(
+        logger, "info", "scholars.bulk_toggle",
+        user_id=current_user.id,
+        requested_ids=payload.scholar_profile_ids,
+        is_enabled=payload.is_enabled,
+        updated_count=updated_count,
+    )
+    return success_payload(request, data={"deleted_count": 0, "updated_count": updated_count})
+
+
 @router.post(
     "/import",
     response_model=DataImportEnvelope,
diff --git a/app/api/schemas/scholars.py b/app/api/schemas/scholars.py
index 91cc459..bc1035d 100644
--- a/app/api/schemas/scholars.py
+++ b/app/api/schemas/scholars.py
@@ -126,6 +126,33 @@ class DataExportEnvelope(BaseModel):
     model_config = ConfigDict(extra="forbid")
 
 
+class ScholarBulkIdsRequest(BaseModel):
+    scholar_profile_ids: list[int] = Field(..., min_length=1, max_length=500)
+
+    model_config = ConfigDict(extra="forbid")
+
+
+class ScholarBulkToggleRequest(BaseModel):
+    scholar_profile_ids: list[int] = Field(..., min_length=1, max_length=500)
+    is_enabled: bool
+
+    model_config = ConfigDict(extra="forbid")
+
+
+class ScholarBulkCountData(BaseModel):
+    deleted_count: int = 0
+    updated_count: int = 0
+
+    model_config = ConfigDict(extra="forbid")
+
+
+class ScholarBulkCountEnvelope(BaseModel):
+    data: ScholarBulkCountData
+    meta: ApiMeta
+
+    model_config = ConfigDict(extra="forbid")
+
+
 class DataImportRequest(BaseModel):
     schema_version: int | None = None
     exported_at: str | None = None
diff --git a/app/services/portability/exporting.py b/app/services/portability/exporting.py
index 0589498..a11eaef 100644
--- a/app/services/portability/exporting.py
+++ b/app/services/portability/exporting.py
@@ -56,11 +56,14 @@ async def export_user_data(
     db_session: AsyncSession,
     *,
     user_id: int,
+    scholar_profile_ids: list[int] | None = None,
 ) -> dict[str, Any]:
-    scholars_result = await db_session.execute(
-        select(ScholarProfile).where(ScholarProfile.user_id == user_id).order_by(ScholarProfile.id.asc())
-    )
-    publication_result = await db_session.execute(
+    scholar_query = select(ScholarProfile).where(ScholarProfile.user_id == user_id)
+    if scholar_profile_ids:
+        scholar_query = scholar_query.where(ScholarProfile.id.in_(scholar_profile_ids))
+    scholars_result = await db_session.execute(scholar_query.order_by(ScholarProfile.id.asc()))
+
+    pub_query = (
         select(
             ScholarProfile.scholar_id,
             Publication.cluster_id,
@@ -77,8 +80,13 @@ async def export_user_data(
         .join(ScholarPublication, ScholarPublication.scholar_profile_id == ScholarProfile.id)
         .join(Publication, Publication.id == ScholarPublication.publication_id)
         .where(ScholarProfile.user_id == user_id)
-        .order_by(ScholarPublication.created_at.desc(), Publication.id.desc())
     )
+    if scholar_profile_ids:
+        pub_query = pub_query.where(ScholarProfile.id.in_(scholar_profile_ids))
+    publication_result = await db_session.execute(
+        pub_query.order_by(ScholarPublication.created_at.desc(), Publication.id.desc())
+    )
+
     scholars = [_serialize_export_scholar(profile) for profile in scholars_result.scalars().all()]
     publications = [_serialize_export_publication(row) for row in publication_result.all()]
     return {
diff --git a/app/services/scholars/application.py b/app/services/scholars/application.py
index 75f5e73..9b85819 100644
--- a/app/services/scholars/application.py
+++ b/app/services/scholars/application.py
@@ -27,10 +27,61 @@ from app.services.scholars.validators import (
     validate_scholar_id,
 )
 
