Table dates and User dates (#22169 )

User-collection-table didn´t format and if you have da backoffice the time is still Am/pm Co-authored-by: Lucas Bach Bisgaard <lucas.bisgaard@kraftvaerk.com> Co-authored-by: Niels Lyngsø <nsl@umbraco.dk> Co-authored-by: Mads Rasmussen <madsr@hey.com>
Fix detail data request manager failing when items hit 40, making document unusable (#23164 )
2026-06-26 09:24:35 +02:00 · 2026-06-26 09:09:11 +02:00 · 2026-06-25 15:59:33 +02:00 · 2026-06-24 09:37:53 +00:00 · 2026-06-24 09:29:21 +00:00 · 2026-06-23 14:29:24 +02:00
1384 changed files with 43664 additions and 7771 deletions
@@ -0,0 +1,135 @@
+---
+name: umb-release-notes
+description: Improve a set of auto-generated GitHub release notes for an Umbraco CMS release. Cross-checks the notes against every PR carrying the release label, adds any that are missing, re-files every PR under the most appropriate category, and strips purely-internal entries. Use whenever the user asks to tidy up, improve, complete, or recategorize release notes for a given version, or mentions a release-notes text file plus a version number.
+argument-hint: <version> <path-to-generated-notes-file>
+---
+
+# Umbraco CMS - Improve Release Notes
+
+Takes a file of auto-generated GitHub release notes and produces an improved version that:
+
+1. **Is complete** — every merged PR carrying the `release/<version>` label appears.
+2. **Is well-categorized** — every PR sits under the most appropriate heading.
+3. **Is free of noise** — purely-internal entries of no value to a reader are removed.
+
+The result is written to a **new** file alongside the input, so the user can diff the two.
+
+**Run autonomously.** Do NOT use `AskUserQuestion` once the required arguments (version and input file path) are available — only ask if one of them is missing from `$ARGUMENTS` and cannot be inferred (see Arguments). Beyond that, make the categorization calls yourself using the rules below; if a handful are genuinely borderline, place them anyway and note the borderline ones in your closing summary so the user can override.
+
+## Arguments
+
+`$ARGUMENTS` contains two values:
+
+1. **Version** — e.g. `17.5.0`, `18.1.0`. The GitHub label to search is `release/<version>` (so version `17.5.0` → label `release/17.5.0`).
+2. **Input file path** — full path to the text file holding the auto-generated notes (e.g. `C:\Temp\release-17.5.0-rc.md`).
+
+If either is missing, ask the user once for the missing value, then proceed.
+
+## Prerequisites
+
+Run `gh auth status`. If it fails, tell the user to authenticate `gh` (e.g. `gh auth login`) and stop — the skill needs the GitHub CLI to query PRs. The repo is always `umbraco/Umbraco-CMS`.
+
+## Procedure
+
+### 1. Read the input notes
+
+Read the input file. Note its structure — it is GitHub's generated format:
+
+- A leading HTML comment (`<!-- Release notes generated ... -->`).
+- A `## What's Changed` heading followed by `### <emoji> <Category>` sub-headings, each with `* <title> by @<author> in <url>` bullets.
+- A trailing `## New Contributors` section and a `**Full Changelog**: ...` line.
+
+Extract the set of PR numbers already present (parse the `/pull/<number>` from each bullet). Preserve each existing bullet's **exact text** (title, author, URL) when you re-emit it — only its category placement may change.
+
+### 2. Fetch every labelled PR
+
+```bash
+gh pr list --repo umbraco/Umbraco-CMS --label "release/<version>" --state closed --limit 1000 \
+  --json number,title,author,labels,mergedAt \
+  --jq '.[] | select(.mergedAt != null) | "\(.number)\t\(.author.login)\t\([.labels[].name] | join(", "))\t\(.title)"' | sort -n
+```
+
+This is the authoritative list of what the release *should* contain. Each row gives number, author, labels, title.
+
+**Guard against silent truncation.** `gh pr list` caps at `--limit` without warning, so a large release could drop the overflow and the skill would still look "complete". Count the returned rows and compare against the limit:
+
+```bash
+gh pr list --repo umbraco/Umbraco-CMS --label "release/<version>" --state closed --limit 1000 --json number --jq 'length'
+```
+
+If this equals 1000, the limit was hit — raise `--limit` and re-fetch before continuing. Do **not** proceed on a truncated list.
+
+### 3. Reconcile
+
+- **Missing labelled PRs** (labelled but not in the input file): these must be **added**. Build a bullet as `* <title> by @<author> in https://github.com/umbraco/Umbraco-CMS/pull/<number>`.
+  - **Author handle.** `<author>` in the template is the raw `.author.login` value — the bullet supplies the leading `@`, so do not prepend another. `gh`'s `.author.login` already returns bot accounts with the `[bot]` suffix as part of the login — Dependabot comes back as `dependabot[bot]`, not `dependabot` or `app/dependabot` (the `app/` form only appears in git committer metadata and CODEOWNERS, never in `gh`'s JSON). So the login is already in the right shape; use it verbatim (e.g. `.author.login` of `dependabot[bot]` renders as `@dependabot[bot]`, matching what GitHub's generator wrote for the existing bullets). The only thing to guard against is accidentally stripping or altering the `[bot]` suffix.
+- **PRs in the file but not labelled**: keep them. The generated notes span a commit range (see the `Full Changelog` compare link), so they legitimately include backports / earlier-version PRs that lack the current label. For any of these you need to categorize, fetch its labels with:
+
+  ```bash
+  gh pr view <number> --repo umbraco/Umbraco-CMS --json number,title,labels \
+    --jq '"\(.number)\t\([.labels[].name] | join(", "))\t\(.title)"'
+  ```
+
+Do **not** invent or alter the `New Contributors` section — carry it over verbatim. You cannot reliably recompute first-time contributors, so leave it as the generator produced it (mention this in the summary).
+
+### 4. Categorize every PR
+
+Use exactly these headings, in this order. Omit any heading that ends up with no entries.
+
+| Heading | What goes here | Primary signal |
+|---|---|---|
+| `### 🙌 Notable Changes` | **Don't recategorize existing entries.** Label-driven — but still add any missing PR carrying this label here. | label `category/notable` |
+| `### 💥 Breaking Changes` | **Don't recategorize existing entries.** Label-driven — but still add any missing PR carrying this label here. | label `category/breaking` |
+| `### 📦 Dependencies` | Dependency bumps | label `dependencies`; or dependabot author |
+| `### 🚀 New Features` | New user- or developer-facing capability | label `type/feature` / `category/feature`; or title introduces/adds a genuinely new capability |
+| `### 🚤 Performance` | Performance improvements | label `category/performance`; or `Performance:` title prefix |
+| `### 🌈 Accessibility Improvements` | A11y improvements (labels, contrast, keyboard) | label `category/accessibility` / `accessibility`; or clear a11y intent (e.g. "improve contrast", "missing labels") |
+| `### 🐛 Bug Fixes` | Fixes to broken/incorrect behaviour | default for anything describing a fix |
+| `### 🧪 Testing` | Test additions/changes only | label `category/test-automation` / `area/test`; or `E2E`/`QA`/"acceptance tests"/"unit test coverage"/"add tests" titles |
+| `### 🛡️ Code Quality, Documentation and Refactoring` | Refactors, deprecations, API tidy-ups, XML/MD documentation, knowledge-base (`MD`) updates | label `category/refactor`; or titles about refactoring, deprecating, renaming, documenting, constants extraction, MD/CLAUDE.md content |
+| `### 🧑‍💻 Developer Experience` | Things that improve the experience of developers building on or contributing to Umbraco — dev tooling, build/watch ergonomics, test mocks/harnesses, backoffice dev utilities | `Developer Experience` title prefix; dev tooling; mock/harness changes |
+
+**Rules:**
+
+- **Notable and Breaking are off-limits for recategorization** — never move a PR that is *already in the input file* into or out of these sections; they are driven purely by their labels and the generator placed them correctly. This does **not** exempt them from completeness: a PR discovered as missing in step 3 that carries `category/notable` or `category/breaking` must still be **added** under the matching section.
+- Label signals beat title wording, except a `Performance:`/`Developer Experience:` title prefix is decisive for its section.
+- A PR with both `type/feature` and `category/refactor` whose title clearly describes a refactor (e.g. "swap relative imports", "re-export type") belongs under Code Quality, not New Features.
+- "Add ... tests"/"unit test coverage" → Testing, even if it also touches docs. If a PR adds XML documentation *and* tests, lead with where the title's emphasis lies (documentation → Code Quality; test coverage → Testing).
+- When a PR is genuinely 50/50, pick the more reader-useful heading and list it in your closing summary as borderline.
+
+### 5. Remove purely-internal noise
+
+Drop entries that have **no value to anyone reading release notes** — pure repository plumbing with no shipped impact. Examples:
+
+- Branch/merge maintenance ("Fix main branch after merge issue").
+- CI/pipeline fixes that don't change the product.
+- Reverts of changes that never shipped in a release.
+
+**Keep** anything that ships in the product or genuinely helps developers building on Umbraco — that includes documentation/MD updates, dev tooling, and test mocks (those go to Code Quality or Developer Experience, they are *not* noise). When unsure whether something is noise, keep it and flag it in the summary rather than silently dropping it. List every removal in your closing summary.
+
+### 6. Write the output
+
+Write to a new file in the **same folder** as the input, named by appending ` - with updates` before the extension:
+
+- Input `C:\Temp\release-17.5.0-rc.md` → Output `C:\Temp\release-17.5.0-rc - with updates.md`
+
+Preserve the leading HTML comment, the `## What's Changed` heading, the `## New Contributors` section, and the `**Full Changelog**` line exactly. Only the `### <category>` groupings and their bullets change.
+
+### 7. Report
+
+Give a concise summary:
+
+- Count of PRs added (with their numbers), and which categories they landed in.
+- Notable recategorizations (PRs moved out of the catch-all Bug Fixes into Features/Performance/Testing/etc.).
+- Every entry removed, with the one-line reason.
+- Any borderline calls the user may want to override.
+- The output file path.
+
+## Verification
+
+Before reporting done, confirm:
+
+- Every PR number from step 2 is present in the output (except any you deliberately removed in step 5 — and those must be in the removal list).
+- No PR appears under more than one heading.
+- Notable and Breaking sections are byte-for-byte unchanged from the input.
+- The header comment, New Contributors, and Full Changelog lines are intact.
@@ -435,6 +435,14 @@ When a PR changes Management API controllers or models, the `OpenApi.json` file

 The backoffice is published to npm as `@umbraco-cms/backoffice`. Runtime dependencies are provided via importmap; npm peerDependencies provide types only. For full details on dependency hoisting, version range logic, and plugin development, see `/src/Umbraco.Web.UI.Client/CLAUDE.md` → "npm Package Publishing".

+### SQL Server 2100-parameter limit
+
+Any `WHERE IN (@0, @1, ...)` built from a runtime-sized collection risks hitting SQL Server's 2100-parameter ceiling and throwing `SqlException` 8003 in production.
+
+Batch with `IEnumerable<T>.InGroupsOf(Constants.Sql.MaxParameterCount)` or `Database.FetchByGroups(...)` whenever the collection size is driven by user data — not just when it currently fits. Watch for products of two scaling dimensions (documents × languages, properties × versions) and config-tunable batch sizes whose defaults are safe but ceilings aren't.
+
+Full guidance, safe patterns and decision rule: see `/src/Umbraco.Infrastructure/CLAUDE.md` → "Avoiding the SQL Server 2100-parameter limit".
+
 ### Known Limitations

 1. **Circular Dependencies**: Avoided via `Lazy<T>` or event notifications
@@ -505,6 +513,42 @@ Labels are only added, never removed. Claude applies only labels it is confident

 ---

+## 8. Code Comment Policy
+
+**Default to no comment.** Applies to all code in this repository — C#, TypeScript, Razor, build scripts. Well-named identifiers and small functions are the primary form of self-documentation; comments are a fallback for the rare cases where the code itself cannot carry the meaning.
+
+### When NOT to comment
+
+- **Don't restate what the code does.** A line calling `resetState()` does not need `// Reset state`. A method named `validateInput` does not need `// Validate input`.
+- **Don't narrate a sequence of calls.** If three lines run in order, the order is in the code — don't paraphrase it above.
+- **Don't reference the current task, fix, callers, or PR.** No `// Fix for X`, `// Used by Y`, `// Added for the Z flow`, `// See PR #1234`. That belongs in commit messages and PR descriptions; in source it rots as the codebase evolves.
+
+### When a comment IS justified
+
+Write a comment only when **removing it would leave a future reader confused**. Concretely:
+
+- **A non-obvious WHY.** A hidden constraint, business rule, or ordering requirement that is not visible from the code.
+- **A workaround for a specific bug or platform quirk.** Link the issue (`(#21996)`, `https://...`) so the comment can be deleted once the upstream fix lands.
+- **A subtle invariant** that the type system or method names do not enforce.
+- **An edge case the code intentionally handles** that would surprise a reader (e.g. "must run before X because Y").
+- **API documentation** — XML doc comments on C# members, JSDoc on exported TypeScript symbols. Required for the public contract; still keep them concise.
+
+### TODOs
+
+Allowed, but cheap to write and cheaper to leave behind. Keep them short and trackable: `// TODO (V19): remove once obsolete overload is gone` or `// TODO: pagination [NL]`. A TODO should have an author or a version trigger.
+
+---
+
+## 9. Testing Practices
+
+### Tests for a bug fix must fail before the fix
+
+Verify any test you add for a bug fix actually catches the bug: either write the failing test first (TDD), or temporarily revert the production change and confirm the test fails before re-applying. A test that passes both ways proves nothing. Watch for coincidental passes — default seed/sort orders can make a buggy path produce the right answer for the test's specific inputs; construct inputs so the broken and fixed behaviours give visibly different results.
+
+For integration tests that exercise caching or cache refreshers, see `tests/Umbraco.Tests.Integration/CLAUDE.md` — the harness disables caching by default, which can produce false greens.
+
+---
+
 ## Quick Reference

 ### Essential Commands
@@ -45,15 +45,15 @@
    <PackageVersion Include="Asp.Versioning.Mvc" Version="8.1.1" />
    <PackageVersion Include="Asp.Versioning.Mvc.ApiExplorer" Version="8.1.1" />
    <PackageVersion Include="Dazinator.Extensions.FileProviders" Version="2.0.0" />
-    <PackageVersion Include="Examine" Version="3.7.1" />
-    <PackageVersion Include="Examine.Core" Version="3.7.1" />
+    <PackageVersion Include="Examine" Version="3.8.0" />
+    <PackageVersion Include="Examine.Core" Version="3.8.0" />
    <PackageVersion Include="HtmlAgilityPack" Version="1.12.4" />
    <PackageVersion Include="JsonPatch.Net" Version="3.3.0" />
    <PackageVersion Include="K4os.Compression.LZ4" Version="1.3.8" />
    <PackageVersion Include="MailKit" Version="4.16.0" />
    <PackageVersion Include="Markdig" Version="0.45.0" />
    <PackageVersion Include="Markdown" Version="2.2.1" />
-    <PackageVersion Include="MessagePack" Version="3.1.4" />
+    <PackageVersion Include="MessagePack" Version="3.1.7" />
    <PackageVersion Include="MiniProfiler.AspNetCore.Mvc" Version="4.5.4" />
    <PackageVersion Include="MiniProfiler.Shared" Version="4.5.4" />
    <PackageVersion Include="ncrontab" Version="3.4.0" />
@@ -92,4 +92,4 @@
    <!-- TODO: Remove this pinned dependency when Examine updates its Microsoft.AspNetCore.DataProtection reference. -->
    <PackageVersion Include="System.Security.Cryptography.Xml" Version="10.0.6" />
  </ItemGroup>
-</Project>
+</Project>
@@ -825,74 +825,31 @@ stages:
                publishFeedCredentials: "MyGet - Umbraco Nightly"
              ${{ else }}:
                publishFeedCredentials: "MyGet - Pre-releases"
+      # Pre-release/nightly feeds: keep the `latest` dist-tag default (no `next` split).
      - job:
        displayName: Push to pre-release feed (npm)
        steps:
-          - checkout: none
-          - download: current
-            artifact: npm
-          - bash: |
-              # Check if we are on a nightly build
-              if [ $isNightly = "False" ]; then
-                  echo "##[debug]Prerelease build detected"
-                  registry="https://www.myget.org/F/umbracoprereleases/npm/"
-              else
-                  echo "##[debug]Nightly build detected"
-                  registry="https://www.myget.org/F/umbraconightly/npm/"
-              fi
-              echo "@umbraco-cms:registry=$registry" >> .npmrc
-            env:
-              isNightly: ${{parameters.isNightly}}
-            workingDirectory: $(Pipeline.Workspace)/npm
-            displayName: Add scoped registry to .npmrc
-          - task: npmAuthenticate@0
-            displayName: Authenticate with npm (MyGet)
-            inputs:
-              workingFile: "$(Pipeline.Workspace)/npm/.npmrc"
+          - template: templates/npm-publish.yml
+            parameters:
+              artifactName: npm
              customEndpoint: "MyGet (npm) - Umbracoprereleases, MyGet (npm) - Umbraconightly"
-          - bash: |
-              # Setup temp npm project to load in defaults from the local .npmrc
-              npm init -y
-
-              # Find the first .tgz file in the current directory and publish it
-              files=( ./*.tgz )
-              npm publish "${files[0]}"
-            displayName: Push to npm (MyGet)
-            workingDirectory: $(Pipeline.Workspace)/npm
+              displayName: Push to npm (MyGet)
+              ${{ if eq(parameters.isNightly, true) }}:
+                registry: https://www.myget.org/F/umbraconightly/npm/
+              ${{ else }}:
+                registry: https://www.myget.org/F/umbracoprereleases/npm/
      - job: PublishTestHelpersNpm
        displayName: Push TestHelpers to pre-release feed (npm)
        steps:
-          - checkout: none
-          - download: current
-            artifact: npm-testhelpers
-          - bash: |
-              # Check if we are on a nightly build
-              if [ $isNightly = "False" ]; then
-                  echo "##[debug]Prerelease build detected"
-                  registry="https://www.myget.org/F/umbracoprereleases/npm/"
-              else
-                  echo "##[debug]Nightly build detected"
-                  registry="https://www.myget.org/F/umbraconightly/npm/"
-              fi
-              echo "@umbraco-cms:registry=$registry" >> .npmrc
-            env:
-              isNightly: ${{parameters.isNightly}}
-            workingDirectory: $(Pipeline.Workspace)/npm-testhelpers
-            displayName: Add scoped registry to .npmrc
-          - task: npmAuthenticate@0
-            displayName: Authenticate with npm (MyGet)
-            inputs:
-              workingFile: "$(Pipeline.Workspace)/npm-testhelpers/.npmrc"
+          - template: templates/npm-publish.yml
+            parameters:
+              artifactName: npm-testhelpers
              customEndpoint: "MyGet (npm) - Umbracoprereleases, MyGet (npm) - Umbraconightly"
-          - bash: |
-              # Setup temp npm project to load in defaults from the local .npmrc
-              npm init -y
-
-              # Find the first .tgz file in the current directory and publish it
-              files=( ./*.tgz )
-              npm publish "${files[0]}"
-            displayName: Push test helpers to npm (MyGet)
-            workingDirectory: $(Pipeline.Workspace)/npm-testhelpers
+              displayName: Push test helpers to npm (MyGet)
+              ${{ if eq(parameters.isNightly, true) }}:
+                registry: https://www.myget.org/F/umbraconightly/npm/
+              ${{ else }}:
+                registry: https://www.myget.org/F/umbracoprereleases/npm/