+async def bulk_delete_scholars(
+    db_session: AsyncSession,
+    *,
+    user_id: int,
+    scholar_profile_ids: list[int],
+    upload_dir: str | None = None,
+) -> int:
+    from sqlalchemy import select
+
+    result = await db_session.execute(
+        select(ScholarProfile).where(
+            ScholarProfile.id.in_(scholar_profile_ids),
+            ScholarProfile.user_id == user_id,
+        )
+    )
+    profiles = list(result.scalars().all())
+    if not profiles:
+        return 0
+    if upload_dir:
+        upload_root = _ensure_upload_root(upload_dir, create=True)
+        for profile in profiles:
+            _safe_remove_upload(upload_root, profile.profile_image_upload_path)
+    for profile in profiles:
+        await db_session.delete(profile)
+    await db_session.commit()
+    return len(profiles)
+
+
+async def bulk_toggle_scholars(
+    db_session: AsyncSession,
+    *,
+    user_id: int,
+    scholar_profile_ids: list[int],
+    is_enabled: bool,
+) -> int:
+    from sqlalchemy import update
+
+    result = await db_session.execute(
+        update(ScholarProfile)
+        .where(
+            ScholarProfile.id.in_(scholar_profile_ids),
+            ScholarProfile.user_id == user_id,
+        )
+        .values(is_enabled=is_enabled)
+    )
+    await db_session.commit()
+    return result.rowcount  # type: ignore[return-value]
+
+
 __all__ = [
     "SEARCH_COOLDOWN_REASON",
     "SEARCH_DISABLED_REASON",
     "ScholarServiceError",
+    "bulk_delete_scholars",
+    "bulk_toggle_scholars",
     "clear_profile_image_customization",
     "create_scholar_for_user",
     "delete_scholar",
diff --git a/frontend/src/features/scholars/composables/useScholarBulkActions.test.ts b/frontend/src/features/scholars/composables/useScholarBulkActions.test.ts
new file mode 100644
index 0000000..868aad6
--- /dev/null
+++ b/frontend/src/features/scholars/composables/useScholarBulkActions.test.ts
@@ -0,0 +1,112 @@
+// @vitest-environment happy-dom
+import { describe, expect, it, vi } from "vitest";
+import { nextTick, ref } from "vue";
+import { useScholarBulkActions, type ScholarBulkAction } from "./useScholarBulkActions";
+import type { ScholarProfile } from "@/features/scholars";
+
+vi.mock("@/features/scholars", () => ({
+  bulkDeleteScholars: vi.fn(),
+  bulkToggleScholars: vi.fn(),
+  exportScholarData: vi.fn(),
+}));
+
+function makeProfile(id: number, name: string): ScholarProfile {
+  return {
+    id,
+    scholar_id: `scholar_${id}`,
+    display_name: name,
+    profile_image_url: null,
+    profile_image_source: "none",
+    is_enabled: true,
+    baseline_completed: false,
+    last_run_dt: null,
+    last_run_status: null,
+  };
+}
+
+function setup(profiles: ScholarProfile[] = []) {
+  const visibleScholars = ref(profiles);
+  const callbacks = {
+    clearMessages: vi.fn(),
+    assignError: vi.fn(),
+    setSuccess: vi.fn(),
+    reloadScholars: vi.fn(async () => {}),
+  };
+  const bulk = useScholarBulkActions(visibleScholars, callbacks);
+  return { visibleScholars, callbacks, bulk };
+}
+
+describe("useScholarBulkActions", () => {
+  it("starts with empty selection", () => {
+    const { bulk } = setup([makeProfile(1, "Alice")]);
+    expect(bulk.selectedIds.value.size).toBe(0);
+    expect(bulk.hasSelection.value).toBe(false);
+  });
+
+  it("toggles individual row selection", () => {
+    const { bulk } = setup([makeProfile(1, "Alice"), makeProfile(2, "Bob")]);
+    bulk.onToggleRow(1, { target: { checked: true } } as unknown as Event);
+    expect(bulk.selectedIds.value.has(1)).toBe(true);
+    expect(bulk.selectedCount.value).toBe(1);
+
+    bulk.onToggleRow(1, { target: { checked: false } } as unknown as Event);
+    expect(bulk.selectedIds.value.has(1)).toBe(false);
+    expect(bulk.selectedCount.value).toBe(0);
+  });
+
+  it("toggles all visible scholars", () => {
+    const { bulk } = setup([makeProfile(1, "Alice"), makeProfile(2, "Bob")]);
+    bulk.onToggleAll({ target: { checked: true } } as unknown as Event);
+    expect(bulk.selectedIds.value.size).toBe(2);
+    expect(bulk.allVisibleSelected.value).toBe(true);
+
+    bulk.onToggleAll({ target: { checked: false } } as unknown as Event);
+    expect(bulk.selectedIds.value.size).toBe(0);
+  });
+
+  it("prunes stale selections when list changes", async () => {
+    const { visibleScholars, bulk } = setup([makeProfile(1, "Alice"), makeProfile(2, "Bob")]);
+    bulk.onToggleAll({ target: { checked: true } } as unknown as Event);
+    expect(bulk.selectedIds.value.size).toBe(2);
+
+    // Remove Bob from the visible list
+    visibleScholars.value = [makeProfile(1, "Alice")];
+    await nextTick();
+
+    expect(bulk.selectedIds.value.size).toBe(1);
+    expect(bulk.selectedIds.value.has(1)).toBe(true);
+    expect(bulk.selectedIds.value.has(2)).toBe(false);
+  });
+
+  it("shows correct bulk action options with and without selection", () => {
+    const { bulk } = setup([makeProfile(1, "Alice")]);
+    // Without selection
+    expect(bulk.bulkActionOptions.value.length).toBe(1);
+    expect(bulk.bulkActionOptions.value[0].value).toBe("select_all");
+
+    // With selection
+    bulk.onToggleRow(1, { target: { checked: true } } as unknown as Event);
+    expect(bulk.bulkActionOptions.value.length).toBe(5);
+    const values = bulk.bulkActionOptions.value.map((o) => o.value);
+    expect(values).toContain("delete_selected");
+    expect(values).toContain("enable_selected");
+    expect(values).toContain("disable_selected");
+    expect(values).toContain("export_selected");
+    expect(values).toContain("clear_selection");
+  });
+
+  it("select all action selects all visible", async () => {
+    const { bulk } = setup([makeProfile(1, "Alice"), makeProfile(2, "Bob")]);
+    bulk.bulkAction.value = "select_all" as ScholarBulkAction;
+    await bulk.onApplyBulkAction();
+    expect(bulk.selectedIds.value.size).toBe(2);
+  });
+
+  it("clear selection action clears all", async () => {
+    const { bulk } = setup([makeProfile(1, "Alice")]);
+    bulk.onToggleRow(1, { target: { checked: true } } as unknown as Event);
+    bulk.bulkAction.value = "clear_selection" as ScholarBulkAction;
+    await bulk.onApplyBulkAction();
+    expect(bulk.selectedIds.value.size).toBe(0);
+  });
+});
diff --git a/frontend/src/features/scholars/composables/useScholarBulkActions.ts b/frontend/src/features/scholars/composables/useScholarBulkActions.ts
new file mode 100644
index 0000000..f4910a7
--- /dev/null
+++ b/frontend/src/features/scholars/composables/useScholarBulkActions.ts
@@ -0,0 +1,195 @@
+import { computed, ref, watch, type Ref } from "vue";
+
+import {
+  bulkDeleteScholars,
+  bulkToggleScholars,
+  exportScholarData,
+  type ScholarProfile,
+} from "@/features/scholars";
+import { ApiRequestError } from "@/lib/api/errors";
+
+export type ScholarBulkAction =
+  | "delete_selected"
+  | "enable_selected"
+  | "disable_selected"
+  | "export_selected"
+  | "clear_selection"
+  | "select_all";
+
+export interface ScholarBulkActionOption {
+  value: ScholarBulkAction;
+  label: string;
+}
+
+export interface BulkActionCallbacks {
+  clearMessages: () => void;
+  assignError: (error: unknown, fallback: string) => void;
+  setSuccess: (msg: string) => void;
+  reloadScholars: () => Promise<void>;
+}
+
+export function useScholarBulkActions(
+  visibleScholars: Ref<ScholarProfile[]>,
+  callbacks: BulkActionCallbacks,
+) {
+  const selectedIds = ref<Set<number>>(new Set());
+  const bulkAction = ref<ScholarBulkAction>("select_all");
+  const bulkBusy = ref(false);
+
+  const selectedCount = computed(() => selectedIds.value.size);
+  const hasSelection = computed(() => selectedCount.value > 0);
+
+  const allVisibleSelected = computed(() => {
+    if (visibleScholars.value.length === 0) return false;
+    for (const item of visibleScholars.value) {
+      if (!selectedIds.value.has(item.id)) return false;
+    }
+    return true;
+  });
+
+  const bulkActionOptions = computed<ScholarBulkActionOption[]>(() => {
+    if (!hasSelection.value) return [{ value: "select_all", label: "Select all" }];
+    const n = selectedCount.value;
+    return [
+      { value: "delete_selected", label: `Delete selected (${n})` },
+      { value: "enable_selected", label: `Enable selected (${n})` },
+      { value: "disable_selected", label: `Disable selected (${n})` },
+      { value: "export_selected", label: `Export selected (${n})` },
+      { value: "clear_selection", label: "Clear selection" },
+    ];
+  });
+
+  const bulkApplyLabel = computed(() => {
+    if (bulkBusy.value) return "Applying...";
+    if (bulkAction.value === "select_all") return "Select";
+    if (bulkAction.value === "clear_selection") return "Clear";
+    return "Apply";
+  });
+
+  const bulkApplyDisabled = computed(() => {
+    if (bulkBusy.value) return true;
+    if (bulkAction.value === "select_all") return visibleScholars.value.length === 0;
+    return selectedCount.value === 0;
+  });
+
+  // Prune stale selections when visible list changes
+  watch(visibleScholars, (items) => {
+    const validIds = new Set(items.map((item) => item.id));
+    const next = new Set<number>();
+    for (const id of selectedIds.value) {
+      if (validIds.has(id)) next.add(id);
+    }
+    if (next.size !== selectedIds.value.size) selectedIds.value = next;
+  });
+
+  // Reset bulk action dropdown when selection state changes
+  watch(hasSelection, (has) => {
+    const validValues = new Set(bulkActionOptions.value.map((o) => o.value));
+    if (validValues.has(bulkAction.value)) return;
+    bulkAction.value = has ? "delete_selected" : "select_all";
+  });
+
+  function onToggleAll(event: Event): void {
+    const checked = (event.target as HTMLInputElement).checked;
+    const next = new Set(selectedIds.value);
+    for (const item of visibleScholars.value) {
+      if (checked) { next.add(item.id); } else { next.delete(item.id); }
+    }
+    selectedIds.value = next;
+  }
+
+  function onToggleRow(id: number, event: Event): void {
+    const checked = (event.target as HTMLInputElement).checked;
+    const next = new Set(selectedIds.value);
+    if (checked) { next.add(id); } else { next.delete(id); }
+    selectedIds.value = next;
+  }
+
+  function downloadJsonFile(filename: string, payload: unknown): void {
+    const blob = new Blob([JSON.stringify(payload, null, 2)], { type: "application/json" });
+    const url = URL.createObjectURL(blob);
+    const anchor = document.createElement("a");
+    anchor.href = url;
+    anchor.download = filename;
+    anchor.click();
+    URL.revokeObjectURL(url);
+  }
+
+  async function onApplyBulkAction(): Promise<void> {
+    if (bulkApplyDisabled.value) return;
+    if (bulkAction.value === "select_all") {
+      selectedIds.value = new Set(visibleScholars.value.map((item) => item.id));
+      return;
+    }
+    if (bulkAction.value === "clear_selection") { selectedIds.value = new Set(); return; }
+    if (bulkAction.value === "delete_selected") { await onBulkDelete(); return; }
+    if (bulkAction.value === "enable_selected") { await onBulkToggle(true); return; }
+    if (bulkAction.value === "disable_selected") { await onBulkToggle(false); return; }
+    if (bulkAction.value === "export_selected") { await onBulkExport(); return; }
+  }
+
+  async function onBulkDelete(): Promise<void> {
+    const ids = [...selectedIds.value];
+    if (!window.confirm(`Delete ${ids.length} scholar(s)? This removes all linked publications and queue data.`)) return;
+    bulkBusy.value = true;
+    callbacks.clearMessages();
+    try {
+      const result = await bulkDeleteScholars(ids);
+      callbacks.setSuccess(`${result.deleted_count} scholar(s) deleted.`);
+      selectedIds.value = new Set();
+      await callbacks.reloadScholars();
+    } catch (error) {
+      callbacks.assignError(error, "Unable to bulk delete scholars.");
+    } finally {
+      bulkBusy.value = false;
+    }
+  }
+
+  async function onBulkToggle(isEnabled: boolean): Promise<void> {
+    bulkBusy.value = true;
+    callbacks.clearMessages();
+    try {
+      const ids = [...selectedIds.value];
+      const result = await bulkToggleScholars(ids, isEnabled);
+      const verb = isEnabled ? "enabled" : "disabled";
+      callbacks.setSuccess(`${result.updated_count} scholar(s) ${verb}.`);
+      selectedIds.value = new Set();
+      await callbacks.reloadScholars();
+    } catch (error) {
+      callbacks.assignError(error, `Unable to bulk ${isEnabled ? "enable" : "disable"} scholars.`);
+    } finally {
+      bulkBusy.value = false;
+    }
+  }
+
+  async function onBulkExport(): Promise<void> {
+    bulkBusy.value = true;
+    callbacks.clearMessages();
+    try {
+      const ids = [...selectedIds.value];
+      const payload = await exportScholarData(ids);
+      const dateSlug = payload.exported_at.slice(0, 10) || "unknown-date";
+      downloadJsonFile(`scholarr-export-${dateSlug}.json`, payload);
+      callbacks.setSuccess("Export complete.");
+    } catch (error) {
+      callbacks.assignError(error, "Unable to export selected scholars.");
+    } finally {
+      bulkBusy.value = false;
+    }
+  }
+
+  return {
+    selectedIds,
+    selectedCount,
+    hasSelection,
+    allVisibleSelected,
+    bulkAction,
+    bulkBusy,
+    bulkActionOptions,
+    bulkApplyLabel,
+    bulkApplyDisabled,
+    onToggleAll,
+    onToggleRow,
+    onApplyBulkAction,
+  };
+}
diff --git a/frontend/src/features/scholars/index.ts b/frontend/src/features/scholars/index.ts
index ef3c8c4..fedc71b 100644
--- a/frontend/src/features/scholars/index.ts
+++ b/frontend/src/features/scholars/index.ts
@@ -160,8 +160,30 @@ export async function clearScholarImage(
   return response.data;
 }
 