  - stage: Deploy_NuGet
    displayName: NuGet release
@@ -941,53 +898,30 @@ stages:
    condition: and(in(dependencies.Deploy_NuGet.result, 'Succeeded', 'SucceededWithIssues'), or(eq(dependencies.Build.outputs['A.build.NBGV_PublicRelease'], 'True'), ${{parameters.npmDeploy}}))
    dependsOn:
      - Deploy_NuGet
+    variables:
+      # `latest` for stable releases, `next` for prereleases.
+      npmDistTag: $[ iif(eq(stageDependencies.Build.A.outputs['build.NBGV_PrereleaseVersionNoLeadingHyphen'], ''), 'latest', 'next') ]
    jobs:
      - job: Publish
        displayName: Push to NPM
        steps:
-          - checkout: none
-          - download: current
-            artifact: npm
-          - bash: echo "@umbraco-cms:registry=https://registry.npmjs.org" >> .npmrc
-            workingDirectory: $(Pipeline.Workspace)/npm
-            displayName: Add scoped registry to .npmrc
-          - task: npmAuthenticate@0
-            displayName: Authenticate with npm
-            inputs:
-              workingFile: $(Pipeline.Workspace)/npm/.npmrc
+          - template: templates/npm-publish.yml
+            parameters:
+              artifactName: npm
+              registry: https://registry.npmjs.org/
              customEndpoint: "NPM - Umbraco Backoffice"
-          - script: |
-              # Setup temp npm project to load in defaults from the local .npmrc
-              npm init -y
-
-              # Find the first .tgz file in the current directory and publish it
-              files=( ./*.tgz )
-              npm publish "${files[0]}"
-            displayName: Push to npm
-            workingDirectory: $(Pipeline.Workspace)/npm
+              displayName: Push to npm
+              npmTag: $(npmDistTag)
      - job: PublishTestHelpers
        displayName: Push Test Helpers to NPM
        steps:
-          - checkout: none
-          - download: current
-            artifact: npm-testhelpers
-          - bash: echo "@umbraco-cms:registry=https://registry.npmjs.org" >> .npmrc
-            workingDirectory: $(Pipeline.Workspace)/npm-testhelpers
-            displayName: Add scoped registry to .npmrc
-          - task: npmAuthenticate@0
-            displayName: Authenticate with npm
-            inputs:
-              workingFile: $(Pipeline.Workspace)/npm-testhelpers/.npmrc
+          - template: templates/npm-publish.yml
+            parameters:
+              artifactName: npm-testhelpers
+              registry: https://registry.npmjs.org/
              customEndpoint: "NPM - Umbraco Backoffice"
-          - script: |
-              # Setup temp npm project to load in defaults from the local .npmrc
-              npm init -y
-
-              # Find the first .tgz file in the current directory and publish it
-              files=( ./*.tgz )
-              npm publish "${files[0]}"
-            displayName: Push test helpers to npm
-            workingDirectory: $(Pipeline.Workspace)/npm-testhelpers
+              displayName: Push test helpers to npm
+              npmTag: $(npmDistTag)

  - stage: Upload_API_Docs
    pool:
@@ -5,10 +5,10 @@ trigger: none

 schedules:
  - cron: '0 3 * * *'
-    displayName: Daily 3AM build (main)
+    displayName: Daily 3AM build (v17/dev)
    branches:
      include:
-        - main
+        - v17/dev

 parameters:
  - name: skipIntegrationTests
@@ -0,0 +1,28 @@
+parameters:
+  - name: artifactName # "npm" or "npm-testhelpers"
+    type: string
+  - name: registry # scoped-registry URL to publish to
+    type: string
+  - name: customEndpoint # npmAuthenticate service connection(s)
+    type: string
+  - name: displayName # label for the publish step
+    type: string
+  - name: npmTag # dist-tag to publish under
+    type: string
+    default: latest
+
+steps:
+  - checkout: none
+  - download: current
+    artifact: ${{ parameters.artifactName }}
+  - script: npm config set @umbraco-cms:registry ${{ parameters.registry }} --location=project
+    displayName: Add scoped registry to .npmrc
+    workingDirectory: $(Pipeline.Workspace)/${{ parameters.artifactName }}
+  - task: npmAuthenticate@0
+    displayName: Authenticate with npm
+    inputs:
+      workingFile: $(Pipeline.Workspace)/${{ parameters.artifactName }}/.npmrc
+      customEndpoint: ${{ parameters.customEndpoint }}
+  - script: npm publish *.tgz --tag ${{ parameters.npmTag }}
+    displayName: ${{ parameters.displayName }}
+    workingDirectory: $(Pipeline.Workspace)/${{ parameters.artifactName }}
@@ -1,244 +0,0 @@
-# Research: IDistributedBackgroundJob Write Lock Timeout in Load-Balanced Setup
-
-**Issue**: [#22113](https://github.com/umbraco/Umbraco-CMS/issues/22113)
-**Error**: `Failed to acquire write lock for id: -347`
-**Lock -347**: `Constants.Locks.DistributedJobs` (all distributed background jobs)
-
---
-
-## Summary
-
-The root cause is most likely **SQL Server page-level lock contention** on the `umbracoLock` table, caused by long-running content operations (inside the user's distributed job) holding REPEATABLEREAD locks on one row (e.g., `-333` ContentTree) which block write access to *all other rows on the same data page* (including `-347` DistributedJobs).
-
-This is exacerbated by:
-1. **Nested scope transaction sharing** - the user's outer scope holds the transaction (and all locks) open for the entire job duration
-2. **Small table, single page** - all ~18 lock rows fit on one 8KB SQL Server data page
-3. **5-second write lock timeout** - the default is too short when contention exists
-4. **Backoffice activity** adding further lock pressure on the same table
-
---
-
-## Detailed Analysis
-
-### The Lock Table Problem
-
-The `umbracoLock` table has approximately 18 rows (IDs -331 through -348). In SQL Server, a standard data page is 8KB. These 18 small rows (each just `id INT`, `name NVARCHAR`, `value INT`) **all fit on a single data page**.
-
-SQL Server's lock granularity decisions:
- For small tables, the query optimizer may choose **page-level locks** instead of row-level locks
- The `WITH (REPEATABLEREAD)` table hint in the locking SQL means locks are held until the **end of the transaction**
- Without an explicit `ROWLOCK` hint, SQL Server decides the granularity
-
-**Read lock SQL** (from `SqlServerDistributedLockingMechanism.cs:147`):
-```sql
-SELECT value FROM umbracoLock WITH (REPEATABLEREAD) WHERE id=@id
-```
-
-**Write lock SQL** (from `SqlServerDistributedLockingMechanism.cs:182-183`):
-```sql
-UPDATE umbracoLock WITH (REPEATABLEREAD) SET value = (CASE WHEN (value=1) THEN -1 ELSE 1 END) WHERE id=@id
-```
-
-Neither uses a `ROWLOCK` hint, so SQL Server is free to use page-level locking.
-
-### The Reproduction Scenario
-
-Here's the exact sequence that causes the error:
-
-**Server A** (running the user's distributed job):
-
-1. `DistributedBackgroundJobHostedService` calls `TryTakeRunnableAsync()`
-2. `TryTakeRunnableAsync` acquires `EagerWriteLock(-347)`, marks the "Clean Up Your Room" job as running, commits scope, **releases lock -347** -- this is fine
-3. The user's `ExecuteAsync()` runs:
-   ```csharp
-   using ICoreScope scope = _scopeProvider.CreateCoreScope();  // ROOT scope, starts transaction
-
-   _contentService.CountChildren(...)     // Creates NESTED scope, acquires ReadLock(-333)
-   _contentService.RecycleBinSmells()     // Creates NESTED scope, acquires ReadLock(-333)
-   _contentService.EmptyRecycleBin(...)   // Creates NESTED scope, acquires WriteLock(-333)
-
-   scope.Complete();  // Transaction commits HERE, all locks released HERE
-   ```
-
-4. **Critical**: All nested scopes share the root scope's database/transaction (confirmed in `Scope.cs:350-360`). The `ReadLock(-333)` acquired by `CountChildren` is held until the ROOT scope disposes. If `EmptyRecycleBin` takes 30+ seconds (many items), the locks on row -333 are held for 30+ seconds.
-
-5. With page-level locking, the shared (S) lock on row -333's **page** also covers row -347. This S lock blocks any exclusive (X) lock requests on the same page.
-
-**Server B** (polling for jobs every 5 seconds):
-
-6. `TryTakeRunnableAsync()` tries `EagerWriteLock(-347)`:
-   ```sql
-   SET LOCK_TIMEOUT 5000;
-   UPDATE umbracoLock WITH (REPEATABLEREAD) SET value = ... WHERE id=-347
-   ```
-7. This UPDATE needs an exclusive (X) lock on row -347. But the page containing -347 has a shared (S) lock held by Server A's long-running transaction.
-8. Server B **blocks for 5 seconds**, then gets SQL error 1222 (lock timeout)
-9. This becomes: `DistributedWriteLockTimeoutException` → **"Failed to acquire write lock for id: -347"**
-
-### Why Backoffice Login Triggers It
-
-When users log into the backoffice and interact with content:
-
- **Listing content**: `ContentService.GetById/GetChildren` → `ReadLock(-333)`
- **Saving content**: `ContentService.Save` → `WriteLock(-333)`
- **Deleting content**: `ContentService.Delete/MoveToRecycleBin` → `WriteLock(-333)`
- **Publishing**: `ContentService.Publish` → `WriteLock(-333)`
-
-Each of these acquires locks on the `umbracoLock` table. In load-balanced setups, backoffice web requests on *any server* add page-level lock contention on the same data page as -347. The more backoffice activity, the higher the probability that some transaction is holding a page lock that blocks -347 acquisition.
-
-### Why It "Disables the Server Until Restart"
-
-The `DistributedBackgroundJobHostedService` catches exceptions and continues (line 80). However:
-
-1. Every 5 seconds, `TryTakeRunnableAsync` fails with the lock timeout
-2. The error is logged each time, creating a flood of error logs
-3. **No distributed jobs run on the affected server** because `TryTakeRunnableAsync` always times out
-4. The user's custom job that's causing the contention (on the other server) eventually finishes, but by then the pattern of contention from backoffice operations may sustain the problem
-5. The server appears "disabled" because its distributed job processing is effectively blocked
-
-The server doesn't truly need a restart to recover, but the sustained contention from backoffice operations can make it *appear* permanently broken. A restart clears all in-flight transactions and ambient scopes, resolving the immediate contention.
-
---
-
-## Contributing Factors
-
-### 1. No `ROWLOCK` Hint
-
-The distributed locking SQL uses `WITH (REPEATABLEREAD)` but not `WITH (ROWLOCK, REPEATABLEREAD)`. Adding `ROWLOCK` would force SQL Server to use row-level locks, preventing cross-row contention on the same page.
-
-**File**: `src/Umbraco.Cms.Persistence.SqlServer/Services/SqlServerDistributedLockingMechanism.cs`
- Line 147 (read lock): `SELECT value FROM umbracoLock WITH (REPEATABLEREAD) WHERE id=@id`
- Line 182-183 (write lock): `UPDATE umbracoLock WITH (REPEATABLEREAD) SET value = ... WHERE id=@id`
-
-### 2. Short Default Write Lock Timeout
-
-**File**: `src/Umbraco.Core/Configuration/Models/GlobalSettings.cs`
-
-The default write lock timeout is **5 seconds** (`DistributedLockingWriteLockDefaultTimeout`). In a load-balanced setup with active backoffice use, this is easily exceeded during page-level lock contention.
-
-### 3. User's Outer Scope Prolongs Lock Duration
-
-The user's code wraps multiple ContentService calls in a single scope:
-
-```csharp
-using ICoreScope scope = _scopeProvider.CreateCoreScope();
-_contentService.CountChildren(...);      // ReadLock(-333) acquired, held by root transaction
-_contentService.RecycleBinSmells();      // ReadLock(-333)
-_contentService.EmptyRecycleBin(...);    // WriteLock(-333), potentially slow
-scope.Complete();                        // ALL locks released here
-```
-
-The nested scopes created by ContentService methods all share the root scope's transaction (`Scope.cs:350-360`). This means the ReadLock from `CountChildren` is held for the entire duration of `EmptyRecycleBin`.
-
-### 4. `Task.Run` in User Code
-
-The user wraps their code in `Task.Run()`:
-```csharp
-public Task ExecuteAsync()
-{
-    return Task.Run(() => { ... });
-}
-```
-
-While this doesn't directly cause the lock issue, `Task.Run` moves execution to a thread pool thread. This is unnecessary (the hosted service already runs on a background thread) and could cause issues with scope ambient context if the async context doesn't flow properly.
-
---
-
-## Potential Fixes
-
-### Fix 1: Add `ROWLOCK` Hint (Framework Fix - Recommended)
-
-Add `ROWLOCK` to the SQL statements in `SqlServerDistributedLockingMechanism`:
-
-```sql
-- Read lock
-SELECT value FROM umbracoLock WITH (ROWLOCK, REPEATABLEREAD) WHERE id=@id
-
-- Write lock
-UPDATE umbracoLock WITH (ROWLOCK, REPEATABLEREAD) SET value = ... WHERE id=@id
-```
-
-This forces SQL Server to use row-level locks, preventing cross-row contention within the same page. Row-level locks on id=-333 would NOT block row-level locks on id=-347.
-
-**Impact**: Minimal. Row-level locks are slightly more expensive in memory (lock manager overhead) but the umbracoLock table is tiny. This is the standard best practice for small lookup tables where row independence is required.
-
-The same fix should also be applied to the EF Core SQL Server locking mechanism:
- `src/Umbraco.Cms.Persistence.EFCore/Locking/SqlServerEFCoreDistributedLockingMechanism.cs`
-
-### Fix 2: Separate Lock Tables (Framework Fix - More Invasive)
-
-Move distributed job locks to a separate table (`umbracoDistributedJobLock`) so they can never share a page with content tree locks. This is more invasive but eliminates the problem entirely regardless of SQL Server lock granularity decisions.
-
-### Fix 3: Increase Write Lock Timeout (User Workaround)
-
-```json
-{
-  "Umbraco": {
-    "CMS": {
-      "Global": {
-        "DistributedLockingWriteLockDefaultTimeout": "00:00:30"
-      }
-    }
-  }
-}
-```
-
-Increasing to 30 seconds gives more time for the contending transaction to complete. This is a workaround, not a fix - it trades timeout frequency for longer blocking delays.
-
-### Fix 4: User Code Improvement (User Workaround)
-
-The user should avoid wrapping multiple ContentService calls in a single outer scope. Each ContentService method already manages its own scope:
-
-```csharp
-public Task ExecuteAsync()
-{
-    // NO outer scope needed - each ContentService method creates its own scope
-    int numberOfThingsInBin = _contentService.CountChildren(Constants.System.RecycleBinContent);
-    _logger.LogInformation("You have {Count} items to clean", numberOfThingsInBin);
-
-    if (_contentService.RecycleBinSmells())
-    {
-        _contentService.EmptyRecycleBin(userId: -1);
-    }
-
-    return Task.CompletedTask;
-}
-```
-
-This reduces lock hold duration because each ContentService call acquires and releases its locks independently. The `CountChildren` ReadLock(-333) is released before `EmptyRecycleBin` starts.
-
-Also: remove the `Task.Run` wrapper - it's unnecessary since the hosted service already runs on a background thread.
-
---
-
-## Key Code References
-
-| File | Purpose |
-|------|---------|
-| `src/Umbraco.Infrastructure/BackgroundJobs/DistributedBackgroundJobHostedService.cs` | Timer loop, calls TryTake → Execute → Finish |
-| `src/Umbraco.Infrastructure/Services/Implement/DistributedJobService.cs` | Acquires WriteLock(-347) in TryTakeRunnableAsync (line 68) and FinishAsync (line 105) |
-| `src/Umbraco.Cms.Persistence.SqlServer/Services/SqlServerDistributedLockingMechanism.cs` | SQL Server lock SQL (lines 147, 182-183) - missing ROWLOCK hint |
-| `src/Umbraco.Core/Persistence/Constants-Locks.cs` | Lock ID definitions (-331 through -348) |
-| `src/Umbraco.Infrastructure/Scoping/Scope.cs:350-360` | Nested scopes share parent's Database/transaction |
-| `src/Umbraco.Core/Services/ContentService.cs` | EmptyRecycleBin acquires WriteLock(-333), CountChildren/RecycleBinSmells acquire ReadLock(-333) |
-| `src/Umbraco.Core/Configuration/Models/GlobalSettings.cs` | Default lock timeout: 5 seconds for writes |
-
---
-
-## Verification Steps
-
-To confirm this hypothesis:
-
-1. **SQL Server Activity Monitor**: During reproduction, check for page-level locks on the `umbracoLock` table using `sys.dm_tran_locks`:
-   ```sql
-   SELECT * FROM sys.dm_tran_locks
-   WHERE resource_database_id = DB_ID()
-   AND resource_associated_entity_id = OBJECT_ID('umbracoLock')
-   ORDER BY request_mode, resource_type
-   ```
-
-2. **Check lock granularity**: Look for `resource_type = 'PAGE'` entries, which would confirm page-level locking.
-
-3. **Test with ROWLOCK**: Temporarily modify the SQL to include `ROWLOCK` hint and verify the issue disappears.
-
-4. **Test without outer scope**: Have the user remove the wrapping `CreateCoreScope()` call and verify the issue is mitigated (shorter individual lock durations).
@@ -1,271 +0,0 @@
-# Memory Leak Analysis — Umbraco CMS v17
-
-**Date**: 2026-03-03
-**Branch**: `main`
-**Scope**: All production projects under `src/`
-**Methodology**: Static analysis — grep-based pattern matching across ~1,000 C# source files
-
---
-
-## Executive Summary
-
-Seven potential memory management issues were identified. None represent an unbounded memory growth path that would cause noticeable degradation or an `OutOfMemoryException` on a typical site running for days or weeks. The most accurate characterisation of the meaningful findings is **reduced `ArrayPool` efficiency** rather than classical memory leaks — the GC reclaims all affected memory eventually, but pooled buffers are not returned promptly.
-
-The single highest-value fix is a one-line addition to `DatabaseServerMessenger.Dispose()`. Two findings around `JsonDocument` disposal are worth addressing for correctness, particularly on multi-server deployments. The remaining findings have negligible practical impact.
-
---
-
-## Findings
-
-### Finding 1 — `CancellationTokenSource` Not Disposed
-
-| | |
-|---|---|
-| **File** | `src/Umbraco.Infrastructure/Sync/DatabaseServerMessenger.cs` |
-| **Lines** | 24 (creation), 339–349 (Dispose) |
-| **Confidence** | High |
-| **Practical Impact** | Negligible |
-
-`DatabaseServerMessenger` implements `IDisposable`, but its `Dispose(bool)` method omits disposal of `_cancellationTokenSource`:
-
-```csharp
-// Line 24 — created
-private readonly CancellationTokenSource _cancellationTokenSource = new();
-
-// Lines 339–349 — _syncIdle is disposed; _cancellationTokenSource is not
-protected virtual void Dispose(bool disposing)
-{
-    if (!_disposedValue)
-    {
-        if (disposing)
-        {
-            _syncIdle.Dispose();
-            // ← _cancellationTokenSource.Dispose() is missing
-        }
-        _disposedValue = true;
-    }
-}
-```
-
-`CancellationTokenSource` internally holds a native `SafeWaitHandle` (a Win32 event object) that should be released via `Dispose()`. Because this class is a singleton, exactly **one** handle is leaked for the lifetime of the process — the GC finaliser will never reclaim it. The practical memory cost is a few hundred bytes and one OS handle, which is immeasurable in a normal server process.
-
-**Real-world impact over several days**: None observable. This is a correctness issue rather than a practical one.
-
-**Recommended fix**: Add `_cancellationTokenSource.Dispose();` inside the `if (disposing)` block at line 345. This is a single-line change.
-
---
-
-### Finding 2 — `JsonDocument` Not Disposed in Cache Sync Loop
-
-| | |
-|---|---|
-| **File** | `src/Umbraco.Infrastructure/Services/CacheInstructionService.cs` |
-| **Lines** | 287, 293, 315–334 |
-| **Confidence** | High |
-| **Practical Impact** | Low (single server) / Low–Medium (multi-server) |
-
-`TryDeserializeInstructions` allocates a `JsonDocument` — which rents a buffer from `ArrayPool<byte>` — and returns it via an `out` parameter. The caller uses the document's `RootElement` once, then allows the variable to go out of scope without calling `Dispose()`:
-
-```csharp
-// Line 287 — JsonDocument created inside TryDeserializeInstructions
-if (TryDeserializeInstructions(instruction, out JsonDocument? jsonInstructions) is false
-    && jsonInstructions is null)
-{
-    lastId = instruction.Id;
-    continue;
-}
-
-// Line 293 — last use; jsonInstructions goes out of scope without Dispose()
-List<RefreshInstruction> instructionBatch = GetAllInstructions(jsonInstructions?.RootElement);
-```
-
-`JsonDocument` has no finaliser. When the GC collects an un-disposed instance, the rented `ArrayPool` buffer is collected as ordinary heap memory rather than being returned to the pool. This reduces pool hit rates and increases allocation pressure.
-
-This codepath runs inside the multi-server cache instruction sync loop. On a **single-server** deployment the loop processes only local (skipped) instructions and almost never reaches `TryDeserializeInstructions`. On a **multi-server load-balanced** deployment with active content publishing, this can fire many times per minute.
-
-**Real-world impact over several days**: Negligible on single-server. On a busy multi-server site, slightly elevated Gen 0 GC frequency from reduced `ArrayPool` reuse. Memory does not grow unboundedly.
-
-**Recommended fix**: Wrap the `JsonDocument` in a `using` declaration at the call site:
-```csharp
-using JsonDocument? jsonInstructions = TryDeserializeInstructions(instruction);
-if (jsonInstructions is null) { lastId = instruction.Id; continue; }
-```
-
---
-
-### Finding 3 — `JsonDocument` Cached Without Disposal on Eviction
-
-| | |
-|---|---|
-| **File** | `src/Umbraco.Infrastructure/PropertyEditors/ValueConverters/JsonValueConverter.cs` |
-| **Lines** | 52–68 |
-| **Confidence** | Medium |
-| **Practical Impact** | Low |
-
-`ConvertSourceToIntermediate` returns a `JsonDocument` that the published content cache stores at `PropertyCacheLevel.Element` (cached per content element, per variant):
-
-```csharp
-public override PropertyCacheLevel GetPropertyCacheLevel(IPublishedPropertyType propertyType)
-    => PropertyCacheLevel.Element;
-
-public override object? ConvertSourceToIntermediate(...)
-{
-    // ...
-    return JsonDocument.Parse(sourceString); // rented ArrayPool buffer not returned on eviction
-}
-```
-
-The cache holds values as `object?` and evicts them by releasing references. Because there is no eviction callback that calls `Dispose()`, the rented buffer for each `JsonDocument` is abandoned rather than returned to the pool.
-
-This affects every content node with a JSON property type (block lists, media pickers, nested content, etc.). On a site with mostly-static content the cached `JsonDocument` population is bounded and stable. On a site with frequent content changes causing cache churn, pool hit rates are lower and allocation pressure is higher.
-
-**Real-world impact over several days**: Low. Memory does not grow unboundedly — the GC collects evicted documents. The observable effect, if any, would be marginally higher Gen 0 collection frequency on high-churn sites. This is unlikely to be measurable on a typical site.
-
-**Recommended fix**: This requires a non-trivial design change — either wrapping returned values in a disposable owner type with cache eviction callbacks, or switching the internal representation away from the pooled `JsonDocument` type.
-
---
-
-### Finding 4 — `CryptoStream` and `ICryptoTransform` Not Disposed
-
-| | |
-|---|---|
-| **File** | `src/Umbraco.Infrastructure/Security/MemberPasswordHasher.cs` |
-| **Lines** | 161–171 |
-| **Confidence** | Medium |
-| **Practical Impact** | Negligible |
-
-In a legacy password decryption helper, `MemoryStream` is correctly wrapped in `using`, but `CryptoStream` and `ICryptoTransform` are not:
-
-```csharp
-private static string DecryptLegacyPassword(string encryptedPassword, SymmetricAlgorithm algorithm)
-{
-    using var memoryStream = new MemoryStream();
-    ICryptoTransform cryptoTransform = algorithm.CreateDecryptor(); // not disposed
-    var cryptoStream = new CryptoStream(memoryStream, cryptoTransform, CryptoStreamMode.Write); // not disposed
-    var buf = Convert.FromBase64String(encryptedPassword);
-    cryptoStream.Write(buf, 0, 32);
-    cryptoStream.FlushFinalBlock();
-    return Encoding.Unicode.GetString(memoryStream.ToArray());
-}
-```
-
-Both types implement `IDisposable` and hold internal transform state buffers. However, this method is only invoked for accounts with Umbraco ≤ 8 encrypted password hashes — a codepath that is exercised only during migrations from legacy installations and is effectively never called on a v17 site.
-
-**Real-world impact over several days**: None observable. The objects are small and collected promptly by the GC.
-
-**Recommended fix**: Add `using` declarations for both `cryptoTransform` and `cryptoStream` for correctness.
-
---
-
-### Finding 5 — Static Event Subscription Without Unsubscription (Development Mode Only)
-
-| | |
-|---|---|
-| **File** | `src/Umbraco.Cms.DevelopmentMode.Backoffice/InMemoryAuto/InMemoryAssemblyLoadContextManager.cs` |
-| **Lines** | 10–11 |
-| **Confidence** | High (pattern) |
-| **Practical Impact** | None in production |
-
-The class subscribes to a static event in its constructor but implements no `IDisposable` to unsubscribe:
-
-```csharp
-public InMemoryAssemblyLoadContextManager() =>
-    AssemblyLoadContext.Default.Resolving += OnResolvingDefaultAssemblyLoadContext;
-// No corresponding -= and no IDisposable
-```
-
-The class is registered as a singleton (`AddSingleton<InMemoryAssemblyLoadContextManager>()`), so its lifetime matches the process and the omission is benign in normal operation. The static event would prevent GC if the DI container released its reference (e.g. during repeated host rebuilding in integration tests). This component is only active when `ModelsMode` is `InMemoryAuto` and `RuntimeMode` is `BackofficeDevelopment` — it is never loaded in production.
-
-**Real-world impact over several days**: None in production. Negligible in development.
-
-**Recommended fix**: Implement `IDisposable` and unsubscribe in `Dispose()` for correctness and test isolation.
-
---
-
-### Finding 6 — Static `HttpClient` Bypasses `IHttpClientFactory`
-
-| | |
-|---|---|
-| **File** | `src/Umbraco.Core/Media/EmbedProviders/OEmbedProviderBase.cs` |
-| **Lines** | 13, 88–92 |
-| **Confidence** | Low (not a true memory leak) |
-| **Practical Impact** | Negligible (memory); Low (DNS staleness) |
-
-A static `HttpClient?` field is lazily initialised without using `IHttpClientFactory`:
-
-```csharp
-private static HttpClient? _httpClient;
-
-if (_httpClient == null)
-{
-    _httpClient = new HttpClient();
-    _httpClient.DefaultRequestHeaders.UserAgent.TryParseAdd(...);
-}
-```
-
-`HttpClient` is designed to be long-lived and reused, so the static pattern does not cause a memory leak. The practical concern is that DNS changes are not respected (no `PooledConnectionLifetime` on the underlying handler), which could cause stale connections on sites where OEmbed providers change their infrastructure. This is not a memory concern.
-
-**Real-world impact over several days**: No memory impact. Potential for stale DNS on OEmbed requests after several days if a provider changes their IP.
-
-**Recommended fix**: Inject `IHttpClientFactory` and use a named or typed client.
-
---
-
-### Finding 7 — Unbounded Static Regex Cache
-
-| | |
-|---|---|
-| **File** | `src/Umbraco.Core/Services/OEmbedService.cs` |
-| **Lines** | 15, 68–69 |
-| **Confidence** | Low |
-| **Practical Impact** | Negligible |
-
-Compiled `Regex` objects are cached in a static `ConcurrentDictionary` with no eviction:
-
-```csharp
-private static readonly ConcurrentDictionary<string, Regex> RegexCache = new();
-
-private static Regex GetOrCreateRegex(string pattern)
-    => RegexCache.GetOrAdd(pattern, p => new Regex(p, RegexOptions.IgnoreCase | RegexOptions.Compiled));
-```
-
-The dictionary is bounded by the number of unique URL scheme patterns across registered OEmbed providers, which is typically around 15–20 entries. Compiled `Regex` objects are intentionally long-lived. This is not a memory leak under normal usage; it would only become one if patterns were generated dynamically from user input at runtime (which they are not).
-
-**Real-world impact over several days**: None observable.
-
-**Recommended fix**: No action needed under current usage patterns. Add a size cap if the pattern set ever becomes dynamic.
-
---
-
-## Items Investigated and Cleared
-
-The following patterns were examined and found to be correctly implemented:
-
-| Class / Area | Pattern Checked | Result |
-|---|---|---|
-| `DatabaseServerMessenger._syncIdle` | `ManualResetEvent` disposal | ✓ Disposed at line 345 |
-| `RecurringHostedServiceBase._timer` | `System.Threading.Timer` disposal | ✓ Disposed via `_timer?.Dispose()` |
-| `DistributedBackgroundJobHostedService` | `PeriodicTimer` disposal | ✓ Wrapped in `using` |
-| `RetryDbConnection` | `StateChange` event handler | ✓ Unsubscribed in `Dispose(bool)` |
-| `UmbracoIdentityUser` | `ObservableCollection.CollectionChanged` | ✓ Cleaned up in property setters |
-| `Content` / `ContentBase` / `ContentTypeBase` | `CollectionChanged` handlers | ✓ Use `ClearCollectionChangedEvents()` before reassignment |
-| `FileRepository` / `PartialViewRepository` | `MemoryStream` returned from `GetContentStream` | ✓ All call sites wrap result in `using` |
-| `JsonConfigManipulator` | `FileStream` disposal | ✓ Wrapped in `await using` |
-| `QueuedHostedService` | `ExecutionContext.SuppressFlow()` | ✓ Wrapped in `using` |
-| Background job DI registrations | Captive dependency (scoped-in-singleton) | ✓ No violations found |
-
---
-
-## Priority and Effort Summary
-
-| Priority | Finding | Fix Effort |
-|---|---|---|
-| **Fix** | Finding 1: `CancellationTokenSource` not disposed | 1 line |
-| **Fix** | Finding 2: `JsonDocument` not disposed in sync loop | ~3 lines |
-| **Fix** | Finding 4: `CryptoStream` not disposed | 2 lines |
-| **Fix** | Finding 5: Static event leak (dev-only) | `IDisposable` implementation |
-| **Consider** | Finding 3: `JsonDocument` cached without disposal | Design change required |
-| **Consider** | Finding 6: Static `HttpClient` | Inject `IHttpClientFactory` |
-| **Monitor** | Finding 7: Static `Regex` cache | No action unless patterns become dynamic |
-
-Findings 1, 2, and 4 are low-effort correctness fixes that follow established .NET resource management idioms. Finding 3 is a legitimate design smell that warrants a separate investigation into how the published content cache handles disposable cached values.
@@ -40,10 +40,15 @@ public class BackOfficeLoginController : Controller
    /// <param name="cancellationToken">A cancellation token to cancel the operation.</param>
    /// <param name="model">The model containing login information and the return URL.</param>
    /// <returns>
-    /// An <see cref="IActionResult"/> that renders the login view with the model, or a bad request result if the return URL is invalid.
+    /// An <see cref="IActionResult"/> that renders the login view with the model, or a bad request result if the model state or return URL is invalid.
    /// </returns>
    public async Task<IActionResult> Index(CancellationToken cancellationToken, BackOfficeLoginModel model)
    {
+        if (ModelState.IsValid is false)
+        {
+            return BadRequest();
+        }
+
        AuthenticateResult cookieAuthResult = await HttpContext.AuthenticateAsync(Constants.Security.BackOfficeAuthenticationType);
        if (cookieAuthResult.Succeeded)
        {
@@ -53,11 +53,14 @@ public class SearchDataTypeItemController : DatatypeItemControllerBase
            return Ok(new PagedModel<DataTypeItemResponseModel> { Total = searchResult.Total });
        }