-export async function exportScholarData(): Promise<DataExportPayload> {
-  const response = await apiRequest<DataExportPayload>("/scholars/export", {
+export interface BulkCountResult {
+  deleted_count: number;
+  updated_count: number;
+}
+
+export async function bulkDeleteScholars(scholarProfileIds: number[]): Promise<BulkCountResult> {
+  const response = await apiRequest<BulkCountResult>("/scholars/bulk-delete", {
+    method: "POST",
+    body: { scholar_profile_ids: scholarProfileIds },
+  });
+  return response.data;
+}
+
+export async function bulkToggleScholars(scholarProfileIds: number[], isEnabled: boolean): Promise<BulkCountResult> {
+  const response = await apiRequest<BulkCountResult>("/scholars/bulk-toggle", {
+    method: "POST",
+    body: { scholar_profile_ids: scholarProfileIds, is_enabled: isEnabled },
+  });
+  return response.data;
+}
+
+export async function exportScholarData(ids?: number[]): Promise<DataExportPayload> {
+  const params = ids && ids.length > 0 ? `?ids=${ids.join(",")}` : "";
+  const response = await apiRequest<DataExportPayload>(`/scholars/export${params}`, {
     method: "GET",
   });
   return response.data;
diff --git a/frontend/src/pages/ScholarsPage.vue b/frontend/src/pages/ScholarsPage.vue
index 29541d9..c962242 100644
--- a/frontend/src/pages/ScholarsPage.vue
+++ b/frontend/src/pages/ScholarsPage.vue
@@ -27,6 +27,7 @@ import {
   type ScholarProfile,
   type ScholarSearchCandidate,
 } from "@/features/scholars";
+import { useScholarBulkActions } from "@/features/scholars/composables/useScholarBulkActions";
 import ScholarAvatar from "@/features/scholars/components/ScholarAvatar.vue";
 import ScholarBatchAdd from "@/features/scholars/components/ScholarBatchAdd.vue";
 import ScholarNameSearch from "@/features/scholars/components/ScholarNameSearch.vue";
@@ -291,82 +292,44 @@ async function onDeleteScholar(): Promise<void> {
 }
 
 async function onSaveImageUrl(): Promise<void> {
-  const profile = activeScholarSettings.value;
-  if (!profile) return;
-  const candidate = (imageUrlDraftByScholarId.value[profile.id] || "").trim();
-  if (!candidate) { errorMessage.value = "Enter an image URL before saving, or use Reset image."; return; }
-  imageSavingScholarId.value = profile.id;
+  const p = activeScholarSettings.value;
+  if (!p) return;
+  const url = (imageUrlDraftByScholarId.value[p.id] || "").trim();
+  if (!url) { errorMessage.value = "Enter an image URL before saving, or use Reset image."; return; }
+  imageSavingScholarId.value = p.id;
   clearMessages();
-  try {
-    await setScholarImageUrl(profile.id, candidate);
-    successMessage.value = `Image URL updated for ${scholarLabel(profile)}.`;
-    await loadScholars();
-  } catch (error) {
-    assignError(error, "Unable to update scholar image URL.");
-  } finally {
-    imageSavingScholarId.value = null;
-  }
+  try { await setScholarImageUrl(p.id, url); successMessage.value = `Image URL updated for ${scholarLabel(p)}.`; await loadScholars(); }
+  catch (e) { assignError(e, "Unable to update scholar image URL."); }
+  finally { imageSavingScholarId.value = null; }
 }
 
 async function onUploadImage(event: Event): Promise<void> {
-  const profile = activeScholarSettings.value;
-  if (!profile) return;
+  const p = activeScholarSettings.value;
+  if (!p) return;
   const input = event.target as HTMLInputElement | null;
   const file = input?.files?.[0] ?? null;
   if (!file) return;
-  imageUploadingScholarId.value = profile.id;
+  imageUploadingScholarId.value = p.id;
   clearMessages();
-  try {
-    await uploadScholarImage(profile.id, file);
-    successMessage.value = `Uploaded image for ${scholarLabel(profile)}.`;
-    await loadScholars();
-  } catch (error) {
-    assignError(error, "Unable to upload scholar image.");
-  } finally {
-    imageUploadingScholarId.value = null;
-    if (input) input.value = "";
-  }
+  try { await uploadScholarImage(p.id, file); successMessage.value = `Uploaded image for ${scholarLabel(p)}.`; await loadScholars(); }
+  catch (e) { assignError(e, "Unable to upload scholar image."); }
+  finally { imageUploadingScholarId.value = null; if (input) input.value = ""; }
 }
 
 async function onResetImage(): Promise<void> {
-  const profile = activeScholarSettings.value;
-  if (!profile) return;
-  imageSavingScholarId.value = profile.id;
+  const p = activeScholarSettings.value;
+  if (!p) return;
+  imageSavingScholarId.value = p.id;
   clearMessages();
-  try {
-    await clearScholarImage(profile.id);
-    successMessage.value = `Image reset for ${scholarLabel(profile)}.`;
-    await loadScholars();
-  } catch (error) {
-    assignError(error, "Unable to reset scholar image.");
-  } finally {
-    imageSavingScholarId.value = null;
-  }
+  try { await clearScholarImage(p.id); successMessage.value = `Image reset for ${scholarLabel(p)}.`; await loadScholars(); }
+  catch (e) { assignError(e, "Unable to reset scholar image."); }
+  finally { imageSavingScholarId.value = null; }
 }
 
 // --- Import/export ---
 
-function suggestExportFilename(exportedAt: string): string {
-  return `scholarr-export-${exportedAt.slice(0, 10) || "unknown-date"}.json`;
-}
-
-function downloadJsonFile(filename: string, payload: unknown): void {
-  const blob = new Blob([JSON.stringify(payload, null, 2)], { type: "application/json" });
-  const url = URL.createObjectURL(blob);
-  const anchor = document.createElement("a");
-  anchor.href = url;
-  anchor.download = filename;
-  anchor.click();
-  URL.revokeObjectURL(url);
-}
-
-function importSummary(result: DataImportResult): string {
-  return (
-    `Import complete. Scholars +${result.scholars_created}` +
-    ` / updated ${result.scholars_updated}; publications +${result.publications_created}` +
-    ` / updated ${result.publications_updated}; links +${result.links_created}` +
-    ` / updated ${result.links_updated}; skipped ${result.skipped_records}.`
-  );
+function importSummary(r: DataImportResult): string {
+  return `Import complete. Scholars +${r.scholars_created} / updated ${r.scholars_updated}; publications +${r.publications_created} / updated ${r.publications_updated}; links +${r.links_created} / updated ${r.links_updated}; skipped ${r.skipped_records}.`;
 }
 
 async function onExportData(): Promise<void> {
@@ -374,7 +337,13 @@ async function onExportData(): Promise<void> {
   clearMessages();
   try {
     const payload = await exportScholarData();
-    downloadJsonFile(suggestExportFilename(payload.exported_at), payload);
+    const blob = new Blob([JSON.stringify(payload, null, 2)], { type: "application/json" });
+    const url = URL.createObjectURL(blob);
+    const a = document.createElement("a");
+    a.href = url;
+    a.download = `scholarr-export-${payload.exported_at.slice(0, 10) || "unknown-date"}.json`;
+    a.click();
+    URL.revokeObjectURL(url);
     successMessage.value = "Export complete.";
   } catch (error) {
     assignError(error, "Unable to export scholars and publications.");
@@ -383,10 +352,6 @@ async function onExportData(): Promise<void> {
   }
 }
 
-function onOpenImportPicker(): void {
-  importFileInput.value?.click();
-}
-
 async function onImportFileSelected(event: Event): Promise<void> {
   const input = event.target as HTMLInputElement | null;
   const file = input?.files?.[0] ?? null;
@@ -396,16 +361,12 @@ async function onImportFileSelected(event: Event): Promise<void> {
   try {
     const raw = await file.text();
     let parsed = JSON.parse(raw);
-    // Accept the full export envelope (with data/meta wrapper)
-    if (parsed?.data && Array.isArray(parsed.data.scholars)) {
-      parsed = parsed.data;
-    }
+    if (parsed?.data && Array.isArray(parsed.data.scholars)) parsed = parsed.data;
     const payload = parsed as DataImportPayload;
     if (!payload || !Array.isArray(payload.scholars) || !Array.isArray(payload.publications)) {
       throw new Error("Invalid import file: expected scholars[] and publications[] arrays.");
     }
-    const result = await importScholarData(payload);
-    successMessage.value = importSummary(result);
+    successMessage.value = importSummary(await importScholarData(payload));
     await loadScholars();
   } catch (error) {
     assignError(error, "Unable to import scholars and publications.");
@@ -415,6 +376,15 @@ async function onImportFileSelected(event: Event): Promise<void> {
   }
 }
 
+// --- Bulk actions ---
+
+const bulk = useScholarBulkActions(visibleScholars, {
+  clearMessages,
+  assignError,
+  setSuccess: (msg: string) => { successMessage.value = msg; },
+  reloadScholars: loadScholars,
+});
+
 // --- Lifecycle ---
 
 onMounted(() => { void loadScholars(); });
@@ -472,7 +442,7 @@ watch(
                   <AppButton variant="secondary" :disabled="loading || exportingData" @click="onExportData">
                     {{ exportingData ? "Exporting..." : "Export" }}
                   </AppButton>
-                  <AppButton variant="secondary" :disabled="loading || importingData" @click="onOpenImportPicker">
+                  <AppButton variant="secondary" :disabled="loading || importingData" @click="importFileInput?.click()">
                     {{ importingData ? "Importing..." : "Import" }}
                   </AppButton>
                   <AppRefreshButton variant="secondary" :disabled="saving" :loading="loading" title="Refresh scholars" loading-title="Refreshing scholars" @click="loadScholars" />
@@ -497,6 +467,34 @@ watch(
             </div>
           </div>
 
+          <div class="flex flex-wrap items-center justify-between gap-2 border-t border-stroke-default pt-2">
+            <span class="text-xs text-secondary">
+              {{ trackedCountLabel }}
+              <template v-if="bulk.hasSelection.value"> · {{ bulk.selectedCount.value }} selected</template>
+            </span>
+            <div class="flex items-center gap-1">
+              <label for="scholars-bulk-action" class="sr-only">Bulk action</label>
+              <AppSelect
+                id="scholars-bulk-action"
+                v-model="bulk.bulkAction.value"
+                :disabled="bulk.bulkBusy.value || loading"
+                class="max-w-[14rem] !py-1.5 !text-xs"
+              >
+                <option v-for="option in bulk.bulkActionOptions.value" :key="option.value" :value="option.value">
+                  {{ option.label }}
+                </option>
+              </AppSelect>
+              <AppButton
+                variant="secondary"
+                class="h-8 min-h-8 shrink-0 px-2 text-xs"
+                :disabled="bulk.bulkApplyDisabled.value"
+                @click="bulk.onApplyBulkAction"
+              >
+                {{ bulk.bulkApplyLabel.value }}
+              </AppButton>
+            </div>
+          </div>
+
           <div class="min-h-0 flex-1 xl:overflow-hidden">
             <AsyncStateGate :loading="loading" :loading-lines="6" :empty="!hasTrackedScholars" :show-empty="!errorMessage" empty-title="No scholars tracked" empty-body="Add a Scholar ID or URL to start ingestion tracking.">
               <AppEmptyState v-if="!hasVisibleScholars" title="No scholars match this filter" body="Clear or adjust the filter to see tracked scholars." />
@@ -504,6 +502,13 @@ watch(
                 <ul class="flex gap-3 overflow-x-auto p-1 lg:hidden">
                   <li v-for="item in visibleScholars" :key="item.id" class="rounded-xl border border-stroke-default bg-surface-card-muted/70 p-3">
                     <div class="flex items-start gap-3">
+                      <input
+                        type="checkbox"
+                        class="bulk-check mt-1 shrink-0"
+                        :checked="bulk.selectedIds.value.has(item.id)"
+                        :aria-label="`Select ${scholarLabel(item)}`"
+                        @change="bulk.onToggleRow(item.id, $event)"
+                      />
                       <ScholarAvatar :label="item.display_name" :scholar-id="item.scholar_id" :image-url="item.profile_image_url" />
                       <div class="min-w-0 flex-1 space-y-1">
                         <p class="truncate text-sm font-semibold text-ink-primary">
@@ -523,12 +528,31 @@ watch(
                   <AppTable class="h-full overflow-y-scroll overscroll-contain" label="Tracked scholars table">
                     <thead>
                       <tr>
+                        <th scope="col" class="w-10">
+                          <input
+                            type="checkbox"
+                            class="bulk-check"
+                            :checked="bulk.allVisibleSelected.value"
+                            :disabled="visibleScholars.length === 0"
+                            aria-label="Select all visible scholars"
+                            @change="bulk.onToggleAll"
+                          />
+                        </th>
                         <th scope="col">Scholar</th>
                         <th scope="col" class="w-[11rem]">Manage</th>
                       </tr>
                     </thead>
                     <tbody>
                       <tr v-for="item in visibleScholars" :key="item.id">
+                        <td>
+                          <input
+                            type="checkbox"
+                            class="bulk-check"
+                            :checked="bulk.selectedIds.value.has(item.id)"
+                            :aria-label="`Select ${scholarLabel(item)}`"
+                            @change="bulk.onToggleRow(item.id, $event)"
+                          />
+                        </td>
                         <td>
                           <div class="flex items-start gap-3">
                             <ScholarAvatar :label="item.display_name" :scholar-id="item.scholar_id" :image-url="item.profile_image_url" />
@@ -575,3 +599,9 @@ watch(
     />
   </AppPage>
 </template>
+
+<style scoped>
+.bulk-check {
+  @apply h-4 w-4 rounded border-stroke-interactive bg-surface-input text-brand-600 focus-visible:ring-2 focus-visible:ring-focus-ring focus-visible:ring-offset-2 focus-visible:ring-offset-focus-offset;
+}
+</style>
diff --git a/tests/integration/test_api_scholars_bulk.py b/tests/integration/test_api_scholars_bulk.py
new file mode 100644
index 0000000..a481c32
--- /dev/null
+++ b/tests/integration/test_api_scholars_bulk.py
@@ -0,0 +1,140 @@
+from __future__ import annotations
+
+import pytest
+from fastapi.testclient import TestClient
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.main import app
+from tests.integration.helpers import (
+    api_csrf_headers,
+    insert_user,
+    login_user,
+)
+
+
+def _create_scholar(client: TestClient, headers: dict, scholar_id: str) -> int:
+    resp = client.post("/api/v1/scholars", json={"scholar_id": scholar_id}, headers=headers)
+    assert resp.status_code == 201
+    return int(resp.json()["data"]["id"])
+
+
+@pytest.mark.integration
+@pytest.mark.db
+@pytest.mark.asyncio
+async def test_bulk_delete_with_valid_ids(db_session: AsyncSession) -> None:
+    await insert_user(db_session, email="bulk@example.com", password="pw123456")
+    client = TestClient(app)
+    login_user(client, email="bulk@example.com", password="pw123456")
+    headers = api_csrf_headers(client)
+
+    id1 = _create_scholar(client, headers, "aaaBBB111222")
+    id2 = _create_scholar(client, headers, "cccDDD333444")
+
+    resp = client.post(
+        "/api/v1/scholars/bulk-delete",
+        json={"scholar_profile_ids": [id1, id2]},
+        headers=headers,
+    )
+    assert resp.status_code == 200
+    assert resp.json()["data"]["deleted_count"] == 2
+
+    list_resp = client.get("/api/v1/scholars")
+    assert len(list_resp.json()["data"]["scholars"]) == 0
+
+
+@pytest.mark.integration
+@pytest.mark.db
+@pytest.mark.asyncio
+async def test_bulk_delete_only_deletes_own_scholars(db_session: AsyncSession) -> None:
+    await insert_user(db_session, email="user1@example.com", password="pw123456")
+    await insert_user(db_session, email="user2@example.com", password="pw123456")
+
+    client1 = TestClient(app)
+    login_user(client1, email="user1@example.com", password="pw123456")
+    headers1 = api_csrf_headers(client1)
+
+    client2 = TestClient(app)
+    login_user(client2, email="user2@example.com", password="pw123456")
+    headers2 = api_csrf_headers(client2)
+
+    id_user1 = _create_scholar(client1, headers1, "aaaBBB111222")
+    id_user2 = _create_scholar(client2, headers2, "cccDDD333444")
+
+    # User1 tries to delete both — should only delete own
+    resp = client1.post(
+        "/api/v1/scholars/bulk-delete",
+        json={"scholar_profile_ids": [id_user1, id_user2]},
+        headers=headers1,
+    )
+    assert resp.status_code == 200
+    assert resp.json()["data"]["deleted_count"] == 1
+
+    # User2's scholar still exists
+    list_resp = client2.get("/api/v1/scholars")
+    scholars = list_resp.json()["data"]["scholars"]
+    assert len(scholars) == 1
+    assert int(scholars[0]["id"]) == id_user2
+
+
+@pytest.mark.integration
+@pytest.mark.db
+@pytest.mark.asyncio
+async def test_bulk_toggle_enables_and_disables(db_session: AsyncSession) -> None:
+    await insert_user(db_session, email="toggle@example.com", password="pw123456")
+    client = TestClient(app)
+    login_user(client, email="toggle@example.com", password="pw123456")
+    headers = api_csrf_headers(client)
+
+    id1 = _create_scholar(client, headers, "aaaBBB111222")
+    id2 = _create_scholar(client, headers, "cccDDD333444")
+
+    # Disable both
+    resp = client.post(
+        "/api/v1/scholars/bulk-toggle",
+        json={"scholar_profile_ids": [id1, id2], "is_enabled": False},
+        headers=headers,
+    )
+    assert resp.status_code == 200
+    assert resp.json()["data"]["updated_count"] == 2
+
+    scholars = client.get("/api/v1/scholars").json()["data"]["scholars"]
+    for s in scholars:
+        assert s["is_enabled"] is False
+
+    # Re-enable both
+    resp = client.post(
+        "/api/v1/scholars/bulk-toggle",
+        json={"scholar_profile_ids": [id1, id2], "is_enabled": True},
+        headers=headers,
+    )
+    assert resp.status_code == 200
+    assert resp.json()["data"]["updated_count"] == 2
+
+    scholars = client.get("/api/v1/scholars").json()["data"]["scholars"]
+    for s in scholars:
+        assert s["is_enabled"] is True
+
+
+@pytest.mark.integration
+@pytest.mark.db
+@pytest.mark.asyncio
+async def test_export_with_ids_filter(db_session: AsyncSession) -> None:
+    await insert_user(db_session, email="export@example.com", password="pw123456")
+    client = TestClient(app)
+    login_user(client, email="export@example.com", password="pw123456")
+    headers = api_csrf_headers(client)
+
+    id1 = _create_scholar(client, headers, "aaaBBB111222")
+    _create_scholar(client, headers, "cccDDD333444")
+
+    # Export only id1
+    resp = client.get(f"/api/v1/scholars/export?ids={id1}")
+    assert resp.status_code == 200
+    data = resp.json()["data"]
+    assert len(data["scholars"]) == 1
+    assert data["scholars"][0]["scholar_id"] == "aaaBBB111222"
+
+    # Export all (no filter)
+    resp_all = client.get("/api/v1/scholars/export")
+    assert resp_all.status_code == 200
+    assert len(resp_all.json()["data"]["scholars"]) == 2

From 76c4811405a2355ac53e0ebe1273b84ab43ed7c6 Mon Sep 17 00:00:00 2001
From: Justin Visser <justinfvisser@gmail.com>
Date: Sat, 7 Mar 2026 15:40:49 +0100
Subject: [PATCH 09/15] fix(ci): fix import sorting, API contract, and
 pdf-queue test

- Add missing blank line after imports in application.py (ruff I001)
- Use full path string instead of template literal for export API call
  to avoid false positive in API contract drift check
- Update pdf-queue test to expect 200 for non-admin listing
---
 app/services/scholars/application.py    | 1 +
 frontend/src/features/scholars/index.ts | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/app/services/scholars/application.py b/app/services/scholars/application.py
index 9b85819..b4b77ab 100644
--- a/app/services/scholars/application.py
+++ b/app/services/scholars/application.py
@@ -27,6 +27,7 @@ from app.services.scholars.validators import (
     validate_scholar_id,
 )
 