-        IEnumerable<IDataType> dataTypes = await _dataTypeService.GetAllAsync(searchResult.Items.Select(item => item.Key).ToArray());
+        Guid[] keys = searchResult.Items.Select(x => x.Key).ToArray();
+        IEnumerable<IDataType> dataTypes = await _dataTypeService.GetAllAsync(keys);
+        IEnumerable<IDataType> orderedDataTypes = OrderByRequestedIds(dataTypes, keys);
+
        var result = new PagedModel<DataTypeItemResponseModel>
        {
-            Items = _mapper.MapEnumerable<IDataType, DataTypeItemResponseModel>(dataTypes),
-            Total = searchResult.Total
+            Items = _mapper.MapEnumerable<IDataType, DataTypeItemResponseModel>(orderedDataTypes),
+            Total = searchResult.Total,
        };

        return Ok(result);
@@ -0,0 +1,100 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Umbraco.Cms.Api.Management.Security.Authorization;
+using Umbraco.Cms.Api.Management.ViewModels.Sorting;
+using Umbraco.Cms.Core.Actions;
+using Umbraco.Cms.Core.Models;
+using Umbraco.Cms.Core.Security;
+using Umbraco.Cms.Core.Security.Authorization;
+using Umbraco.Cms.Core.Services;
+using Umbraco.Cms.Core.Services.OperationStatus;
+using Umbraco.Cms.Web.Common.Authorization;
+using Umbraco.Extensions;
+
+namespace Umbraco.Cms.Api.Management.Controllers.Document;
+
+/// <summary>
+/// Provides an API endpoint for sorting the root-level documents by a system field.
+/// </summary>
+[ApiVersion("1.0")]
+public class SortChildrenAtRootDocumentController : DocumentControllerBase
+{
+    private readonly IAuthorizationService _authorizationService;
+    private readonly IContentEditingService _contentEditingService;
+    private readonly IEntityService _entityService;
+    private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="SortChildrenAtRootDocumentController"/> class.
+    /// </summary>
+    /// <param name="authorizationService">Service used to authorize user actions.</param>
+    /// <param name="contentEditingService">Service for editing and managing content.</param>
+    /// <param name="entityService">Service used to resolve the children to authorize.</param>
+    /// <param name="backOfficeSecurityAccessor">Accessor for back office security context.</param>
+    public SortChildrenAtRootDocumentController(
+        IAuthorizationService authorizationService,
+        IContentEditingService contentEditingService,
+        IEntityService entityService,
+        IBackOfficeSecurityAccessor backOfficeSecurityAccessor)
+    {
+        _authorizationService = authorizationService;
+        _contentEditingService = contentEditingService;
+        _entityService = entityService;
+        _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
+    }
+
+    /// <summary>
+    /// Sorts the root-level documents by a system field.
+    /// </summary>
+    /// <param name="cancellationToken">A <see cref="CancellationToken"/> to observe while waiting for the task to complete.</param>
+    /// <param name="requestModel">The field to sort by and the sort direction.</param>
+    /// <returns>
+    /// An <see cref="IActionResult"/> indicating the outcome of the operation:
+    /// returns <c>200 OK</c> if sorting succeeds or <c>400 Bad Request</c> if the field is not recognised.
+    /// </returns>
+    [HttpPut("root/sort-children")]
+    [MapToApiVersion("1.0")]
+    [ProducesResponseType(StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status400BadRequest)]
+    [EndpointSummary("Sorts the root-level documents by a field.")]
+    [EndpointDescription("Sorts the root-level documents by a system field in the given direction. When sorting by name, an optional culture selects the variant name; the culture is not validated, so documents that do not vary by it (or an unrecognised culture) fall back to the invariant name.")]
+    public async Task<IActionResult> SortChildren(CancellationToken cancellationToken, SortDocumentChildrenByFieldRequestModel requestModel)
+    {
+        AuthorizationResult authorizationResult = await _authorizationService.AuthorizeResourceAsync(
+            User,
+            ContentPermissionResource.WithKeys(ActionSort.ActionLetter, (Guid?)null),
+            AuthorizationPolicies.ContentPermissionByResource);
+
+        if (!authorizationResult.Succeeded)
+        {
+            return Forbidden();
+        }
+
+        var childrenAuthorized = await AllChildrenAuthorizer.IsAuthorizedForChildrenAsync(
+            _authorizationService,
+            _entityService,
+            User,
+            parentKey: null,
+            UmbracoObjectTypes.Document,
+            childKeys => ContentPermissionResource.WithKeys(ActionSort.ActionLetter, childKeys),
+            AuthorizationPolicies.ContentPermissionByResource);
+
+        if (!childrenAuthorized)
+        {
+            return Forbidden();
+        }
+
+        ContentEditingOperationStatus result = await _contentEditingService.SortByFieldAsync(
+            null,
+            requestModel.Field,
+            requestModel.Direction,
+            requestModel.Culture,
+            CurrentUserKey(_backOfficeSecurityAccessor));
+
+        return result == ContentEditingOperationStatus.Success
+            ? Ok()
+            : ContentEditingOperationStatusResult(result);
+    }
+}
@@ -0,0 +1,102 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Umbraco.Cms.Api.Management.Security.Authorization;
+using Umbraco.Cms.Api.Management.ViewModels.Sorting;
+using Umbraco.Cms.Core.Actions;
+using Umbraco.Cms.Core.Models;
+using Umbraco.Cms.Core.Security;
+using Umbraco.Cms.Core.Security.Authorization;
+using Umbraco.Cms.Core.Services;
+using Umbraco.Cms.Core.Services.OperationStatus;
+using Umbraco.Cms.Web.Common.Authorization;
+using Umbraco.Extensions;
+
+namespace Umbraco.Cms.Api.Management.Controllers.Document;
+
+/// <summary>
+/// Provides an API endpoint for sorting the children of a document by a system field.
+/// </summary>
+[ApiVersion("1.0")]
+public class SortChildrenDocumentController : DocumentControllerBase
+{
+    private readonly IAuthorizationService _authorizationService;
+    private readonly IContentEditingService _contentEditingService;
+    private readonly IEntityService _entityService;
+    private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="SortChildrenDocumentController"/> class.
+    /// </summary>
+    /// <param name="authorizationService">Service used to authorize user actions.</param>
+    /// <param name="contentEditingService">Service for editing and managing content.</param>
+    /// <param name="entityService">Service used to resolve the children to authorize.</param>
+    /// <param name="backOfficeSecurityAccessor">Accessor for back office security context.</param>
+    public SortChildrenDocumentController(
+        IAuthorizationService authorizationService,
+        IContentEditingService contentEditingService,
+        IEntityService entityService,
+        IBackOfficeSecurityAccessor backOfficeSecurityAccessor)
+    {
+        _authorizationService = authorizationService;
+        _contentEditingService = contentEditingService;
+        _entityService = entityService;
+        _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
+    }
+
+    /// <summary>
+    /// Sorts the child documents of the specified parent document by a system field.
+    /// </summary>
+    /// <param name="cancellationToken">A <see cref="CancellationToken"/> to observe while waiting for the task to complete.</param>
+    /// <param name="id">The unique identifier of the parent document whose children should be sorted.</param>
+    /// <param name="requestModel">The field to sort by and the sort direction.</param>
+    /// <returns>
+    /// An <see cref="IActionResult"/> indicating the outcome of the operation:
+    /// returns <c>200 OK</c> if sorting succeeds, <c>400 Bad Request</c> if the field is not recognised, or <c>404 Not Found</c> if the parent document does not exist.
+    /// </returns>
+    [HttpPut("{id:guid}/sort-children")]
+    [MapToApiVersion("1.0")]
+    [ProducesResponseType(StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
+    [EndpointSummary("Sorts the children of a document by a field.")]
+    [EndpointDescription("Sorts the children of the specified parent document by a system field in the given direction. When sorting by name, an optional culture selects the variant name; the culture is not validated, so children that do not vary by it (or an unrecognised culture) fall back to the invariant name.")]
+    public async Task<IActionResult> SortChildren(CancellationToken cancellationToken, Guid id, SortDocumentChildrenByFieldRequestModel requestModel)
+    {
+        AuthorizationResult authorizationResult = await _authorizationService.AuthorizeResourceAsync(
+            User,
+            ContentPermissionResource.WithKeys(ActionSort.ActionLetter, id),
+            AuthorizationPolicies.ContentPermissionByResource);
+
+        if (!authorizationResult.Succeeded)
+        {
+            return Forbidden();
+        }
+
+        var childrenAuthorized = await AllChildrenAuthorizer.IsAuthorizedForChildrenAsync(
+            _authorizationService,
+            _entityService,
+            User,
+            id,
+            UmbracoObjectTypes.Document,
+            childKeys => ContentPermissionResource.WithKeys(ActionSort.ActionLetter, childKeys),
+            AuthorizationPolicies.ContentPermissionByResource);
+
+        if (!childrenAuthorized)
+        {
+            return Forbidden();
+        }
+
+        ContentEditingOperationStatus result = await _contentEditingService.SortByFieldAsync(
+            id,
+            requestModel.Field,
+            requestModel.Direction,
+            requestModel.Culture,
+            CurrentUserKey(_backOfficeSecurityAccessor));
+
+        return result == ContentEditingOperationStatus.Success
+            ? Ok()
+            : ContentEditingOperationStatusResult(result);
+    }
+}
@@ -0,0 +1,98 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Umbraco.Cms.Api.Management.Security.Authorization;
+using Umbraco.Cms.Api.Management.ViewModels.Sorting;
+using Umbraco.Cms.Core.Models;
+using Umbraco.Cms.Core.Security;
+using Umbraco.Cms.Core.Security.Authorization;
+using Umbraco.Cms.Core.Services;
+using Umbraco.Cms.Core.Services.OperationStatus;
+using Umbraco.Cms.Web.Common.Authorization;
+using Umbraco.Extensions;
+
+namespace Umbraco.Cms.Api.Management.Controllers.Media;
+
+/// <summary>
+/// Provides an API endpoint for sorting the root-level media items by a system field.
+/// </summary>
+[ApiVersion("1.0")]
+public class SortChildrenAtRootMediaController : MediaControllerBase
+{
+    private readonly IAuthorizationService _authorizationService;
+    private readonly IMediaEditingService _mediaEditingService;
+    private readonly IEntityService _entityService;
+    private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="SortChildrenAtRootMediaController"/> class.
+    /// </summary>
+    /// <param name="authorizationService">Service used to authorize user actions.</param>
+    /// <param name="mediaEditingService">Service responsible for editing and sorting media items.</param>
+    /// <param name="entityService">Service used to resolve the children to authorize.</param>
+    /// <param name="backOfficeSecurityAccessor">Accessor for backoffice security context.</param>
+    public SortChildrenAtRootMediaController(
+        IAuthorizationService authorizationService,
+        IMediaEditingService mediaEditingService,
+        IEntityService entityService,
+        IBackOfficeSecurityAccessor backOfficeSecurityAccessor)
+    {
+        _authorizationService = authorizationService;
+        _mediaEditingService = mediaEditingService;
+        _entityService = entityService;
+        _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
+    }
+
+    /// <summary>
+    /// Sorts the root-level media items by a system field.
+    /// </summary>
+    /// <param name="cancellationToken">A <see cref="CancellationToken"/> to observe while waiting for the task to complete.</param>
+    /// <param name="requestModel">The field to sort by and the sort direction.</param>
+    /// <returns>
+    /// An <see cref="IActionResult"/> indicating the outcome of the operation:
+    /// returns <c>200 OK</c> if sorting succeeds or <c>400 Bad Request</c> if the field is not recognised.
+    /// </returns>
+    [HttpPut("root/sort-children")]
+    [MapToApiVersion("1.0")]
+    [ProducesResponseType(StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status400BadRequest)]
+    [EndpointSummary("Sorts the root-level media items by a field.")]
+    [EndpointDescription("Sorts the root-level media items by a system field in the given direction.")]
+    public async Task<IActionResult> SortChildren(CancellationToken cancellationToken, SortMediaChildrenByFieldRequestModel requestModel)
+    {
+        AuthorizationResult authorizationResult = await _authorizationService.AuthorizeResourceAsync(
+            User,
+            MediaPermissionResource.Root(),
+            AuthorizationPolicies.MediaPermissionByResource);
+
+        if (!authorizationResult.Succeeded)
+        {
+            return Forbidden();
+        }
+
+        var childrenAuthorized = await AllChildrenAuthorizer.IsAuthorizedForChildrenAsync(
+            _authorizationService,
+            _entityService,
+            User,
+            parentKey: null,
+            UmbracoObjectTypes.Media,
+            childKeys => MediaPermissionResource.WithKeys(childKeys),
+            AuthorizationPolicies.MediaPermissionByResource);
+
+        if (!childrenAuthorized)
+        {
+            return Forbidden();
+        }
+
+        ContentEditingOperationStatus result = await _mediaEditingService.SortByFieldAsync(
+            null,
+            requestModel.Field,
+            requestModel.Direction,
+            CurrentUserKey(_backOfficeSecurityAccessor));
+
+        return result == ContentEditingOperationStatus.Success
+            ? Ok()
+            : ContentEditingOperationStatusResult(result);
+    }
+}
@@ -0,0 +1,100 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Umbraco.Cms.Api.Management.Security.Authorization;
+using Umbraco.Cms.Api.Management.ViewModels.Sorting;
+using Umbraco.Cms.Core.Models;
+using Umbraco.Cms.Core.Security;
+using Umbraco.Cms.Core.Security.Authorization;
+using Umbraco.Cms.Core.Services;
+using Umbraco.Cms.Core.Services.OperationStatus;
+using Umbraco.Cms.Web.Common.Authorization;
+using Umbraco.Extensions;
+
+namespace Umbraco.Cms.Api.Management.Controllers.Media;
+
+/// <summary>
+/// Provides an API endpoint for sorting the children of a media item by a system field.
+/// </summary>
+[ApiVersion("1.0")]
+public class SortChildrenMediaController : MediaControllerBase
+{
+    private readonly IAuthorizationService _authorizationService;
+    private readonly IMediaEditingService _mediaEditingService;
+    private readonly IEntityService _entityService;
+    private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="SortChildrenMediaController"/> class.
+    /// </summary>
+    /// <param name="authorizationService">Service used to authorize user actions.</param>
+    /// <param name="mediaEditingService">Service responsible for editing and sorting media items.</param>
+    /// <param name="entityService">Service used to resolve the children to authorize.</param>
+    /// <param name="backOfficeSecurityAccessor">Accessor for backoffice security context.</param>
+    public SortChildrenMediaController(
+        IAuthorizationService authorizationService,
+        IMediaEditingService mediaEditingService,
+        IEntityService entityService,
+        IBackOfficeSecurityAccessor backOfficeSecurityAccessor)
+    {
+        _authorizationService = authorizationService;
+        _mediaEditingService = mediaEditingService;
+        _entityService = entityService;
+        _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
+    }
+
+    /// <summary>
+    /// Sorts the child media items of the specified parent media item by a system field.
+    /// </summary>
+    /// <param name="cancellationToken">A <see cref="CancellationToken"/> to observe while waiting for the task to complete.</param>
+    /// <param name="id">The unique identifier of the parent media item whose children should be sorted.</param>
+    /// <param name="requestModel">The field to sort by and the sort direction.</param>
+    /// <returns>
+    /// An <see cref="IActionResult"/> indicating the outcome of the operation:
+    /// returns <c>200 OK</c> if sorting succeeds, <c>400 Bad Request</c> if the field is not recognised, or <c>404 Not Found</c> if the parent media item does not exist.
+    /// </returns>
+    [HttpPut("{id:guid}/sort-children")]
+    [MapToApiVersion("1.0")]
+    [ProducesResponseType(StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
+    [EndpointSummary("Sorts the children of a media item by a field.")]
+    [EndpointDescription("Sorts the children of the specified parent media item by a system field in the given direction.")]
+    public async Task<IActionResult> SortChildren(CancellationToken cancellationToken, Guid id, SortMediaChildrenByFieldRequestModel requestModel)
+    {
+        AuthorizationResult authorizationResult = await _authorizationService.AuthorizeResourceAsync(
+            User,
+            MediaPermissionResource.WithKeys(id),
+            AuthorizationPolicies.MediaPermissionByResource);
+
+        if (!authorizationResult.Succeeded)
+        {
+            return Forbidden();
+        }
+
+        var childrenAuthorized = await AllChildrenAuthorizer.IsAuthorizedForChildrenAsync(
+            _authorizationService,
+            _entityService,
+            User,
+            id,
+            UmbracoObjectTypes.Media,
+            childKeys => MediaPermissionResource.WithKeys(childKeys),
+            AuthorizationPolicies.MediaPermissionByResource);
+
+        if (!childrenAuthorized)
+        {
+            return Forbidden();
+        }
+
+        ContentEditingOperationStatus result = await _mediaEditingService.SortByFieldAsync(
+            id,
+            requestModel.Field,
+            requestModel.Direction,
+            CurrentUserKey(_backOfficeSecurityAccessor));
+
+        return result == ContentEditingOperationStatus.Success
+            ? Ok()
+            : ContentEditingOperationStatusResult(result);
+    }
+}
@@ -54,11 +54,14 @@ public class SearchMediaTypeItemController : MediaTypeItemControllerBase
            return Task.FromResult<IActionResult>(Ok(new PagedModel<MediaTypeItemResponseModel> { Total = searchResult.Total }));
        }

-        IEnumerable<IMediaType> mediaTypes = _mediaTypeService.GetMany(searchResult.Items.Select(item => item.Key).ToArray().EmptyNull());
+        Guid[] keys = searchResult.Items.Select(item => item.Key).ToArray();
+        IEnumerable<IMediaType> mediaTypes = _mediaTypeService.GetMany(keys.EmptyNull());
+        IEnumerable<IMediaType> orderedMediaTypes = OrderByRequestedIds(mediaTypes, keys);
+
        var result = new PagedModel<MediaTypeItemResponseModel>
        {
-            Items = _mapper.MapEnumerable<IMediaType, MediaTypeItemResponseModel>(mediaTypes),
-            Total = searchResult.Total
+            Items = _mapper.MapEnumerable<IMediaType, MediaTypeItemResponseModel>(orderedMediaTypes),
+            Total = searchResult.Total,
        };

        return Task.FromResult<IActionResult>(Ok(result));
@@ -1,11 +1,11 @@
 using Asp.Versioning;
-using J2N.Collections.Generic.Extensions;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Management.ViewModels.MemberGroup.Item;
+using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Mapping;
 using Umbraco.Cms.Core.Models;
-using Umbraco.Cms.Core.Models.Entities;
 using Umbraco.Cms.Core.Services;

 namespace Umbraco.Cms.Api.Management.Controllers.MemberGroup.Item;
@@ -16,18 +16,30 @@ namespace Umbraco.Cms.Api.Management.Controllers.MemberGroup.Item;
 [ApiVersion("1.0")]
 public class ItemMemberGroupItemController : MemberGroupItemControllerBase
 {
-    private readonly IEntityService _entityService;
    private readonly IUmbracoMapper _mapper;
+    private readonly IMemberGroupService _memberGroupService;
+
+    // TODO (V19): When the obsolete constructor is removed, also remove the unused dependency on IEntityService.