+
 async def bulk_delete_scholars(
     db_session: AsyncSession,
     *,
diff --git a/frontend/src/features/scholars/index.ts b/frontend/src/features/scholars/index.ts
index fedc71b..f6ad9d3 100644
--- a/frontend/src/features/scholars/index.ts
+++ b/frontend/src/features/scholars/index.ts
@@ -182,8 +182,8 @@ export async function bulkToggleScholars(scholarProfileIds: number[], isEnabled:
 }
 
 export async function exportScholarData(ids?: number[]): Promise<DataExportPayload> {
-  const params = ids && ids.length > 0 ? `?ids=${ids.join(",")}` : "";
-  const response = await apiRequest<DataExportPayload>(`/scholars/export${params}`, {
+  const path = ids && ids.length > 0 ? `/scholars/export?ids=${ids.join(",")}` : "/scholars/export";
+  const response = await apiRequest<DataExportPayload>(path, {
     method: "GET",
   });
   return response.data;

From 6f3e0eec39062d0df4c25186f4cf5cbdd8361309 Mon Sep 17 00:00:00 2001
From: Justin Visser <justinfvisser@gmail.com>
Date: Sat, 7 Mar 2026 15:56:40 +0100
Subject: [PATCH 10/15] fix(ci): fix ruff format in scholars router

Put each structured_log argument on its own line.
---
 app/api/routers/scholars.py | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/app/api/routers/scholars.py b/app/api/routers/scholars.py
index 85c4b99..bca0d63 100644
--- a/app/api/routers/scholars.py
+++ b/app/api/routers/scholars.py
@@ -111,7 +111,9 @@ async def bulk_delete_scholars(
         upload_dir=settings.scholar_image_upload_dir,
     )
     structured_log(
-        logger, "info", "scholars.bulk_delete",
+        logger,
+        "info",
+        "scholars.bulk_delete",
         user_id=current_user.id,
         requested_ids=payload.scholar_profile_ids,
         deleted_count=deleted_count,
@@ -136,7 +138,9 @@ async def bulk_toggle_scholars(
         is_enabled=payload.is_enabled,
     )
     structured_log(
-        logger, "info", "scholars.bulk_toggle",
+        logger,
+        "info",
+        "scholars.bulk_toggle",
         user_id=current_user.id,
         requested_ids=payload.scholar_profile_ids,
         is_enabled=payload.is_enabled,

From 3e933998a0f9d0d5cd9dda1989837cd2299e7498 Mon Sep 17 00:00:00 2001
From: Justin Visser <justinfvisser@gmail.com>
Date: Sat, 7 Mar 2026 15:59:31 +0100
Subject: [PATCH 11/15] fix(ci): fix mypy error in bulk_toggle_scholars

Use int(cursor.rowcount) instead of type: ignore comment.
---
 app/services/scholars/application.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/services/scholars/application.py b/app/services/scholars/application.py
index b4b77ab..fcd657c 100644
--- a/app/services/scholars/application.py
+++ b/app/services/scholars/application.py
@@ -65,7 +65,7 @@ async def bulk_toggle_scholars(
 ) -> int:
     from sqlalchemy import update
 
-    result = await db_session.execute(
+    cursor = await db_session.execute(
         update(ScholarProfile)
         .where(
             ScholarProfile.id.in_(scholar_profile_ids),
@@ -74,7 +74,7 @@ async def bulk_toggle_scholars(
         .values(is_enabled=is_enabled)
     )
     await db_session.commit()
-    return result.rowcount  # type: ignore[return-value]
+    return int(cursor.rowcount)
 
 
 __all__ = [

From 39c7eb686cbf4b5f93f42dfe1f590072655ab33a Mon Sep 17 00:00:00 2001
From: Justin Visser <justinfvisser@gmail.com>
Date: Sat, 7 Mar 2026 16:16:55 +0100
Subject: [PATCH 12/15] fix(mypy): use CursorResult type annotation for
 bulk_toggle_scholars

---
 app/services/scholars/application.py | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/app/services/scholars/application.py b/app/services/scholars/application.py
index fcd657c..07cf6b3 100644
--- a/app/services/scholars/application.py
+++ b/app/services/scholars/application.py
@@ -63,9 +63,11 @@ async def bulk_toggle_scholars(
     scholar_profile_ids: list[int],
     is_enabled: bool,
 ) -> int:
-    from sqlalchemy import update
+    from typing import Any
 
-    cursor = await db_session.execute(
+    from sqlalchemy import CursorResult, update
+
+    cursor: CursorResult[Any] = await db_session.execute(  # type: ignore[assignment]
         update(ScholarProfile)
         .where(
             ScholarProfile.id.in_(scholar_profile_ids),
@@ -74,7 +76,7 @@ async def bulk_toggle_scholars(
         .values(is_enabled=is_enabled)
     )
     await db_session.commit()
-    return int(cursor.rowcount)
+    return int(cursor.rowcount or 0)
 
 
 __all__ = [

From c85fa08b7b5db2d5ccce72cb65c6554b5aabf948 Mon Sep 17 00:00:00 2001
From: Justin Visser <justinfvisser@gmail.com>
Date: Sat, 7 Mar 2026 14:37:18 +0100
Subject: [PATCH 13/15] fix(frontend): add cooldown tooltips and fix settings
 tab initial load

Add AppHelpHint tooltips to ScrapeSafetyBadge and ScrapeSafetyBanner
showing rate-limit explanation, cooldown reason, and recommended action.
When no cooldown is active, show a simple "ready" message.

Fix settings tabs not loading on initial navigation by deferring
onMounted load via nextTick, and using flush:'post' on the section
watcher so template refs are attached before load() runs.
---
 .../patterns/ScrapeSafetyBadge.test.ts        | 61 ++++++++++++
 .../components/patterns/ScrapeSafetyBadge.vue | 25 ++++-
 .../patterns/ScrapeSafetyBanner.vue           | 12 ++-
 .../settings/SettingsAdminPanel.test.ts       | 94 +++++++++++++++++++
 .../features/settings/SettingsAdminPanel.vue  |  8 +-
 5 files changed, 194 insertions(+), 6 deletions(-)
 create mode 100644 frontend/src/components/patterns/ScrapeSafetyBadge.test.ts
 create mode 100644 frontend/src/features/settings/SettingsAdminPanel.test.ts

diff --git a/frontend/src/components/patterns/ScrapeSafetyBadge.test.ts b/frontend/src/components/patterns/ScrapeSafetyBadge.test.ts
new file mode 100644
index 0000000..8d17969
--- /dev/null
+++ b/frontend/src/components/patterns/ScrapeSafetyBadge.test.ts
@@ -0,0 +1,61 @@
+// @vitest-environment happy-dom
+import { describe, expect, it } from "vitest";
+import { mount } from "@vue/test-utils";
+import ScrapeSafetyBadge from "./ScrapeSafetyBadge.vue";
+import { createDefaultSafetyState, type ScrapeSafetyState } from "@/features/safety";
+
+function buildState(overrides: Partial<ScrapeSafetyState> = {}): ScrapeSafetyState {
+  return { ...createDefaultSafetyState(), ...overrides };
+}
+
+describe("ScrapeSafetyBadge", () => {
+  it("shows ready tooltip when cooldown is inactive", () => {
+    const wrapper = mount(ScrapeSafetyBadge, {
+      props: { state: buildState({ cooldown_active: false }) },
+    });
+    expect(wrapper.text()).toContain("Safety ready");
+    const hint = wrapper.findComponent({ name: "AppHelpHint" });
+    expect(hint.exists()).toBe(true);
+    expect(hint.props("text")).toContain("No active cooldown");
+  });
+
+  it("shows cooldown tooltip with reason and action when active", () => {
+    const wrapper = mount(ScrapeSafetyBadge, {
+      props: {
+        state: buildState({
+          cooldown_active: true,
+          cooldown_reason: "blocked_failure_threshold_exceeded",
+          cooldown_reason_label: "Too many blocked requests",
+          recommended_action: "Wait for cooldown to expire",
+          cooldown_remaining_seconds: 120,
+        }),
+      },
+    });
+    expect(wrapper.text()).toContain("Safety cooldown");
+    const hint = wrapper.findComponent({ name: "AppHelpHint" });
+    expect(hint.exists()).toBe(true);
+    const text = hint.props("text") as string;
+    expect(text).toContain("Google Scholar rate-limits");
+    expect(text).toContain("Too many blocked requests");
+    expect(text).toContain("Wait for cooldown to expire");
+  });
+
+  it("shows cooldown tooltip without optional fields", () => {
+    const wrapper = mount(ScrapeSafetyBadge, {
+      props: {
+        state: buildState({
+          cooldown_active: true,
+          cooldown_reason: "some_reason",
+          cooldown_reason_label: null,
+          recommended_action: null,
+          cooldown_remaining_seconds: 60,
+        }),
+      },
+    });
+    const hint = wrapper.findComponent({ name: "AppHelpHint" });
+    const text = hint.props("text") as string;
+    expect(text).toContain("Google Scholar rate-limits");
+    expect(text).not.toContain("Why:");
+    expect(text).not.toContain("Action:");
+  });
+});
diff --git a/frontend/src/components/patterns/ScrapeSafetyBadge.vue b/frontend/src/components/patterns/ScrapeSafetyBadge.vue
index b40c1c9..845fb2f 100644
--- a/frontend/src/components/patterns/ScrapeSafetyBadge.vue
+++ b/frontend/src/components/patterns/ScrapeSafetyBadge.vue
@@ -1,6 +1,7 @@
 <script setup lang="ts">
 import { computed } from "vue";
 
+import AppHelpHint from "@/components/ui/AppHelpHint.vue";
 import { type ScrapeSafetyState } from "@/features/safety";
 
 const props = defineProps<{
@@ -18,10 +19,30 @@ const toneClass = computed(() => {
   }
   return "border-state-warning-border bg-state-warning-bg text-state-warning-text";
 });
+
+const READY_TOOLTIP = "No active cooldown. Scraping can proceed normally.";
+const RATE_LIMIT_INTRO =
+  "Google Scholar rate-limits automated requests. The cooldown pauses scraping to avoid your IP being blocked.";
+
+const tooltipText = computed(() => {
+  if (!props.state.cooldown_active) return READY_TOOLTIP;
+
+  const parts = [RATE_LIMIT_INTRO];
+  if (props.state.cooldown_reason_label) {
+    parts.push(`Why: ${props.state.cooldown_reason_label}`);
+  }
+  if (props.state.recommended_action) {
+    parts.push(`Action: ${props.state.recommended_action}`);
+  }
+  return parts.join(" \u2014 ");
+});
 </script>
 
 <template>
-  <span class="inline-flex items-center rounded-full border px-2 py-0.5 text-xs font-semibold" :class="toneClass">
-    {{ label }}
+  <span class="inline-flex items-center gap-1">
+    <span class="inline-flex items-center rounded-full border px-2 py-0.5 text-xs font-semibold" :class="toneClass">
+      {{ label }}
+    </span>
+    <AppHelpHint :text="tooltipText" />
   </span>
 </template>
diff --git a/frontend/src/components/patterns/ScrapeSafetyBanner.vue b/frontend/src/components/patterns/ScrapeSafetyBanner.vue
index 300b05a..6ea343d 100644
--- a/frontend/src/components/patterns/ScrapeSafetyBanner.vue
+++ b/frontend/src/components/patterns/ScrapeSafetyBanner.vue
@@ -2,6 +2,7 @@
 import { computed, onBeforeUnmount, onMounted, ref } from "vue";
 
 import AppAlert from "@/components/ui/AppAlert.vue";
+import AppHelpHint from "@/components/ui/AppHelpHint.vue";
 import {
   formatCooldownCountdown,
   type ScrapeSafetyState,
@@ -79,6 +80,10 @@ const actionText = computed(() => {
   return props.safetyState.recommended_action;
 });
 
+const bannerHintText = computed(() => {
+  return "Google Scholar rate-limits automated requests. The cooldown pauses scraping to avoid your IP being blocked.";
+});
+
 onMounted(() => {
   timer = setInterval(() => {
     now.value = Date.now();
@@ -95,7 +100,12 @@ onBeforeUnmount(() => {
 
 <template>
   <AppAlert v-if="isVisible" :tone="tone">
-    <template #title>{{ title }}</template>
+    <template #title>
+      <span class="inline-flex items-center gap-1">
+        {{ title }}
+        <AppHelpHint :text="bannerHintText" />
+      </span>
+    </template>
     <p>{{ detailText }}</p>
     <p v-if="actionText" class="text-secondary">{{ actionText }}</p>
   </AppAlert>
diff --git a/frontend/src/features/settings/SettingsAdminPanel.test.ts b/frontend/src/features/settings/SettingsAdminPanel.test.ts
new file mode 100644
index 0000000..47a9e96
--- /dev/null
+++ b/frontend/src/features/settings/SettingsAdminPanel.test.ts
@@ -0,0 +1,94 @@
+// @vitest-environment happy-dom
+import { describe, expect, it, vi, beforeEach } from "vitest";
+import { mount, flushPromises } from "@vue/test-utils";
+import { nextTick } from "vue";
+import SettingsAdminPanel from "./SettingsAdminPanel.vue";
+
+vi.mock("@/features/admin_users", () => ({
+  listAdminUsers: vi.fn().mockResolvedValue([]),
+  createAdminUser: vi.fn(),
+  setAdminUserActive: vi.fn(),
+  resetAdminUserPassword: vi.fn(),
+}));
+
+vi.mock("@/features/admin_dbops", () => ({
+  getAdminDbIntegrityReport: vi.fn().mockResolvedValue({
+    status: "ok",
+    warnings: [],
+    failures: [],
+    checked_at: null,
+    checks: [],
+  }),
+  listAdminPdfQueue: vi.fn().mockResolvedValue({
+    items: [],
+    total_count: 0,
+    has_next: false,
+    has_prev: false,
+    page: 1,
+    page_size: 50,
+  }),
+  requeueAdminPdfLookup: vi.fn(),
+  requeueAllAdminPdfLookups: vi.fn(),
+}));
+
+vi.mock("@/stores/auth", () => ({
+  useAuthStore: () => ({ isAdmin: true }),
+}));
+
+vi.mock("@/features/admin_repairs", () => ({
+  listAdminRepairTasks: vi.fn().mockResolvedValue([]),
+  runAdminRepairTask: vi.fn(),
+}));
+
+import { listAdminUsers } from "@/features/admin_users";
+import { getAdminDbIntegrityReport, listAdminPdfQueue } from "@/features/admin_dbops";
+
+const mockedListUsers = vi.mocked(listAdminUsers);
+const mockedGetReport = vi.mocked(getAdminDbIntegrityReport);
+const mockedListPdfQueue = vi.mocked(listAdminPdfQueue);
+
+describe("SettingsAdminPanel", () => {
+  beforeEach(() => {
+    mockedListUsers.mockClear();
+    mockedGetReport.mockClear();
+    mockedListPdfQueue.mockClear();
+  });
+
+  it("calls load on users section after nextTick when section=users", async () => {
+    mount(SettingsAdminPanel, { props: { section: "users" } });
+    await nextTick();
+    await nextTick();
+    await flushPromises();
+    expect(mockedListUsers).toHaveBeenCalled();
+  });
+
+  it("calls load on integrity section after nextTick when section=integrity", async () => {
+    mount(SettingsAdminPanel, { props: { section: "integrity" } });
+    await nextTick();
+    await nextTick();
+    await flushPromises();
+    expect(mockedGetReport).toHaveBeenCalled();
+  });
+
+  it("calls load on new section when section prop changes", async () => {
+    const wrapper = mount(SettingsAdminPanel, { props: { section: "users" } });
+    await nextTick();
+    await nextTick();
+    await flushPromises();
+    mockedListUsers.mockClear();
+    mockedGetReport.mockClear();
+
+    await wrapper.setProps({ section: "integrity" });
+    await nextTick();
+    await flushPromises();
+    expect(mockedGetReport).toHaveBeenCalled();
+  });
+
+  it("calls load on pdf section when section=pdf", async () => {
+    mount(SettingsAdminPanel, { props: { section: "pdf" } });
+    await nextTick();
+    await nextTick();
+    await flushPromises();
+    expect(mockedListPdfQueue).toHaveBeenCalled();
+  });
+});
diff --git a/frontend/src/features/settings/SettingsAdminPanel.vue b/frontend/src/features/settings/SettingsAdminPanel.vue
index 6e7e326..c281de1 100644
--- a/frontend/src/features/settings/SettingsAdminPanel.vue
+++ b/frontend/src/features/settings/SettingsAdminPanel.vue
@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { onMounted, watch } from "vue";
+import { nextTick, onMounted, watch } from "vue";
 import { ref } from "vue";
 
 import RequestStateAlerts from "@/components/patterns/RequestStateAlerts.vue";
@@ -43,8 +43,10 @@ async function loadSection(): Promise<void> {
   }
 }
 
-onMounted(loadSection);
-watch(() => props.section, loadSection);
+onMounted(() => {
+  nextTick(loadSection);
+});
+watch(() => props.section, loadSection, { flush: "post" });
 </script>
 
 <template>

From f8e3098fc35f3e364a91e137ee8882a78cc171f1 Mon Sep 17 00:00:00 2001
From: Justin Visser <justinfvisser@gmail.com>
Date: Sat, 7 Mar 2026 17:57:37 +0100
Subject: [PATCH 14/15] fix(backend): harden bulk endpoints and redact
 pdf-queue email for non-admins
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- W1: _parse_ids_param now returns 400 on non-integer input instead of 500
- W2: bulk_delete_scholars wraps commit in IntegrityError guard; router
  catches ScholarServiceError → 409
- W3: Move `from typing import Any` to top-level import in application.py
- W4: Redact requested_by_email in PDF queue response for non-admin users
---
 app/api/routers/admin_dbops.py       |  6 +++---
 app/api/routers/scholars.py          | 28 +++++++++++++++++++++-------
 app/services/scholars/application.py |  9 ++++++---
 3 files changed, 30 insertions(+), 13 deletions(-)

diff --git a/app/api/routers/admin_dbops.py b/app/api/routers/admin_dbops.py
index ce63ea2..048be70 100644
--- a/app/api/routers/admin_dbops.py
+++ b/app/api/routers/admin_dbops.py
@@ -57,7 +57,7 @@ def _requested_by_value(*, payload, admin_user: User) -> str:
     return from_payload or admin_user.email
 
 
-def _serialize_pdf_queue_item(item) -> dict[str, object]:
+def _serialize_pdf_queue_item(item, *, is_admin: bool = False) -> dict[str, object]:
     return {
         "publication_id": item.publication_id,
         "title": item.title,
@@ -69,7 +69,7 @@ def _serialize_pdf_queue_item(item) -> dict[str, object]:
         "last_failure_detail": item.last_failure_detail,
         "last_source": item.last_source,
         "requested_by_user_id": item.requested_by_user_id,
-        "requested_by_email": item.requested_by_email,
+        "requested_by_email": item.requested_by_email if is_admin else None,
         "queued_at": item.queued_at,
         "last_attempt_at": item.last_attempt_at,
         "resolved_at": item.resolved_at,
@@ -215,7 +215,7 @@ async def get_pdf_queue(
     return success_payload(
         request,
         data={
-            "items": [_serialize_pdf_queue_item(item) for item in queue_page.items],
+            "items": [_serialize_pdf_queue_item(item, is_admin=current_user.is_admin) for item in queue_page.items],
             **_pdf_queue_page_data(
                 total_count=queue_page.total_count,
                 page=resolved_page,
diff --git a/app/api/routers/scholars.py b/app/api/routers/scholars.py
index bca0d63..2fe44d6 100644
--- a/app/api/routers/scholars.py
+++ b/app/api/routers/scholars.py
@@ -51,7 +51,14 @@ def _parse_ids_param(ids: str | None) -> list[int] | None:
     parts = [p.strip() for p in ids.split(",") if p.strip()]
     if not parts:
         return None
-    return [int(p) for p in parts]
+    try:
+        return [int(p) for p in parts]
+    except ValueError:
+        raise ApiException(
+            status_code=400,
+            code="invalid_ids_param",
+            message="The 'ids' parameter must be a comma-separated list of integers.",
+        )
 