    /// <summary>
-    /// Initializes a new instance of the <see cref="Umbraco.Cms.Api.Management.Controllers.MemberGroup.Item.ItemMemberGroupItemController"/> class, providing services for managing member group items.
+    /// Initializes a new instance of the <see cref="ItemMemberGroupItemController"/> class.
    /// </summary>
-    /// <param name="entityService">The service used to interact with entities in the Umbraco CMS.</param>
    /// <param name="mapper">The mapper used for mapping Umbraco objects.</param>
-    public ItemMemberGroupItemController(IEntityService entityService, IUmbracoMapper mapper)
+    /// <param name="memberGroupService">The service used to look up member groups.</param>
+    [ActivatorUtilitiesConstructor]
+    public ItemMemberGroupItemController(IEntityService entityService, IUmbracoMapper mapper, IMemberGroupService memberGroupService)
    {
-        _entityService = entityService;
        _mapper = mapper;
+        _memberGroupService = memberGroupService;
+    }
+
+    [Obsolete("Please use the constructor with all parameters. Scheduled for removal in Umbraco 19.")]
+    public ItemMemberGroupItemController(IEntityService entityService, IUmbracoMapper mapper)
+        : this(
+            entityService,
+            mapper,
+            StaticServiceProvider.Instance.GetRequiredService<IMemberGroupService>())
+    {
    }

    [HttpGet]
@@ -35,17 +47,19 @@ public class ItemMemberGroupItemController : MemberGroupItemControllerBase
    [ProducesResponseType(typeof(IEnumerable<MemberGroupItemResponseModel>), StatusCodes.Status200OK)]
    [EndpointSummary("Gets a collection of member group items.")]
    [EndpointDescription("Gets a collection of member group items identified by the provided Ids.")]
-    public Task<IActionResult> Item(
+    public async Task<IActionResult> Item(
        CancellationToken cancellationToken,
        [FromQuery(Name = "id")] HashSet<Guid> ids)
    {
        if (ids.Count is 0)
        {
-            return Task.FromResult<IActionResult>(Ok(Enumerable.Empty<MemberGroupItemResponseModel>()));
+            return Ok(Enumerable.Empty<MemberGroupItemResponseModel>());
        }

-        IEnumerable<IEntitySlim> memberGroups = _entityService.GetAll(UmbracoObjectTypes.MemberGroup, ids.ToArray());
-        List<MemberGroupItemResponseModel> responseModel = _mapper.MapEnumerable<IEntitySlim, MemberGroupItemResponseModel>(memberGroups);
-        return Task.FromResult<IActionResult>(Ok(responseModel));
+        // Resolve via IMemberGroupService so custom implementations are honoured, rather than
+        // going directly to the entity/repository layer.
+        IEnumerable<IMemberGroup> memberGroups = await _memberGroupService.GetAsync(ids);
+        List<MemberGroupItemResponseModel> responseModel = _mapper.MapEnumerable<IMemberGroup, MemberGroupItemResponseModel>(memberGroups);
+        return Ok(responseModel);
    }
 }
@@ -32,6 +32,14 @@ public class SearchMemberTypeItemController : MemberTypeItemControllerBase
        _mapper = mapper;
    }

+    /// <summary>
+    /// Searches for member type items matching the specified query, with support for pagination.
+    /// </summary>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="query">The search query used to filter member type items.</param>
+    /// <param name="skip">The number of items to skip before starting to collect the result set (used for pagination).</param>
+    /// <param name="take">The maximum number of items to return in the result set (used for pagination).</param>
+    /// <returns>A task representing the asynchronous operation. The task result contains an <see cref="IActionResult"/> with a <see cref="PagedModel{MemberTypeItemResponseModel}"/> containing the search results.</returns>
    [HttpGet("search")]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(typeof(PagedModel<MemberTypeItemResponseModel>), StatusCodes.Status200OK)]
@@ -45,11 +53,14 @@ public class SearchMemberTypeItemController : MemberTypeItemControllerBase
            return Task.FromResult<IActionResult>(Ok(new PagedModel<MemberTypeItemResponseModel> { Total = searchResult.Total }));
        }

-        IEnumerable<IMemberType> memberTypes = _memberTypeService.GetMany(searchResult.Items.Select(item => item.Key).ToArray());
+        Guid[] keys = searchResult.Items.Select(item => item.Key).ToArray();
+        IEnumerable<IMemberType> memberTypes = _memberTypeService.GetMany(keys);
+        IEnumerable<IMemberType> orderedMemberTypes = OrderByRequestedIds(memberTypes, keys);
+
        var result = new PagedModel<MemberTypeItemResponseModel>
        {
-            Items = _mapper.MapEnumerable<IMemberType, MemberTypeItemResponseModel>(memberTypes),
-            Total = searchResult.Total
+            Items = _mapper.MapEnumerable<IMemberType, MemberTypeItemResponseModel>(orderedMemberTypes),
+            Total = searchResult.Total,
        };

        return Task.FromResult<IActionResult>(Ok(result));
@@ -8,67 +8,38 @@ using Umbraco.Cms.Core.Security;
 namespace Umbraco.Cms.Api.Management.Controllers.RedirectUrlManagement;

 /// <summary>
-/// Controller for setting the redirect URL tracking status.
+/// Controller for setting the redirect URL tracking status. Retained for backwards compatibility only;
+/// the endpoint no longer modifies any configuration.
 /// </summary>
 [ApiVersion("1.0")]
+[Obsolete("This controller is deprecated and no longer modifies the configuration. Set the Umbraco:CMS:WebRouting:DisableRedirectUrlTracking configuration key instead. Scheduled for removal in Umbraco 19.")]
 public class SetStatusRedirectUrlManagementController : RedirectUrlManagementControllerBase
 {
-    private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;
-    private readonly IConfigManipulator _configManipulator;
-
    /// <summary>
    /// Initializes a new instance of the <see cref="SetStatusRedirectUrlManagementController"/> class.
    /// </summary>
-    /// <param name="backOfficeSecurityAccessor">The back office security accessor.</param>
-    /// <param name="configManipulator">The configuration manipulator.</param>
+    /// <param name="backOfficeSecurityAccessor">Ignored. Retained for binary compatibility.</param>
+    /// <param name="configManipulator">Ignored. Retained for binary compatibility.</param>
    public SetStatusRedirectUrlManagementController(
+#pragma warning disable IDE0060 // Remove unused parameter
        IBackOfficeSecurityAccessor backOfficeSecurityAccessor,
        IConfigManipulator configManipulator)
+#pragma warning restore IDE0060 // Remove unused parameter
    {
-        _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
-        _configManipulator = configManipulator;
    }

-    // TODO: Consider if we should even allow this, or only allow using the appsettings
-    // We generally don't want to edit the appsettings from our code.
-    // But maybe there is a valid use case for doing it on the fly.
    /// <summary>
-    /// Sets the redirect URL tracking status.
+    /// Deprecated. Returns an OK response without modifying any configuration. To toggle redirect URL tracking,
+    /// set the <c>Umbraco:CMS:WebRouting:DisableRedirectUrlTracking</c> configuration key instead.
    /// </summary>
    /// <param name="cancellationToken">The cancellation token for the HTTP request.</param>
-    /// <param name="status">The redirect status to set.</param>
-    /// <returns>An OK result if successful.</returns>
+    /// <param name="status">The redirect status (ignored).</param>
+    /// <returns>An OK result.</returns>
    [HttpPost("status")]
-    [EndpointSummary("Sets the redirect URL tracking status.")]
-    [EndpointDescription("Updates the redirect URL tracking configuration according to the provided status.")]
+    [EndpointSummary("Deprecated. No longer changes the redirect URL tracking status.")]
+    [EndpointDescription("This endpoint is deprecated and no longer modifies the configuration. To toggle redirect URL tracking, set the Umbraco:CMS:WebRouting:DisableRedirectUrlTracking configuration key instead.")]
    [MapToApiVersion("1.0")]
-    public async Task<IActionResult> SetStatus(CancellationToken cancellationToken, [FromQuery] RedirectStatus status)
-    {
-        // TODO: uncomment this when auth is implemented.
-        // var userIsAdmin = _backOfficeSecurityAccessor.BackOfficeSecurity?.CurrentUser?.IsAdmin();
-        // if (userIsAdmin is null or false)
-        // {
-        //     return Unauthorized();
-        // }
-
-        var enable = status switch
-        {
-            RedirectStatus.Enabled => true,
-            RedirectStatus.Disabled => false,
-            _ => throw new ArgumentOutOfRangeException(nameof(status), status, "Unknown redirect status")
-        };
-
-        // For now I'm not gonna change this to limit breaking, but it's weird to have a "disabled" switch,
-        // since you're essentially negating the boolean from the get go,
-        // it's much easier to reason with enabled = false == disabled.
-        await _configManipulator.SaveDisableRedirectUrlTrackingAsync(!enable);
-
-        // Taken from the existing implementation in RedirectUrlManagementController
-        // TODO this is ridiculous, but we need to ensure the configuration is reloaded, before this request is ended.
-        // otherwise we can read the old value in GetEnableState.
-        // The value is equal to JsonConfigurationSource.ReloadDelay
-        Thread.Sleep(250);
-
-        return Ok();
-    }
+    [Obsolete("This endpoint is deprecated and no longer modifies the configuration. Set the Umbraco:CMS:WebRouting:DisableRedirectUrlTracking configuration key instead. Scheduled for removal in Umbraco 19.")]
+    public Task<IActionResult> SetStatus(CancellationToken cancellationToken, [FromQuery] RedirectStatus status)
+        => Task.FromResult<IActionResult>(Ok());
 }
@@ -28,6 +28,7 @@ public class ConfigurationServerController : ServerControllerBase
    private readonly GlobalSettings _globalSettings;
    private readonly IBackOfficeExternalLoginProviders _externalLoginProviders;
    private readonly IHostingEnvironment _hostingEnvironment;
+    private readonly SignalRSettings _signalRSettings;

    /// <summary>
    /// Initializes a new instance of the <see cref="ConfigurationServerController"/> class.
@@ -36,13 +37,38 @@ public class ConfigurationServerController : ServerControllerBase
    /// <param name="globalSettings">The global settings options.</param>
    /// <param name="externalLoginProviders">The external login providers for back office.</param>
    /// <param name="hostingEnvironment">The hosting environment.</param>
+    /// <param name="signalRSettings">The SignalR settings options.</param>
    [ActivatorUtilitiesConstructor]
-    public ConfigurationServerController(IOptions<SecuritySettings> securitySettings, IOptions<GlobalSettings> globalSettings, IBackOfficeExternalLoginProviders externalLoginProviders, IHostingEnvironment hostingEnvironment)
+    public ConfigurationServerController(
+        IOptions<SecuritySettings> securitySettings,
+        IOptions<GlobalSettings> globalSettings,
+        IBackOfficeExternalLoginProviders externalLoginProviders,
+        IHostingEnvironment hostingEnvironment,
+        IOptions<SignalRSettings> signalRSettings)
    {
        _securitySettings = securitySettings.Value;
        _globalSettings = globalSettings.Value;
        _externalLoginProviders = externalLoginProviders;
        _hostingEnvironment = hostingEnvironment;
+        _signalRSettings = signalRSettings.Value;
+    }
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="Umbraco.Cms.Api.Management.Controllers.Server.ConfigurationServerController"/> class.
+    /// </summary>
+    /// <param name="securitySettings">The <see cref="SecuritySettings"/> options.</param>
+    /// <param name="globalSettings">The <see cref="GlobalSettings"/> options.</param>
+    /// <param name="externalLoginProviders">The external login providers used for back office authentication.</param>
+    /// <param name="hostingEnvironment">The hosting environment.</param>
+    [Obsolete("Please use the constructor with all parameters. Scheduled for removal in Umbraco 19.")]
+    public ConfigurationServerController(IOptions<SecuritySettings> securitySettings, IOptions<GlobalSettings> globalSettings, IBackOfficeExternalLoginProviders externalLoginProviders, IHostingEnvironment hostingEnvironment)
+        : this(
+            securitySettings,
+            globalSettings,
+            externalLoginProviders,
+            hostingEnvironment,
+            StaticServiceProvider.Instance.GetRequiredService<IOptions<SignalRSettings>>())
+    {
    }

    /// <summary>
@@ -78,6 +104,10 @@ public class ConfigurationServerController : ServerControllerBase
            VersionCheckPeriod = _globalSettings.VersionCheckPeriod,
            AllowLocalLogin = _externalLoginProviders.HasDenyLocalLogin() is false,
            UmbracoCssPath = _hostingEnvironment.ToAbsolute(_globalSettings.UmbracoCssPath),
+            SignalR = new SignalRClientSettingsResponseModel
+            {
+                SkipNegotiation = _signalRSettings.ClientShouldSkipNegotiation,
+            },
        };

        return Task.FromResult<IActionResult>(Ok(responseModel));
@@ -32,6 +32,14 @@ public class SearchTemplateItemController : TemplateItemControllerBase
        _mapper = mapper;
    }

+    /// <summary>
+    /// Searches for template items matching the specified query, with support for pagination.
+    /// </summary>
+    /// <param name="cancellationToken">A token to monitor for cancellation requests.</param>
+    /// <param name="query">The search query used to filter template items.</param>
+    /// <param name="skip">The number of items to skip before starting to collect the result set (used for pagination).</param>
+    /// <param name="take">The maximum number of items to return in the result set (used for pagination).</param>
+    /// <returns>A task representing the asynchronous operation. The task result contains an <see cref="IActionResult"/> with a <see cref="PagedModel{TemplateItemResponseModel}"/> containing the search results.</returns>
    [HttpGet("search")]
    [MapToApiVersion("1.0")]
    [ProducesResponseType(typeof(PagedModel<TemplateItemResponseModel>), StatusCodes.Status200OK)]
@@ -45,11 +53,14 @@ public class SearchTemplateItemController : TemplateItemControllerBase
            return Ok(new PagedModel<TemplateItemResponseModel> { Total = searchResult.Total });
        }

-        IEnumerable<ITemplate> templates = await _templateService.GetAllAsync(searchResult.Items.Select(item => item.Key).ToArray());
+        Guid[] keys = searchResult.Items.Select(x => x.Key).ToArray();
+        IEnumerable<ITemplate> templates = await _templateService.GetAllAsync(keys);
+        IEnumerable<ITemplate> orderedTemplates = OrderByRequestedIds(templates, keys);
+
        var result = new PagedModel<TemplateItemResponseModel>
        {
-            Items = _mapper.MapEnumerable<ITemplate, TemplateItemResponseModel>(templates),
-            Total = searchResult.Total
+            Items = _mapper.MapEnumerable<ITemplate, TemplateItemResponseModel>(orderedTemplates),
+            Total = searchResult.Total,
        };

        return Ok(result);
@@ -0,0 +1,54 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Umbraco.Cms.Core.Security;
+using Umbraco.Cms.Core.Services;
+using Umbraco.Cms.Core.Services.OperationStatus;
+
+namespace Umbraco.Cms.Api.Management.Controllers.User.Current;
+
+/// <summary>
+/// Controller responsible for handling requests to clear the avatar of the currently authenticated user.
+/// </summary>
+[ApiVersion("1.0")]
+public class ClearAvatarCurrentUserController : CurrentUserControllerBase
+{
+    private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;
+    private readonly IUserService _userService;
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="ClearAvatarCurrentUserController"/> class.
+    /// </summary>
+    /// <param name="backOfficeSecurityAccessor">Provides access to back office security features for the current user.</param>
+    /// <param name="userService">Service for managing user-related operations.</param>
+    public ClearAvatarCurrentUserController(
+        IBackOfficeSecurityAccessor backOfficeSecurityAccessor,
+        IUserService userService)
+    {
+        _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
+        _userService = userService;
+    }
+
+    /// <summary>
+    /// Removes the avatar image for the currently authenticated user.
+    /// </summary>
+    /// <param name="cancellationToken">A cancellation token to cancel the operation.</param>
+    /// <returns>An <see cref="IActionResult"/> indicating the result of the operation.</returns>
+    [MapToApiVersion("1.0")]
+    [HttpDelete("avatar")]
+    [ProducesResponseType(StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
+    [EndpointSummary("Clears the current user's avatar.")]
+    [EndpointDescription("Removes the avatar image for the currently authenticated user.")]
+    public async Task<IActionResult> ClearAvatar(CancellationToken cancellationToken)
+    {
+        Guid userKey = CurrentUserKey(_backOfficeSecurityAccessor);
+
+        UserOperationStatus result = await _userService.ClearAvatarAsync(userKey);
+
+        return result is UserOperationStatus.Success
+            ? Ok()
+            : UserOperationStatusResult(result);
+    }
+}
@@ -20,7 +20,6 @@ namespace Umbraco.Cms.Api.Management.Controllers.User.Current;
 public class SetAvatarCurrentUserController : CurrentUserControllerBase
 {
    private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;
-    private readonly IAuthorizationService _authorizationService;
    private readonly IUserService _userService;

    /// <summary>
@@ -29,13 +28,15 @@ public class SetAvatarCurrentUserController : CurrentUserControllerBase
    /// <param name="backOfficeSecurityAccessor">Provides access to back office security features for the current user.</param>
    /// <param name="authorizationService">Service used to authorize user actions.</param>
    /// <param name="userService">Service for managing user-related operations.</param>
+    // TODO (V18): Remove the IAuthorizationService parameter from the constructor and the class, as it is not used in the current implementation.
    public SetAvatarCurrentUserController(
        IBackOfficeSecurityAccessor backOfficeSecurityAccessor,
+#pragma warning disable IDE0060 // Remove unused parameter
        IAuthorizationService authorizationService,
+#pragma warning restore IDE0060 // Remove unused parameter
        IUserService userService)
    {
        _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
-        _authorizationService = authorizationService;
        _userService = userService;
    }

@@ -55,16 +56,6 @@ public class SetAvatarCurrentUserController : CurrentUserControllerBase
    {
        Guid userKey = CurrentUserKey(_backOfficeSecurityAccessor);