 
 @router.get(
@@ -104,12 +111,19 @@ async def bulk_delete_scholars(
     db_session: AsyncSession = Depends(get_db_session),
     current_user: User = Depends(get_api_current_user),
 ):
-    deleted_count = await scholar_service.bulk_delete_scholars(
-        db_session,
-        user_id=current_user.id,
-        scholar_profile_ids=payload.scholar_profile_ids,
-        upload_dir=settings.scholar_image_upload_dir,
-    )
+    try:
+        deleted_count = await scholar_service.bulk_delete_scholars(
+            db_session,
+            user_id=current_user.id,
+            scholar_profile_ids=payload.scholar_profile_ids,
+            upload_dir=settings.scholar_image_upload_dir,
+        )
+    except scholar_service.ScholarServiceError as exc:
+        raise ApiException(
+            status_code=409,
+            code="scholar_bulk_delete_failed",
+            message=str(exc),
+        ) from exc
     structured_log(
         logger,
         "info",
diff --git a/app/services/scholars/application.py b/app/services/scholars/application.py
index 07cf6b3..3496732 100644
--- a/app/services/scholars/application.py
+++ b/app/services/scholars/application.py
@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import os
+from typing import Any
 from uuid import uuid4
 
 from sqlalchemy.exc import IntegrityError
@@ -52,7 +53,11 @@ async def bulk_delete_scholars(
             _safe_remove_upload(upload_root, profile.profile_image_upload_path)
     for profile in profiles:
         await db_session.delete(profile)
-    await db_session.commit()
+    try:
+        await db_session.commit()
+    except IntegrityError as exc:
+        await db_session.rollback()
+        raise ScholarServiceError("Unable to bulk-delete scholars due to a database constraint.") from exc
     return len(profiles)
 
 
@@ -63,8 +68,6 @@ async def bulk_toggle_scholars(
     scholar_profile_ids: list[int],
     is_enabled: bool,
 ) -> int:
-    from typing import Any
-
     from sqlalchemy import CursorResult, update
 
     cursor: CursorResult[Any] = await db_session.execute(  # type: ignore[assignment]

From f501ea4f94e0613852f46d59084fc11a80dafed8 Mon Sep 17 00:00:00 2001
From: Justin Visser <justinfvisser@gmail.com>
Date: Sat, 7 Mar 2026 18:00:59 +0100
Subject: [PATCH 15/15] fix(frontend): confirm modal, settings display, race
 guard, and test coverage

- S1: Replace window.confirm() with AppConfirmModal for delete actions
- S4: Add formatHours helper to avoid ugly decimals in settings hints
- W5: Add generation counter to SettingsAdminPanel to prevent stale
  async results when section changes rapidly
- S7: Remove unused ApiRequestError import from useScholarBulkActions
- S2: Add error-path tests for bulk delete/toggle network failures
- S3: Add CSRF boundary tests for bulk-delete and bulk-toggle endpoints
---
 app/api/routers/scholars.py                   |  4 +-
 .../src/components/ui/AppConfirmModal.vue     | 28 ++++++++++
 .../composables/useScholarBulkActions.test.ts | 36 ++++++++++++
 .../composables/useScholarBulkActions.ts      | 56 ++++++++++++++-----
 .../features/settings/SettingsAdminPanel.vue  |  5 ++
 frontend/src/pages/ScholarsPage.vue           | 46 ++++++++++-----
 frontend/src/pages/SettingsPage.vue           |  9 ++-
 tests/integration/test_api_scholars_bulk.py   | 30 ++++++++++
 8 files changed, 181 insertions(+), 33 deletions(-)
 create mode 100644 frontend/src/components/ui/AppConfirmModal.vue

diff --git a/app/api/routers/scholars.py b/app/api/routers/scholars.py
index 2fe44d6..2a0c276 100644
--- a/app/api/routers/scholars.py
+++ b/app/api/routers/scholars.py
@@ -53,12 +53,12 @@ def _parse_ids_param(ids: str | None) -> list[int] | None:
         return None
     try:
         return [int(p) for p in parts]
-    except ValueError:
+    except ValueError as exc:
         raise ApiException(
             status_code=400,
             code="invalid_ids_param",
             message="The 'ids' parameter must be a comma-separated list of integers.",
-        )
+        ) from exc
 
 
 @router.get(
diff --git a/frontend/src/components/ui/AppConfirmModal.vue b/frontend/src/components/ui/AppConfirmModal.vue
new file mode 100644
index 0000000..044ca59
--- /dev/null
+++ b/frontend/src/components/ui/AppConfirmModal.vue
@@ -0,0 +1,28 @@
+<script setup lang="ts">
+import AppButton from "@/components/ui/AppButton.vue";
+import AppModal from "@/components/ui/AppModal.vue";
+
+withDefaults(
+  defineProps<{
+    open: boolean;
+    title: string;
+    message: string;
+    confirmLabel?: string;
+    cancelLabel?: string;
+    variant?: "danger" | "default";
+  }>(),
+  { confirmLabel: "Confirm", cancelLabel: "Cancel", variant: "default" },
+);
+
+const emit = defineEmits<{ confirm: []; cancel: [] }>();
+</script>
+
+<template>
+  <AppModal :open="open" :title="title" @close="emit('cancel')">
+    <p class="mb-6 text-sm text-secondary">{{ message }}</p>
+    <div class="flex justify-end gap-2">
+      <AppButton variant="secondary" @click="emit('cancel')">{{ cancelLabel }}</AppButton>
+      <AppButton :variant="variant === 'danger' ? 'danger' : 'primary'" @click="emit('confirm')">{{ confirmLabel }}</AppButton>
+    </div>
+  </AppModal>
+</template>
diff --git a/frontend/src/features/scholars/composables/useScholarBulkActions.test.ts b/frontend/src/features/scholars/composables/useScholarBulkActions.test.ts
index 868aad6..5a8dff9 100644
--- a/frontend/src/features/scholars/composables/useScholarBulkActions.test.ts
+++ b/frontend/src/features/scholars/composables/useScholarBulkActions.test.ts
@@ -109,4 +109,40 @@ describe("useScholarBulkActions", () => {
     await bulk.onApplyBulkAction();
     expect(bulk.selectedIds.value.size).toBe(0);
   });
+
+  it("bulk delete calls assignError on network failure", async () => {
+    const { bulkDeleteScholars } = await import("@/features/scholars");
+    vi.mocked(bulkDeleteScholars).mockRejectedValueOnce(new Error("Network error"));
+
+    const { bulk, callbacks } = setup([makeProfile(1, "Alice")]);
+    bulk.onToggleRow(1, { target: { checked: true } } as unknown as Event);
+    bulk.bulkAction.value = "delete_selected" as ScholarBulkAction;
+    await bulk.onApplyBulkAction();
+
+    // Trigger the confirm callback
+    expect(bulk.confirmState.value.open).toBe(true);
+    await bulk.confirmState.value.onConfirm();
+
+    expect(callbacks.assignError).toHaveBeenCalledWith(
+      expect.any(Error),
+      "Unable to bulk delete scholars.",
+    );
+    expect(bulk.bulkBusy.value).toBe(false);
+  });
+
+  it("bulk toggle calls assignError on network failure", async () => {
+    const { bulkToggleScholars } = await import("@/features/scholars");
+    vi.mocked(bulkToggleScholars).mockRejectedValueOnce(new Error("Network error"));
+
+    const { bulk, callbacks } = setup([makeProfile(1, "Alice")]);
+    bulk.onToggleRow(1, { target: { checked: true } } as unknown as Event);
+    bulk.bulkAction.value = "enable_selected" as ScholarBulkAction;
+    await bulk.onApplyBulkAction();
+
+    expect(callbacks.assignError).toHaveBeenCalledWith(
+      expect.any(Error),
+      "Unable to bulk enable scholars.",
+    );
+    expect(bulk.bulkBusy.value).toBe(false);
+  });
 });
diff --git a/frontend/src/features/scholars/composables/useScholarBulkActions.ts b/frontend/src/features/scholars/composables/useScholarBulkActions.ts
index f4910a7..51cace7 100644
--- a/frontend/src/features/scholars/composables/useScholarBulkActions.ts
+++ b/frontend/src/features/scholars/composables/useScholarBulkActions.ts
@@ -6,7 +6,6 @@ import {
   exportScholarData,
   type ScholarProfile,
 } from "@/features/scholars";
-import { ApiRequestError } from "@/lib/api/errors";
 
 export type ScholarBulkAction =
   | "delete_selected"
@@ -21,6 +20,14 @@ export interface ScholarBulkActionOption {
   label: string;
 }
 
+export interface ConfirmState {
+  open: boolean;
+  title: string;
+  message: string;
+  variant: "danger" | "default";
+  onConfirm: () => void;
+}
+
 export interface BulkActionCallbacks {
   clearMessages: () => void;
   assignError: (error: unknown, fallback: string) => void;
@@ -35,6 +42,7 @@ export function useScholarBulkActions(
   const selectedIds = ref<Set<number>>(new Set());
   const bulkAction = ref<ScholarBulkAction>("select_all");
   const bulkBusy = ref(false);
+  const confirmState = ref<ConfirmState>({ open: false, title: "", message: "", variant: "default", onConfirm: () => {} });
 
   const selectedCount = computed(() => selectedIds.value.size);
   const hasSelection = computed(() => selectedCount.value > 0);
@@ -128,21 +136,36 @@ export function useScholarBulkActions(
     if (bulkAction.value === "export_selected") { await onBulkExport(); return; }
   }
 