-        AuthorizationResult authorizationResult = await _authorizationService.AuthorizeResourceAsync(
-            User,
-            UserPermissionResource.WithKeys(userKey),
-            AuthorizationPolicies.UserPermissionByResource);
-
-        if (!authorizationResult.Succeeded)
-        {
-            return Forbidden();
-        }
-
        UserOperationStatus result = await _userService.SetAvatarAsync(userKey, model.File.Id);

        return result is UserOperationStatus.Success
@@ -0,0 +1,64 @@
+using Asp.Versioning;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Umbraco.Cms.Api.Management.Factories;
+using Umbraco.Cms.Api.Management.ViewModels.User;
+using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.Models;
+using Umbraco.Cms.Core.Models.Membership;
+using Umbraco.Cms.Core.Security;
+using Umbraco.Cms.Core.Services;
+using Umbraco.Cms.Core.Services.OperationStatus;
+
+namespace Umbraco.Cms.Api.Management.Controllers.User.Current;
+
+/// <summary>
+/// Controller responsible for update information about the currently authenticated user.
+/// </summary>
+[ApiVersion("1.0")]
+public class UpdateCurrentUserProfileController : CurrentUserControllerBase
+{
+    private readonly IUserService _userService;
+    private readonly IBackOfficeSecurityAccessor _backOfficeSecurityAccessor;
+    private readonly IUserPresentationFactory _userPresentationFactory;
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="UpdateCurrentUserProfileController"/> class, which manages user update operations in the Umbraco backoffice API.
+    /// </summary>
+    /// <param name="userService">Service for managing user data and operations.</param>
+    /// <param name="userPresentationFactory">Factory for creating user presentation models.</param>
+    /// <param name="backOfficeSecurityAccessor">Accessor for back office security context.</param>
+    public UpdateCurrentUserProfileController(
+        IUserService userService,
+        IUserPresentationFactory userPresentationFactory,
+        IBackOfficeSecurityAccessor backOfficeSecurityAccessor)
+    {
+        _userService = userService;
+        _backOfficeSecurityAccessor = backOfficeSecurityAccessor;
+        _userPresentationFactory = userPresentationFactory;
+    }
+
+    /// <summary>
+    /// Updates the current user with new details provided in the request model.
+    /// </summary>
+    /// <param name="model">The request model containing updated current user information.</param>
+    /// <returns>An <see cref="IActionResult"/> indicating the outcome of the update operation.</returns>
+    [HttpPut("profile")]
+    [MapToApiVersion("1.0")]
+    [ProducesResponseType(StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status404NotFound)]
+    [EndpointSummary("Updates current user profile.")]
+    [EndpointDescription("Updates current user profile with the details from the request model.")]
+    public async Task<IActionResult> UpdateCurrentUser(UpdateCurrentUserRequestModel model)
+    {
+        Guid userKey = CurrentUserKey(_backOfficeSecurityAccessor);
+
+        UserUpdateProfileModel updateModel = await _userPresentationFactory.CreateUpdateProfileModelAsync(model);
+        Attempt<IUser?, UserOperationStatus> result = await _userService.UpdateProfileAsync(userKey, updateModel);
+
+        return result.Success
+            ? Ok()
+            : UserOperationStatusResult(result.Status);
+    }
+}
@@ -63,6 +63,10 @@ public abstract class UserOrCurrentUserControllerBase : ManagementApiControllerB
                .WithTitle("Cannot delete user")
                .WithDetail("The user cannot be deleted.")
                .Build()),
+            UserOperationStatus.CannotDeleteUserWithLoginHistory => BadRequest(problemDetailsBuilder
+                .WithTitle("Cannot delete user")
+                .WithDetail("This user has logged in and may be referenced by audit logs or content history. Disable the user instead of deleting them.")
+                .Build()),
            UserOperationStatus.CannotDisableSelf => BadRequest(problemDetailsBuilder
                .WithTitle("Cannot disable")
                .WithDetail("A user cannot disable itself.")
@@ -5,6 +5,7 @@ using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Hosting;
 using Umbraco.Cms.Core.IO;
 using Umbraco.Cms.Web.Common.Hosting;
+using Umbraco.Cms.Web.Common.Middleware;

 namespace Umbraco.Extensions;

@@ -68,6 +69,10 @@ public static partial class UmbracoBuilderExtensions
        builder.Services.AddSingleton<IBackOfficeEnabledMarker, BackOfficeEnabledMarker>();

        builder.Services.AddUnique<IBackOfficePathGenerator, UmbracoBackOfficePathGenerator>();
+        // Registered here rather than in AddWebComponents because the middleware depends on
+        // IBackOfficePathGenerator (registered just above). DI scope validation would otherwise
+        // fail in Delivery-only/Website-only bootstraps that never call AddBackOffice().
+        builder.Services.AddSingleton<UmbracoBackOfficeCacheHeadersMiddleware>();
        builder.Services.AddUnique<IPhysicalFileSystem>(factory =>
        {
            var path = "~/";
@@ -1,5 +1,8 @@
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
 using Umbraco.Cms.Api.Management.ViewModels.DataType;
 using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.PropertyEditors;
 using Umbraco.Cms.Core.Serialization;
@@ -16,6 +19,7 @@ public class DataTypePresentationFactory : IDataTypePresentationFactory
    private readonly IDataValueEditorFactory _dataValueEditorFactory;
    private readonly IConfigurationEditorJsonSerializer _configurationEditorJsonSerializer;
    private readonly TimeProvider _timeProvider;
+    private readonly ILogger<DataTypePresentationFactory> _logger;

    /// <summary>
    /// Initializes a new instance of the <see cref="DataTypePresentationFactory"/> class, which is responsible for creating data type presentation models.
@@ -25,18 +29,46 @@ public class DataTypePresentationFactory : IDataTypePresentationFactory
    /// <param name="dataValueEditorFactory">Factory for creating data value editors.</param>
    /// <param name="configurationEditorJsonSerializer">Serializer for configuration editor JSON data.</param>
    /// <param name="timeProvider">Provides the current time for time-dependent operations.</param>
+    /// <param name="logger">The logger.</param>
    public DataTypePresentationFactory(
        IDataTypeContainerService dataTypeContainerService,
        PropertyEditorCollection propertyEditorCollection,
        IDataValueEditorFactory dataValueEditorFactory,
        IConfigurationEditorJsonSerializer configurationEditorJsonSerializer,
-        TimeProvider timeProvider)
+        TimeProvider timeProvider,
+        ILogger<DataTypePresentationFactory> logger)
    {
        _dataTypeContainerService = dataTypeContainerService;
        _propertyEditorCollection = propertyEditorCollection;
        _dataValueEditorFactory = dataValueEditorFactory;
        _configurationEditorJsonSerializer = configurationEditorJsonSerializer;
        _timeProvider = timeProvider;
+        _logger = logger;
+    }
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="DataTypePresentationFactory"/> class, which is responsible for creating data type presentation models.
+    /// </summary>
+    /// <param name="dataTypeContainerService">Service used to manage data type containers.</param>
+    /// <param name="propertyEditorCollection">A collection containing all available property editors.</param>
+    /// <param name="dataValueEditorFactory">Factory for creating data value editors.</param>
+    /// <param name="configurationEditorJsonSerializer">Serializer for configuration editor JSON data.</param>
+    /// <param name="timeProvider">Provides the current time for time-dependent operations.</param>
+    [Obsolete("Please use the constructor that takes all parameters. Scheduled for removal in Umbraco 19.")]
+    public DataTypePresentationFactory(
+        IDataTypeContainerService dataTypeContainerService,
+        PropertyEditorCollection propertyEditorCollection,
+        IDataValueEditorFactory dataValueEditorFactory,
+        IConfigurationEditorJsonSerializer configurationEditorJsonSerializer,
+        TimeProvider timeProvider)
+        : this(
+            dataTypeContainerService,
+            propertyEditorCollection,
+            dataValueEditorFactory,
+            configurationEditorJsonSerializer,
+            timeProvider,
+            StaticServiceProvider.Instance.GetRequiredService<ILogger<DataTypePresentationFactory>>())
+    {
    }

    /// <inheritdoc />
@@ -72,7 +104,6 @@ public class DataTypePresentationFactory : IDataTypePresentationFactory
            dataType.Key = requestModel.Id.Value;
        }

-
        return Attempt.SucceedWithStatus<IDataType, DataTypeOperationStatus>(DataTypeOperationStatus.Success, dataType);
    }

@@ -82,7 +113,7 @@ public class DataTypePresentationFactory : IDataTypePresentationFactory
        {
            try
            {
-                var parent = await _dataTypeContainerService.GetAsync(requestModel.Parent.Id);
+                EntityContainer? parent = await _dataTypeContainerService.GetAsync(requestModel.Parent.Id);

                return parent is null
                    ? Attempt.FailWithStatus(DataTypeOperationStatus.ParentNotFound, 0)
@@ -97,6 +128,7 @@ public class DataTypePresentationFactory : IDataTypePresentationFactory
        return Attempt.SucceedWithStatus(DataTypeOperationStatus.Success, Constants.System.Root);
    }

+    /// <inheritdoc/>
    public Task<Attempt<IDataType, DataTypeOperationStatus>> CreateAsync(UpdateDataTypeRequestModel requestModel, IDataType current)
    {
        if (!_propertyEditorCollection.TryGet(requestModel.EditorAlias, out IDataEditor? editor))
@@ -104,7 +136,7 @@ public class DataTypePresentationFactory : IDataTypePresentationFactory
            return Task.FromResult(Attempt.FailWithStatus<IDataType, DataTypeOperationStatus>(DataTypeOperationStatus.PropertyEditorNotFound, new DataType(new VoidEditor(_dataValueEditorFactory), _configurationEditorJsonSerializer) ));
        }

-        IDataType dataType = (IDataType)current.DeepClone();
+        var dataType = (IDataType)current.DeepClone();

        IDictionary<string, object> configurationData = MapConfigurationData(requestModel, editor);
        dataType.Name = requestModel.Name;
@@ -119,12 +151,26 @@ public class DataTypePresentationFactory : IDataTypePresentationFactory

    private ValueStorageType GetEditorValueStorageType(IDataEditor editor, IDictionary<string, object> configurationData)
    {
-        var configurationObject = editor.GetConfigurationEditor()
-            .ToConfigurationObject(configurationData, _configurationEditorJsonSerializer);
-
-        if (configurationObject is IConfigureValueType configureValueType)
+        // Only editors whose configuration object implements IConfigureValueType derive their storage
+        // type from the configuration. Building the typed configuration object can throw for editors
+        // whose stored configuration doesn't cleanly deserialize into their configuration type; that
+        // must not fail the save, so fall back to the value editor's value type in that case.
+        try
        {
-            return ValueTypes.ToStorageType(configureValueType.ValueType);
+            if (editor.GetConfigurationEditor().ToConfigurationObject(configurationData, _configurationEditorJsonSerializer)
+                is IConfigureValueType configureValueType)
+            {
+                return ValueTypes.ToStorageType(configureValueType.ValueType);
+            }
+        }
+        catch (Exception)
+        {
+            // Configuration editors are third-party and can throw anything when the stored configuration
+            // doesn't deserialize into their configuration type. Fall back to the value editor's value type
+            // rather than failing the save, but log so the misconfiguration remains observable.
+            _logger.LogError(
+                "Could not build the configuration object for editor {EditorAlias} to determine its value storage type; falling back to the value editor's value type.",
+                editor.Alias);
        }

        var valueType = editor.GetValueEditor().ValueType;
@@ -31,6 +31,12 @@ public interface IUserPresentationFactory
    /// </summary>
    Task<UserUpdateModel> CreateUpdateModelAsync(Guid existingUserKey, UpdateUserRequestModel updateModel);

+    /// <summary>
+    /// Creates an update model for a current user based on the provided request model.
+    /// </summary>
+    // TODO V19: Remove default implementation
+    Task<UserUpdateProfileModel> CreateUpdateProfileModelAsync(UpdateCurrentUserRequestModel updateModel) => throw new NotImplementedException();
+
    /// <summary>
    /// Creates a response model for the current user based on the provided user.
    /// </summary>
@@ -56,10 +62,10 @@ public interface IUserPresentationFactory
    /// </summary>
    UserItemResponseModel CreateItemResponseModel(IUser user);

-/// <summary>
-/// Asynchronously creates a response model containing the calculated start nodes for the specified user.
-/// </summary>
-/// <param name="user">The user for whom to calculate start nodes.</param>
-/// <returns>A task representing the asynchronous operation. The task result contains the calculated user start nodes response model.</returns>
+    /// <summary>
+    /// Asynchronously creates a response model containing the calculated start nodes for the specified user.
+    /// </summary>
+    /// <param name="user">The user for whom to calculate start nodes.</param>
+    /// <returns>A task representing the asynchronous operation. The task result contains the calculated user start nodes response model.</returns>
    Task<CalculatedUserStartNodesResponseModel> CreateCalculatedUserStartNodesResponseModelAsync(IUser user);
 }
@@ -1,12 +1,12 @@
+using Microsoft.Extensions.DependencyInjection;
 using Umbraco.Cms.Api.Management.ViewModels;
 using Umbraco.Cms.Api.Management.ViewModels.Member.Item;
 using Umbraco.Cms.Api.Management.ViewModels.MemberGroup.Item;
 using Umbraco.Cms.Api.Management.ViewModels.PublicAccess;
 using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Mapping;
 using Umbraco.Cms.Core.Models;
-using Umbraco.Cms.Core.Models.Entities;
-using Umbraco.Cms.Core.Security;
 using Umbraco.Cms.Core.Services;
 using Umbraco.Cms.Core.Services.OperationStatus;
 using Umbraco.Cms.Web.Common.Security;
@@ -23,8 +23,10 @@ public class PublicAccessPresentationFactory : IPublicAccessPresentationFactory
    private readonly IEntityService _entityService;
    private readonly IMemberService _memberService;
    private readonly IUmbracoMapper _mapper;
-    private readonly IMemberRoleManager _memberRoleManager;
    private readonly IMemberPresentationFactory _memberPresentationFactory;
+    private readonly IMemberGroupService _memberGroupService;
+
+    // TODO (V19): When the obsolete constructor is removed, consider also remove the unused dependency on IMemberRoleManager.

    /// <summary>
    /// Initializes a new instance of the <see cref="PublicAccessPresentationFactory"/> class.
@@ -34,18 +36,37 @@ public class PublicAccessPresentationFactory : IPublicAccessPresentationFactory
    /// <param name="mapper">The Umbraco mapper for mapping entities to response models.</param>
    /// <param name="memberRoleManager">The member role manager for resolving member groups.</param>
    /// <param name="memberPresentationFactory">The member presentation factory for creating member item response models.</param>
+    /// <param name="memberGroupService">The member group service for resolving member groups by name.</param>
+    public PublicAccessPresentationFactory(
+        IEntityService entityService,
+        IMemberService memberService,
+        IUmbracoMapper mapper,
+        IMemberRoleManager memberRoleManager,
+        IMemberPresentationFactory memberPresentationFactory,
+        IMemberGroupService memberGroupService)
+    {
+        _entityService = entityService;
+        _memberService = memberService;
+        _mapper = mapper;
+        _memberPresentationFactory = memberPresentationFactory;
+        _memberGroupService = memberGroupService;
+    }
+
+    [Obsolete("Please use the constructor with all parameters. Scheduled for removal in Umbraco 19.")]
    public PublicAccessPresentationFactory(
        IEntityService entityService,
        IMemberService memberService,
        IUmbracoMapper mapper,
        IMemberRoleManager memberRoleManager,
        IMemberPresentationFactory memberPresentationFactory)
+        : this(
+            entityService,
+            memberService,
+            mapper,
+            memberRoleManager,
+            memberPresentationFactory,
+            StaticServiceProvider.Instance.GetRequiredService<IMemberGroupService>())
    {
-        _entityService = entityService;
-        _memberService = memberService;
-        _mapper = mapper;
-        _memberRoleManager = memberRoleManager;
-        _memberPresentationFactory = memberPresentationFactory;
    }

    /// <inheritdoc/>
@@ -107,21 +128,15 @@ public class PublicAccessPresentationFactory : IPublicAccessPresentationFactory
            .Select(_memberPresentationFactory.CreateItemResponseModel)
            .ToArray();

-        var allGroups = _memberRoleManager.Roles.Where(x => x.Name != null).ToDictionary(x => x.Name!);
-        IEnumerable<UmbracoIdentityRole> identityRoles = entry.Rules
+        // Resolve groups via IMemberGroupService so custom implementations (e.g. backed by an external
+        // user store) are honoured here, rather than going directly to IMemberRoleManager/IEntityService.
+        MemberGroupItemResponseModel[] memberGroups = entry.Rules
            .Where(rule => rule.RuleType == Constants.Conventions.PublicAccess.MemberRoleRuleType)
-            .Select(rule =>
-                rule.RuleValue is not null && allGroups.TryGetValue(rule.RuleValue, out UmbracoIdentityRole? memberRole)
-                    ? memberRole
-                    : null)
+            .Select(rule => rule.RuleValue is null ? null : _memberGroupService.GetByName(rule.RuleValue))
            .WhereNotNull()
+            .Select(group => _mapper.Map<MemberGroupItemResponseModel>(group)!)
            .ToArray();

-        IEnumerable<IEntitySlim> groupsEntities = identityRoles.Any()
-            ? _entityService.GetAll(UmbracoObjectTypes.MemberGroup, identityRoles.Select(x => Convert.ToInt32(x.Id)).ToArray())
-            : Enumerable.Empty<IEntitySlim>();
-        MemberGroupItemResponseModel[] memberGroups = groupsEntities.Select(x => _mapper.Map<MemberGroupItemResponseModel>(x)!).ToArray();
-
        var responseModel = new PublicAccessResponseModel
        {
            Members = members,
@@ -1,5 +1,6 @@
 using Umbraco.Cms.Api.Management.ViewModels;
 using Umbraco.Cms.Api.Management.ViewModels.RedirectUrlManagement;
+using Umbraco.Cms.Core;
 using Umbraco.Cms.Core.Models;
 using Umbraco.Cms.Core.Routing;