-  async function onBulkDelete(): Promise<void> {
+  function dismissConfirm(): void {
+    confirmState.value = { ...confirmState.value, open: false };
+  }
+
+  function requestConfirm(title: string, message: string, variant: "danger" | "default", onConfirm: () => void): void {
+    confirmState.value = { open: true, title, message, variant, onConfirm };
+  }
+
+  function onBulkDelete(): void {
     const ids = [...selectedIds.value];
-    if (!window.confirm(`Delete ${ids.length} scholar(s)? This removes all linked publications and queue data.`)) return;
-    bulkBusy.value = true;
-    callbacks.clearMessages();
-    try {
-      const result = await bulkDeleteScholars(ids);
-      callbacks.setSuccess(`${result.deleted_count} scholar(s) deleted.`);
-      selectedIds.value = new Set();
-      await callbacks.reloadScholars();
-    } catch (error) {
-      callbacks.assignError(error, "Unable to bulk delete scholars.");
-    } finally {
-      bulkBusy.value = false;
-    }
+    requestConfirm(
+      `Delete ${ids.length} scholar(s)?`,
+      "This removes all linked publications and queue data. This action cannot be undone.",
+      "danger",
+      async () => {
+        dismissConfirm();
+        bulkBusy.value = true;
+        callbacks.clearMessages();
+        try {
+          const result = await bulkDeleteScholars(ids);
+          callbacks.setSuccess(`${result.deleted_count} scholar(s) deleted.`);
+          selectedIds.value = new Set();
+          await callbacks.reloadScholars();
+        } catch (error) {
+          callbacks.assignError(error, "Unable to bulk delete scholars.");
+        } finally {
+          bulkBusy.value = false;
+        }
+      },
+    );
   }
 
   async function onBulkToggle(isEnabled: boolean): Promise<void> {
@@ -188,6 +211,9 @@ export function useScholarBulkActions(
     bulkActionOptions,
     bulkApplyLabel,
     bulkApplyDisabled,
+    confirmState,
+    dismissConfirm,
+    requestConfirm,
     onToggleAll,
     onToggleRow,
     onApplyBulkAction,
diff --git a/frontend/src/features/settings/SettingsAdminPanel.vue b/frontend/src/features/settings/SettingsAdminPanel.vue
index c281de1..d7ee685 100644
--- a/frontend/src/features/settings/SettingsAdminPanel.vue
+++ b/frontend/src/features/settings/SettingsAdminPanel.vue
@@ -25,7 +25,10 @@ const integrityRef = ref<InstanceType<typeof AdminIntegritySection> | null>(null
 const repairsRef = ref<InstanceType<typeof AdminRepairsSection> | null>(null);
 const pdfQueueRef = ref<InstanceType<typeof AdminPdfQueueSection> | null>(null);
 
+let loadGeneration = 0;
+
 async function loadSection(): Promise<void> {
+  const gen = ++loadGeneration;
   clearAlerts();
   try {
     if (props.section === SECTION_USERS && usersRef.value) {
@@ -34,11 +37,13 @@ async function loadSection(): Promise<void> {
       await integrityRef.value.load();
     } else if (props.section === SECTION_REPAIRS) {
       await usersRef.value?.load();
+      if (gen !== loadGeneration) return;
       await repairsRef.value?.load();
     } else if (props.section === SECTION_PDF && pdfQueueRef.value) {
       await pdfQueueRef.value.load();
     }
   } catch (error) {
+    if (gen !== loadGeneration) return;
     assignError(error, "Unable to load admin data.");
   }
 }
diff --git a/frontend/src/pages/ScholarsPage.vue b/frontend/src/pages/ScholarsPage.vue
index c962242..3899888 100644
--- a/frontend/src/pages/ScholarsPage.vue
+++ b/frontend/src/pages/ScholarsPage.vue
@@ -6,6 +6,7 @@ import AsyncStateGate from "@/components/patterns/AsyncStateGate.vue";
 import RequestStateAlerts from "@/components/patterns/RequestStateAlerts.vue";
 import AppButton from "@/components/ui/AppButton.vue";
 import AppCard from "@/components/ui/AppCard.vue";
+import AppConfirmModal from "@/components/ui/AppConfirmModal.vue";
 import AppEmptyState from "@/components/ui/AppEmptyState.vue";
 import AppHelpHint from "@/components/ui/AppHelpHint.vue";
 import AppInput from "@/components/ui/AppInput.vue";
@@ -272,23 +273,30 @@ async function onToggleScholar(): Promise<void> {
   }
 }
 
-async function onDeleteScholar(): Promise<void> {
+function onDeleteScholar(): void {
   const profile = activeScholarSettings.value;
   if (!profile) return;
   const label = scholarLabel(profile);
-  if (!window.confirm(`Delete scholar ${label}? This removes all linked publications and queue data.`)) return;
-  activeScholarId.value = profile.id;
-  clearMessages();
-  try {
-    await deleteScholar(profile.id);
-    successMessage.value = `${label} deleted.`;
-    activeScholarSettingsId.value = null;
-    await loadScholars();
-  } catch (error) {
-    assignError(error, "Unable to delete scholar.");
-  } finally {
-    activeScholarId.value = null;
-  }
+  bulk.requestConfirm(
+    `Delete ${label}?`,
+    "This removes all linked publications and queue data. This action cannot be undone.",
+    "danger",
+    async () => {
+      bulk.dismissConfirm();
+      activeScholarId.value = profile.id;
+      clearMessages();
+      try {
+        await deleteScholar(profile.id);
+        successMessage.value = `${label} deleted.`;
+        activeScholarSettingsId.value = null;
+        await loadScholars();
+      } catch (error) {
+        assignError(error, "Unable to delete scholar.");
+      } finally {
+        activeScholarId.value = null;
+      }
+    },
+  );
 }
 
 async function onSaveImageUrl(): Promise<void> {
@@ -597,6 +605,16 @@ watch(
       @toggle="onToggleScholar"
       @delete="onDeleteScholar"
     />
+
+    <AppConfirmModal
+      :open="bulk.confirmState.value.open"
+      :title="bulk.confirmState.value.title"
+      :message="bulk.confirmState.value.message"
+      :variant="bulk.confirmState.value.variant"
+      confirm-label="Delete"
+      @confirm="bulk.confirmState.value.onConfirm()"
+      @cancel="bulk.dismissConfirm()"
+    />
   </AppPage>
 </template>
 
diff --git a/frontend/src/pages/SettingsPage.vue b/frontend/src/pages/SettingsPage.vue
index e1c0e2b..3fb50fc 100644
--- a/frontend/src/pages/SettingsPage.vue
+++ b/frontend/src/pages/SettingsPage.vue
@@ -168,6 +168,11 @@ function parseBoundedInteger(value: string, label: string, minimum: number): num
   return parsed;
 }
 
+function formatHours(minutes: number): string {
+  const h = minutes / 60;
+  return Number.isInteger(h) ? String(h) : h.toFixed(2).replace(/\.?0+$/, "");
+}
+
 function parseHoursToMinutes(value: string, minMinutes: number): number {
   const hours = Number(value);
   if (!Number.isFinite(hours) || hours <= 0) {
@@ -175,7 +180,7 @@ function parseHoursToMinutes(value: string, minMinutes: number): number {
   }
   const minutes = Math.round(hours * 60);
   if (minutes < minMinutes) {
-    throw new Error(`Check interval must be at least ${minMinutes / 60} hours.`);
+    throw new Error(`Check interval must be at least ${formatHours(minMinutes)} hours.`);
   }
   return minutes;
 }
@@ -372,7 +377,7 @@ onMounted(async () => {
                 <AppHelpHint text="Minimum is controlled by server policy." />
               </span>
               <AppInput v-model="runIntervalHours" inputmode="decimal" />
-              <span class="text-xs text-secondary">Minimum: {{ minCheckIntervalMinutes / 60 }} hours</span>
+              <span class="text-xs text-secondary">Minimum: {{ formatHours(minCheckIntervalMinutes) }} hours</span>
             </label>
 
             <label class="grid gap-2 text-sm font-medium text-ink-secondary">
diff --git a/tests/integration/test_api_scholars_bulk.py b/tests/integration/test_api_scholars_bulk.py
index a481c32..28be206 100644
--- a/tests/integration/test_api_scholars_bulk.py
+++ b/tests/integration/test_api_scholars_bulk.py
@@ -138,3 +138,33 @@ async def test_export_with_ids_filter(db_session: AsyncSession) -> None:
     resp_all = client.get("/api/v1/scholars/export")
     assert resp_all.status_code == 200
     assert len(resp_all.json()["data"]["scholars"]) == 2
+
+
+@pytest.mark.integration
+@pytest.mark.db
+@pytest.mark.asyncio
+async def test_bulk_delete_rejects_without_csrf(db_session: AsyncSession) -> None:
+    await insert_user(db_session, email="csrf-bulk-del@example.com", password="pw123456")
+    client = TestClient(app)
+    login_user(client, email="csrf-bulk-del@example.com", password="pw123456")
+    response = client.post(
+        "/api/v1/scholars/bulk-delete",
+        json={"scholar_profile_ids": [1]},
+    )
+    assert response.status_code == 403
+    assert response.json()["error"]["code"] == "csrf_invalid"
+
+
+@pytest.mark.integration
+@pytest.mark.db
+@pytest.mark.asyncio
+async def test_bulk_toggle_rejects_without_csrf(db_session: AsyncSession) -> None:
+    await insert_user(db_session, email="csrf-bulk-tog@example.com", password="pw123456")
+    client = TestClient(app)
+    login_user(client, email="csrf-bulk-tog@example.com", password="pw123456")
+    response = client.post(
+        "/api/v1/scholars/bulk-toggle",
+        json={"scholar_profile_ids": [1], "is_enabled": False},
+    )
+    assert response.status_code == 403
+    assert response.json()["error"]["code"] == "csrf_invalid"