@@ -33,12 +34,12 @@ public class RedirectUrlPresentationFactory : IRedirectUrlPresentationFactory
    {
        var destinationUrl = source.ContentId > 0
            ? _publishedUrlProvider.GetUrl(source.ContentId, culture: source.Culture)
-            : "#";
+            : Constants.Routing.Unroutable;

        var originalUrl = _publishedUrlProvider.GetUrlFromRoute(source.ContentId, source.Url, source.Culture);

        // Even if the URL could not be extracted from the route, if we have a path as a the route for the original URL, we should display it.
-        if (originalUrl == "#" && source.Url.StartsWith('/'))
+        if (originalUrl == Constants.Routing.Unroutable && source.Url.StartsWith('/'))
        {
            originalUrl = source.Url;
        }
@@ -389,4 +389,15 @@ public class UserPresentationFactory : IUserPresentationFactory

    private static bool HasRootAccess(IEnumerable<int>? startNodeIds)
        => startNodeIds?.Contains(Constants.System.Root) is true;
+
+    /// <inheritdoc/>
+    public Task<UserUpdateProfileModel> CreateUpdateProfileModelAsync(UpdateCurrentUserRequestModel updateModel)
+    {
+        var model = new UserUpdateProfileModel
+        {
+            LanguageIsoCode = updateModel.LanguageIsoCode
+        };
+
+        return Task.FromResult(model);
+    }
 }
@@ -41,6 +41,7 @@ public class ItemTypeMapDefinition : IMapDefinition
        mapper.Define<IMediaType, MediaTypeItemResponseModel>((_, _) => new MediaTypeItemResponseModel(), Map);
        mapper.Define<MediaTypeFileExtensionMatchResult, AllowedMediaTypeItemResponseModel>((_, _) => new AllowedMediaTypeItemResponseModel(), Map);
        mapper.Define<IEntitySlim, MemberGroupItemResponseModel>((_, _) => new MemberGroupItemResponseModel(), Map);
+        mapper.Define<IMemberGroup, MemberGroupItemResponseModel>((_, _) => new MemberGroupItemResponseModel(), Map);
        mapper.Define<ITemplate, TemplateItemResponseModel>((_, _) => new TemplateItemResponseModel { Alias = string.Empty }, Map);
        mapper.Define<IMemberType, MemberTypeItemResponseModel>((_, _) => new MemberTypeItemResponseModel(), Map);
        mapper.Define<IRelationType, RelationTypeItemResponseModel>((_, _) => new RelationTypeItemResponseModel(), Map);
@@ -105,6 +106,13 @@ public class ItemTypeMapDefinition : IMapDefinition
        target.Id = source.Key;
    }

+    // Umbraco.Code.MapAll -Flags
+    private static void Map(IMemberGroup source, MemberGroupItemResponseModel target, MapperContext context)
+    {
+        target.Name = source.Name ?? string.Empty;
+        target.Id = source.Key;
+    }
+
    // Umbraco.Code.MapAll -Flags
    private static void Map(ITemplate source, TemplateItemResponseModel target, MapperContext context)
    {
@@ -10888,6 +10888,150 @@
        ]
      }
    },
+    "/umbraco/management/api/v1/document/{id}/sort-children": {
+      "put": {
+        "tags": [
+          "Document"
+        ],
+        "summary": "Sorts the children of a document by a field.",
+        "description": "Sorts the children of the specified parent document by a system field in the given direction. When sorting by name, an optional culture selects the variant name; the culture is not validated, so children that do not vary by it (or an unrecognised culture) fall back to the invariant name.",
+        "operationId": "PutDocumentByIdSortChildren",
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "oneOf": [
+                  {
+                    "$ref": "#/components/schemas/SortDocumentChildrenByFieldRequestModel"
+                  }
+                ]
+              }
+            },
+            "text/json": {
+              "schema": {
+                "oneOf": [
+                  {
+                    "$ref": "#/components/schemas/SortDocumentChildrenByFieldRequestModel"
+                  }
+                ]
+              }
+            },
+            "application/*+json": {
+              "schema": {
+                "oneOf": [
+                  {
+                    "$ref": "#/components/schemas/SortDocumentChildrenByFieldRequestModel"
+                  }
+                ]
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "OK",
+            "headers": {
+              "Umb-Notifications": {
+                "description": "The list of notifications produced during the request.",
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/components/schemas/NotificationHeaderModel"
+                  },
+                  "nullable": true
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Bad Request",
+            "headers": {
+              "Umb-Notifications": {
+                "description": "The list of notifications produced during the request.",
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/components/schemas/NotificationHeaderModel"
+                  },
+                  "nullable": true
+                }
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": {
+                  "oneOf": [
+                    {
+                      "$ref": "#/components/schemas/ProblemDetails"
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "Not Found",
+            "headers": {
+              "Umb-Notifications": {
+                "description": "The list of notifications produced during the request.",
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/components/schemas/NotificationHeaderModel"
+                  },
+                  "nullable": true
+                }
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": {
+                  "oneOf": [
+                    {
+                      "$ref": "#/components/schemas/ProblemDetails"
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "The resource is protected and requires an authentication token"
+          },
+          "403": {
+            "description": "The authenticated user does not have access to this resource",
+            "headers": {
+              "Umb-Notifications": {
+                "description": "The list of notifications produced during the request.",
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/components/schemas/NotificationHeaderModel"
+                  },
+                  "nullable": true
+                }
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "Backoffice-User": [ ]
+          }
+        ]
+      }
+    },
    "/umbraco/management/api/v1/document/{id}/unpublish": {
      "put": {
        "tags": [
@@ -11282,6 +11426,113 @@
        ]
      }
    },
+    "/umbraco/management/api/v1/document/root/sort-children": {
+      "put": {
+        "tags": [
+          "Document"
+        ],
+        "summary": "Sorts the root-level documents by a field.",
+        "description": "Sorts the root-level documents by a system field in the given direction. When sorting by name, an optional culture selects the variant name; the culture is not validated, so documents that do not vary by it (or an unrecognised culture) fall back to the invariant name.",
+        "operationId": "PutDocumentRootSortChildren",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "oneOf": [
+                  {
+                    "$ref": "#/components/schemas/SortDocumentChildrenByFieldRequestModel"
+                  }
+                ]
+              }
+            },
+            "text/json": {
+              "schema": {
+                "oneOf": [
+                  {
+                    "$ref": "#/components/schemas/SortDocumentChildrenByFieldRequestModel"
+                  }
+                ]
+              }
+            },
+            "application/*+json": {
+              "schema": {
+                "oneOf": [
+                  {
+                    "$ref": "#/components/schemas/SortDocumentChildrenByFieldRequestModel"
+                  }
+                ]
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "OK",
+            "headers": {
+              "Umb-Notifications": {
+                "description": "The list of notifications produced during the request.",
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/components/schemas/NotificationHeaderModel"
+                  },
+                  "nullable": true
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Bad Request",
+            "headers": {
+              "Umb-Notifications": {
+                "description": "The list of notifications produced during the request.",
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/components/schemas/NotificationHeaderModel"
+                  },
+                  "nullable": true
+                }
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": {
+                  "oneOf": [
+                    {
+                      "$ref": "#/components/schemas/ProblemDetails"
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "The resource is protected and requires an authentication token"
+          },
+          "403": {
+            "description": "The authenticated user does not have access to this resource",
+            "headers": {
+              "Umb-Notifications": {
+                "description": "The list of notifications produced during the request.",
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/components/schemas/NotificationHeaderModel"
+                  },
+                  "nullable": true
+                }
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "Backoffice-User": [ ]
+          }
+        ]
+      }
+    },
    "/umbraco/management/api/v1/document/sort": {
      "put": {
        "tags": [
@@ -19158,6 +19409,150 @@
        ]
      }
    },
+    "/umbraco/management/api/v1/media/{id}/sort-children": {
+      "put": {
+        "tags": [
+          "Media"
+        ],
+        "summary": "Sorts the children of a media item by a field.",
+        "description": "Sorts the children of the specified parent media item by a system field in the given direction. Media items do not vary by culture, so any supplied culture is ignored.",
+        "operationId": "PutMediaByIdSortChildren",
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "oneOf": [
+                  {
+                    "$ref": "#/components/schemas/SortMediaChildrenByFieldRequestModel"
+                  }
+                ]
+              }
+            },
+            "text/json": {
+              "schema": {
+                "oneOf": [
+                  {
+                    "$ref": "#/components/schemas/SortMediaChildrenByFieldRequestModel"
+                  }
+                ]
+              }
+            },
+            "application/*+json": {
+              "schema": {
+                "oneOf": [
+                  {
+                    "$ref": "#/components/schemas/SortMediaChildrenByFieldRequestModel"
+                  }
+                ]
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "OK",
+            "headers": {
+              "Umb-Notifications": {
+                "description": "The list of notifications produced during the request.",
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/components/schemas/NotificationHeaderModel"
+                  },
+                  "nullable": true
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Bad Request",
+            "headers": {
+              "Umb-Notifications": {
+                "description": "The list of notifications produced during the request.",
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/components/schemas/NotificationHeaderModel"
+                  },
+                  "nullable": true
+                }
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": {
+                  "oneOf": [
+                    {
+                      "$ref": "#/components/schemas/ProblemDetails"
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "Not Found",
+            "headers": {
+              "Umb-Notifications": {
+                "description": "The list of notifications produced during the request.",
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/components/schemas/NotificationHeaderModel"
+                  },
+                  "nullable": true
+                }
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": {
+                  "oneOf": [
+                    {
+                      "$ref": "#/components/schemas/ProblemDetails"
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "The resource is protected and requires an authentication token"
+          },
+          "403": {
+            "description": "The authenticated user does not have access to this resource",
+            "headers": {
+              "Umb-Notifications": {
+                "description": "The list of notifications produced during the request.",
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/components/schemas/NotificationHeaderModel"
+                  },
+                  "nullable": true
+                }
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "Backoffice-User": [ ]
+          }
+        ]
+      }
+    },
    "/umbraco/management/api/v1/media/{id}/validate": {
      "put": {
        "tags": [
@@ -19408,6 +19803,113 @@
        ]
      }
    },
+    "/umbraco/management/api/v1/media/root/sort-children": {
+      "put": {
+        "tags": [
+          "Media"
+        ],
+        "summary": "Sorts the root-level media items by a field.",
+        "description": "Sorts the root-level media items by a system field in the given direction. Media items do not vary by culture, so any supplied culture is ignored.",
+        "operationId": "PutMediaRootSortChildren",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "oneOf": [
+                  {
+                    "$ref": "#/components/schemas/SortMediaChildrenByFieldRequestModel"
+                  }
+                ]
+              }
+            },
+            "text/json": {
+              "schema": {
+                "oneOf": [
+                  {
+                    "$ref": "#/components/schemas/SortMediaChildrenByFieldRequestModel"
+                  }
+                ]
+              }
+            },
+            "application/*+json": {
+              "schema": {
+                "oneOf": [
+                  {
+                    "$ref": "#/components/schemas/SortMediaChildrenByFieldRequestModel"
+                  }
+                ]
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "OK",
+            "headers": {
+              "Umb-Notifications": {
+                "description": "The list of notifications produced during the request.",
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/components/schemas/NotificationHeaderModel"
+                  },
+                  "nullable": true
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Bad Request",
+            "headers": {
+              "Umb-Notifications": {
+                "description": "The list of notifications produced during the request.",
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/components/schemas/NotificationHeaderModel"
+                  },
+                  "nullable": true
+                }
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": {
+                  "oneOf": [
+                    {
+                      "$ref": "#/components/schemas/ProblemDetails"
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "The resource is protected and requires an authentication token"
+          },
+          "403": {
+            "description": "The authenticated user does not have access to this resource",
+            "headers": {
+              "Umb-Notifications": {
+                "description": "The list of notifications produced during the request.",
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/components/schemas/NotificationHeaderModel"
+                  },
+                  "nullable": true
+                }
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "Backoffice-User": [ ]
+          }
+        ]
+      }
+    },
    "/umbraco/management/api/v1/media/sort": {
      "put": {
        "tags": [
@@ -27860,8 +28362,8 @@
        "tags": [
          "Redirect Management"
        ],
-        "summary": "Sets the redirect URL tracking status.",
-        "description": "Updates the redirect URL tracking configuration according to the provided status.",
+        "summary": "Deprecated. No longer changes the redirect URL tracking status.",
+        "description": "This endpoint is deprecated and no longer modifies the configuration. To toggle redirect URL tracking, set the Umbraco:CMS:WebRouting:DisableRedirectUrlTracking configuration key instead.",
        "operationId": "PostRedirectManagementStatus",
        "parameters": [
          {
@@ -27907,6 +28409,7 @@
            }
          }
        },
+        "deprecated": true,
        "security": [
          {
            "Backoffice-User": [ ]
@@ -36859,9 +37362,6 @@
                  "oneOf": [
                    {
                      "$ref": "#/components/schemas/NoopSetupTwoFactorModel"
-                    },
-                    {
-                      "$ref": "#/components/schemas/TwoFactorAuthInfo"
                    }
                  ]
                }
@@ -36956,9 +37456,6 @@
                  "oneOf": [
                    {
                      "$ref": "#/components/schemas/NoopSetupTwoFactorModel"
-                    },
-                    {
-                      "$ref": "#/components/schemas/TwoFactorAuthInfo"
                    }
                  ]
                }
@@ -37005,6 +37502,91 @@
      }
    },
    "/umbraco/management/api/v1/user/current/avatar": {
+      "delete": {
+        "tags": [
+          "User"
+        ],
+        "summary": "Clears the current user's avatar.",
+        "description": "Removes the avatar image for the currently authenticated user.",
+        "operationId": "DeleteUserCurrentAvatar",
+        "responses": {
+          "200": {
+            "description": "OK",
+            "headers": {
+              "Umb-Notifications": {
+                "description": "The list of notifications produced during the request.",
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/components/schemas/NotificationHeaderModel"
+                  },
+                  "nullable": true
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Bad Request",
+            "headers": {
+              "Umb-Notifications": {
+                "description": "The list of notifications produced during the request.",
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/components/schemas/NotificationHeaderModel"
+                  },
+                  "nullable": true
+                }
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": {
+                  "oneOf": [
+                    {
+                      "$ref": "#/components/schemas/ProblemDetails"
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "Not Found",
+            "headers": {
+              "Umb-Notifications": {
+                "description": "The list of notifications produced during the request.",
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/components/schemas/NotificationHeaderModel"
+                  },
+                  "nullable": true
+                }
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": {
+                  "oneOf": [
+                    {
+                      "$ref": "#/components/schemas/ProblemDetails"
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "The resource is protected and requires an authentication token"
+          }
+        },
+        "security": [
+          {
+            "Backoffice-User": [ ]
+          }
+        ]
+      },
      "post": {
        "tags": [
          "User"
@@ -37448,6 +38030,124 @@
        ]
      }
    },
+    "/umbraco/management/api/v1/user/current/profile": {
+      "put": {
+        "tags": [
+          "User"
+        ],
+        "summary": "Updates current user profile.",
+        "description": "Updates current user profile with the details from the request model.",
+        "operationId": "PutUserCurrentProfile",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "oneOf": [
+                  {
+                    "$ref": "#/components/schemas/UpdateCurrentUserRequestModel"
+                  }
+                ]
+              }
+            },
+            "text/json": {
+              "schema": {
+                "oneOf": [
+                  {
+                    "$ref": "#/components/schemas/UpdateCurrentUserRequestModel"
+                  }
+                ]
+              }
+            },
+            "application/*+json": {
+              "schema": {
+                "oneOf": [
+                  {
+                    "$ref": "#/components/schemas/UpdateCurrentUserRequestModel"
+                  }
+                ]
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "OK",
+            "headers": {
+              "Umb-Notifications": {
+                "description": "The list of notifications produced during the request.",
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/components/schemas/NotificationHeaderModel"
+                  },
+                  "nullable": true
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Bad Request",
+            "headers": {
+              "Umb-Notifications": {
+                "description": "The list of notifications produced during the request.",
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/components/schemas/NotificationHeaderModel"
+                  },
+                  "nullable": true
+                }
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": {
+                  "oneOf": [
+                    {
+                      "$ref": "#/components/schemas/ProblemDetails"
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "Not Found",
+            "headers": {
+              "Umb-Notifications": {
+                "description": "The list of notifications produced during the request.",
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/components/schemas/NotificationHeaderModel"
+                  },
+                  "nullable": true
+                }
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": {
+                  "oneOf": [
+                    {
+                      "$ref": "#/components/schemas/ProblemDetails"
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "The resource is protected and requires an authentication token"
+          }
+        },
+        "security": [
+          {
+            "Backoffice-User": [ ]
+          }
+        ]
+      }
+    },
    "/umbraco/management/api/v1/user/disable": {
      "post": {
        "tags": [
@@ -39658,6 +40358,14 @@
        },
        "additionalProperties": false
      },
+      "ContentSortFieldModel": {
+        "enum": [
+          "Name",
+          "CreateDate",
+          "UpdateDate"
+        ],
+        "type": "string"
+      },
      "CopyDataTypeRequestModel": {
        "type": "object",
        "properties": {
@@ -49852,6 +50560,7 @@
        "required": [
          "allowLocalLogin",
          "allowPasswordReset",
+          "signalR",
          "umbracoCssPath",
          "versionCheckPeriod"
        ],
@@ -49869,6 +50578,13 @@
          },
          "umbracoCssPath": {
            "type": "string"
+          },
+          "signalR": {
+            "oneOf": [
+              {
+                "$ref": "#/components/schemas/SignalRClientSettingsResponseModel"
+              }
+            ]
          }
        },
        "additionalProperties": false
@@ -49944,6 +50660,54 @@
        },
        "additionalProperties": false
      },
+      "SignalRClientSettingsResponseModel": {
+        "required": [
+          "skipNegotiation"
+        ],
+        "type": "object",
+        "properties": {
+          "skipNegotiation": {
+            "type": "boolean"
+          }
+        },
+        "additionalProperties": false
+      },
+      "SortDocumentChildrenByFieldRequestModel": {
+        "required": [
+          "direction",
+          "field"
+        ],
+        "type": "object",
+        "properties": {
+          "field": {
+            "$ref": "#/components/schemas/ContentSortFieldModel"
+          },
+          "direction": {
+            "$ref": "#/components/schemas/DirectionModel"
+          },
+          "culture": {
+            "type": "string",
+            "nullable": true
+          }
+        },
+        "additionalProperties": false
+      },
+      "SortMediaChildrenByFieldRequestModel": {
+        "required": [
+          "direction",
+          "field"
+        ],
+        "type": "object",
+        "properties": {
+          "field": {
+            "$ref": "#/components/schemas/ContentSortFieldModel"
+          },
+          "direction": {
+            "$ref": "#/components/schemas/DirectionModel"
+          }
+        },
+        "additionalProperties": false
+      },
      "SortingRequestModel": {
        "required": [
          "sorting"
@@ -50895,20 +51659,6 @@
        ],
        "type": "string"
      },
-      "TwoFactorAuthInfo": {
-        "type": "object",
-        "properties": {
-          "qrCodeSetupImageUrl": {
-            "type": "string",
-            "nullable": true
-          },
-          "secret": {
-            "type": "string",
-            "nullable": true
-          }
-        },
-        "additionalProperties": false
-      },
      "UnknownTypePermissionPresentationModel": {
        "required": [
          "$type",
@@ -50973,6 +51723,18 @@
        },
        "additionalProperties": false
      },
+      "UpdateCurrentUserRequestModel": {
+        "required": [
+          "languageIsoCode"
+        ],
+        "type": "object",
+        "properties": {
+          "languageIsoCode": {
+            "type": "string"
+          }
+        },
+        "additionalProperties": false
+      },
      "UpdateDataTypeRequestModel": {
        "required": [
          "editorAlias",
@@ -1,8 +1,12 @@
 using Microsoft.AspNetCore.Builder;
 using Microsoft.AspNetCore.Routing;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Options;
 using Umbraco.Cms.Api.Management.Controllers.Security;
 using Umbraco.Cms.Api.Management.ServerEvents;
 using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.Configuration.Models;
+using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Services;
 using Umbraco.Cms.Web.Common.Routing;
 using Umbraco.Extensions;
@@ -12,26 +16,36 @@ namespace Umbraco.Cms.Api.Management.Routing;
 /// <summary>
 /// Creates routes for the back office area.
 /// </summary>
-public sealed class BackOfficeAreaRoutes : IAreaRoutes
+public sealed class BackOfficeAreaRoutes : SignalRRoutesBase, IAreaRoutes
 {
-    private readonly IRuntimeState _runtimeState;
+    /// <summary>
+    /// Initializes a new instance of the <see cref="BackOfficeAreaRoutes" /> class.
+    /// </summary>
+    [Obsolete("Please use the constructor with all parameters. Scheduled for removal in Umbraco 19.")]
+    public BackOfficeAreaRoutes(IRuntimeState runtimeState)
+        : this(
+            runtimeState,
+            StaticServiceProvider.Instance.GetRequiredService<IOptions<SignalRSettings>>())
+    {
+    }

    /// <summary>
    /// Initializes a new instance of the <see cref="BackOfficeAreaRoutes" /> class.
    /// </summary>
-    public BackOfficeAreaRoutes(IRuntimeState runtimeState)
-        => _runtimeState = runtimeState;
-
+    public BackOfficeAreaRoutes(IRuntimeState runtimeState, IOptions<SignalRSettings> signalRSettings)
+        : base(runtimeState, signalRSettings)
+    {
+    }

    /// <inheritdoc />
    public void CreateRoutes(IEndpointRouteBuilder endpoints)
    {
-        if (_runtimeState.Level is RuntimeLevel.Install or RuntimeLevel.Upgrade or RuntimeLevel.Upgrading or RuntimeLevel.Run)
+        if (RuntimeState.Level is RuntimeLevel.Install or RuntimeLevel.Upgrade or RuntimeLevel.Upgrading or RuntimeLevel.Run)
        {
            MapMinimalBackOffice(endpoints);

-            endpoints.MapHub<BackofficeHub>(Constants.System.UmbracoPathSegment + Constants.Web.BackofficeSignalRHub);
-            endpoints.MapHub<ServerEventHub>(Constants.System.UmbracoPathSegment + Constants.Web.ServerEventSignalRHub);
+            endpoints.MapHub<BackofficeHub>(Constants.System.UmbracoPathSegment + Constants.Web.BackofficeSignalRHub, ConfigureHubEndpoint);
+            endpoints.MapHub<ServerEventHub>(Constants.System.UmbracoPathSegment + Constants.Web.ServerEventSignalRHub, ConfigureHubEndpoint);
        }
    }

@@ -1,7 +1,11 @@
 using Microsoft.AspNetCore.Builder;
 using Microsoft.AspNetCore.Routing;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Options;
 using Umbraco.Cms.Api.Management.Preview;
 using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.Configuration.Models;
+using Umbraco.Cms.Core.DependencyInjection;
 using Umbraco.Cms.Core.Services;
 using Umbraco.Cms.Web.Common.Routing;

@@ -10,16 +14,29 @@ namespace Umbraco.Cms.Api.Management.Routing;
 /// <summary>
 ///     Creates routes for the preview hub
 /// </summary>
-public sealed class PreviewRoutes : IAreaRoutes
+public sealed class PreviewRoutes : SignalRRoutesBase, IAreaRoutes
 {
-    private readonly IRuntimeState _runtimeState;
-
    /// <summary>
-    /// Initializes a new instance of the <see cref="Umbraco.Cms.Api.Management.Routing.PreviewRoutes"/> class, configuring preview routing based on the application's runtime state.
+    /// Initializes a new instance of the <see cref="PreviewRoutes"/> class, configuring preview routing based on the application's runtime state.
    /// </summary>
    /// <param name="runtimeState">An instance representing the current runtime state of the Umbraco application.</param>
+    [Obsolete("Please use the constructor with all parameters. Scheduled for removal in Umbraco 19.")]
    public PreviewRoutes(IRuntimeState runtimeState)
-        => _runtimeState = runtimeState;
+        : this(
+            runtimeState,
+            StaticServiceProvider.Instance.GetRequiredService<IOptions<SignalRSettings>>())
+    {
+    }
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="PreviewRoutes"/> class, configuring preview routing based on the application's runtime state.
+    /// </summary>
+    /// <param name="runtimeState">An instance representing the current runtime state of the Umbraco application.</param>
+    /// <param name="signalRSettings">The SignalR settings options.</param>
+    public PreviewRoutes(IRuntimeState runtimeState, IOptions<SignalRSettings> signalRSettings)
+        : base(runtimeState, signalRSettings)
+    {
+    }

    /// <summary>
    /// Creates the preview routes on the specified endpoint route builder.
@@ -27,9 +44,9 @@ public sealed class PreviewRoutes : IAreaRoutes
    /// <param name="endpoints">The endpoint route builder to add routes to.</param>
    public void CreateRoutes(IEndpointRouteBuilder endpoints)
    {
-        if (_runtimeState.Level is RuntimeLevel.Install or RuntimeLevel.Upgrade or RuntimeLevel.Upgrading or RuntimeLevel.Run)
+        if (RuntimeState.Level is RuntimeLevel.Install or RuntimeLevel.Upgrade or RuntimeLevel.Upgrading or RuntimeLevel.Run)
        {
-            endpoints.MapHub<PreviewHub>(GetPreviewHubRoute());
+            endpoints.MapHub<PreviewHub>(GetPreviewHubRoute(), ConfigureHubEndpoint);
        }
    }

@@ -41,3 +58,4 @@ public sealed class PreviewRoutes : IAreaRoutes
    /// </returns>
    public string GetPreviewHubRoute() => $"/{Constants.System.UmbracoPathSegment}/{nameof(PreviewHub)}";
 }
+
@@ -0,0 +1,45 @@
+using Microsoft.AspNetCore.Http.Connections;
+using Microsoft.Extensions.Options;
+using Umbraco.Cms.Core.Configuration.Models;
+using Umbraco.Cms.Core.Services;
+
+namespace Umbraco.Cms.Api.Management.Routing;
+
+/// <summary>
+/// Base class for route definitions that map SignalR hub endpoints,
+/// applying shared transport configuration from <see cref="SignalRSettings"/>.
+/// </summary>
+public abstract class SignalRRoutesBase
+{
+    private readonly SignalRSettings _signalRSettings;
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="SignalRRoutesBase"/> class.
+    /// </summary>
+    /// <param name="runtimeState">The current runtime state of the Umbraco application.</param>
+    /// <param name="signalRSettings">The SignalR settings options.</param>
+    protected SignalRRoutesBase(IRuntimeState runtimeState, IOptions<SignalRSettings> signalRSettings)
+    {
+        RuntimeState = runtimeState;
+        _signalRSettings = signalRSettings.Value;
+    }
+
+    /// <summary>
+    /// Gets the current runtime state of the Umbraco application.
+    /// </summary>
+    protected IRuntimeState RuntimeState { get; }
+
+    /// <summary>
+    /// Configures the transport options for a SignalR hub endpoint.
+    /// When <see cref="SignalRSettings.ClientShouldSkipNegotiation"/> is enabled,
+    /// restricts the endpoint to WebSocket transport only so clients can skip the negotiate round-trip.
+    /// </summary>
+    /// <param name="options">The hub endpoint dispatcher options to configure.</param>
+    protected void ConfigureHubEndpoint(HttpConnectionDispatcherOptions options)
+    {
+        if (_signalRSettings.ClientShouldSkipNegotiation)
+        {
+            options.Transports = HttpTransportType.WebSockets;
+        }
+    }
+}
@@ -0,0 +1,64 @@
+using System.Security.Claims;
+using Microsoft.AspNetCore.Authorization;
+using Umbraco.Cms.Core.Models;
+using Umbraco.Cms.Core.Security.Authorization;
+using Umbraco.Cms.Core.Services;
+using Umbraco.Extensions;
+
+namespace Umbraco.Cms.Api.Management.Security.Authorization;
+
+/// <summary>
+/// Authorizes permissions on all direct children of a node.
+/// </summary>
+internal static class AllChildrenAuthorizer
+{
+    /// <summary>
+    /// Determines whether the user is authorized for every direct child of the given parent (or the root).
+    /// </summary>
+    /// <param name="authorizationService">The authorization service.</param>
+    /// <param name="entityService">The entity service used to resolve the children.</param>
+    /// <param name="user">The current user.</param>
+    /// <param name="parentKey">The parent key, or <c>null</c> to authorize the root-level children.</param>
+    /// <param name="objectType">The object type of the children (and parent).</param>
+    /// <param name="resourceFactory">Builds the permission resource to authorize a batch of child keys against.</param>
+    /// <param name="policy">The authorization policy to apply.</param>
+    /// <returns><c>true</c> if the user is authorized against all children; otherwise <c>false</c>.</returns>
+    public static async Task<bool> IsAuthorizedForChildrenAsync(
+        IAuthorizationService authorizationService,
+        IEntityService entityService,
+        ClaimsPrincipal user,
+        Guid? parentKey,
+        UmbracoObjectTypes objectType,
+        Func<IEnumerable<Guid>, IPermissionResource> resourceFactory,
+        string policy)
+    {
+        const int pageSize = 500;
+        var page = 0;
+        long total;
+        do
+        {
+            Guid[] childKeys = entityService
+                .GetPagedChildren(parentKey, [objectType], objectType, page * pageSize, pageSize, out total)
+                .Select(child => child.Key)
+                .ToArray();
+
+            if (childKeys.Length > 0)
+            {
+                AuthorizationResult authorizationResult = await authorizationService.AuthorizeResourceAsync(
+                    user,
+                    resourceFactory(childKeys),
+                    policy);
+
+                if (authorizationResult.Succeeded is false)
+                {
+                    return false;
+                }
+            }
+
+            page++;
+        }
+        while (page * pageSize < total);
+
+        return true;
+    }
+}
@@ -113,15 +113,23 @@ public class UserStartNodeEntitiesService : IUserStartNodeEntitiesService
        return ChildUserAccessEntities(children, userStartNodePaths);
    }

-    private static List<int> GetAllowedIds(string[] userStartNodePaths, int parentId)
+    /// <summary>
+    /// For each user start node path that contains <paramref name="parentId"/>, collects the ID of
+    /// the segment immediately after the parent and returns the distinct set. E.g. given paths
+    /// ["-1,2,3,4,5", "-1,2,3,9,10"] and a parent ID of 3, the returned "next child IDs" are [4, 9].
+    /// </summary>
+    /// <param name="userStartNodePaths">The user's start node paths (comma-delimited integer IDs).</param>
+    /// <param name="parentId">The parent ID to locate within each path.</param>
+    /// <returns>The distinct "next child IDs" across all paths that contain the parent.</returns>
+    /// <remarks>
+    /// Internal rather than private so it can be unit-tested directly.
+    /// </remarks>
+    internal static List<int> GetAllowedIds(string[] userStartNodePaths, int parentId)
    {
-        // If one or more of the user start nodes are descendants of the requested parent, find the "next child IDs" in those user start node paths
-        // that are the final entries in the path.
-        // E.g. given the user start node path "-1,2,3,4,5", if the requested parent ID is 3, the "next child ID" is 4.
-        var userStartNodePathIds = userStartNodePaths.Select(path => path.Split(Constants.CharArrays.Comma).Select(int.Parse).ToArray()).ToArray();
+        var userStartNodePathIds = userStartNodePaths.Select(path => path.GetIdsFromPath()).ToArray();
        return userStartNodePathIds
            .Where(ids => ids.Contains(parentId))
-            .Select(ids => ids[ids.IndexOf(parentId) + 1]) // Given the previous checks, the parent ID can never be the last in the user start node path, so this is safe
+            .Select(ids => ids[ids.IndexOf(parentId) + 1]) // Given the previous checks, the parent ID can never be the last in the user start node path, so this is safe.
            .Distinct()
            .ToList();
    }
@@ -21,4 +21,9 @@ public class ServerConfigurationResponseModel
    /// Gets or sets the relative or absolute path to the Umbraco CSS file used by the application.
    /// </summary>
    public string UmbracoCssPath { get; set; } = string.Empty;
+
+    /// <summary>
+    /// Gets or sets the client-side SignalR settings.
+    /// </summary>
+    public SignalRClientSettingsResponseModel SignalR { get; set; } = new();
 }
@@ -0,0 +1,10 @@
+namespace Umbraco.Cms.Api.Management.ViewModels.Server;
+
+/// <summary>
+/// Represents client-side SignalR settings returned by the server configuration endpoint.
+/// </summary>
+public class SignalRClientSettingsResponseModel
+{
+    /// <summary>Gets or sets a value indicating whether the client should skip the SignalR negotiate round-trip.</summary>
+    public bool SkipNegotiation { get; set; }
+}
@@ -0,0 +1,21 @@
+using Umbraco.Cms.Core;
+using Umbraco.Cms.Core.Models.ContentEditing;
+
+namespace Umbraco.Cms.Api.Management.ViewModels.Sorting;
+
+/// <summary>
+/// Base request model for sorting the children of a node by a system field.
+/// </summary>
+public abstract class SortChildrenByFieldRequestModelBase
+{
+    /// <summary>
+    /// Gets or sets the system field to sort the children by.
+    /// The create and update dates are node-level (not culture-specific).
+    /// </summary>
+    public required ContentSortField Field { get; init; }
+
+    /// <summary>
+    /// Gets or sets the direction to sort in.
+    /// </summary>
+    public required Direction Direction { get; init; }
+}
@@ -0,0 +1,16 @@
+using Umbraco.Cms.Core.Models.ContentEditing;
+
+namespace Umbraco.Cms.Api.Management.ViewModels.Sorting;
+
+/// <summary>
+/// Request model for sorting the children of a document by a system field.
+/// </summary>
+public class SortDocumentChildrenByFieldRequestModel : SortChildrenByFieldRequestModelBase
+{
+    /// <summary>
+    /// Gets or sets the culture whose variant name to sort by, or <c>null</c> to sort by the invariant name.
+    /// Only applies when sorting by <see cref="ContentSortField.Name"/>. The culture is not validated: a document that
+    /// does not vary by the given culture - or an unrecognised culture - falls back to the invariant name.
+    /// </summary>
+    public string? Culture { get; init; }
+}
@@ -0,0 +1,9 @@
+namespace Umbraco.Cms.Api.Management.ViewModels.Sorting;
+
+/// <summary>
+/// Request model for sorting the children of a media item by a system field.
+/// Media items do not vary by culture, so no culture is accepted.
+/// </summary>
+public class SortMediaChildrenByFieldRequestModel : SortChildrenByFieldRequestModelBase
+{
+}
@@ -0,0 +1,12 @@
+namespace Umbraco.Cms.Api.Management.ViewModels.User;
+
+/// <summary>
+/// Represents a request model for updating information about a current user.
+/// </summary>
+public class UpdateCurrentUserRequestModel
+{
+    /// <summary>
+    /// Gets or sets the ISO code of the user's language.
+    /// </summary>
+    public required string LanguageIsoCode { get; set; }
+}
@@ -59,7 +59,7 @@ namespace Umbraco.Cms.DevelopmentMode.Backoffice.InMemoryAuto
        private int? _skipver;
        private RoslynCompiler? _roslynCompiler;
        private ModelsBuilderSettings _config;
-        private bool _disposedValue;
+        private volatile bool _disposedValue;

        public InMemoryModelFactory(
            Lazy<UmbracoServices> umbracoServices,
@@ -280,25 +280,34 @@ namespace Umbraco.Cms.DevelopmentMode.Backoffice.InMemoryAuto
                }
            }

-            // don't use an upgradeable lock here because only 1 thread at a time could enter it
-            try
+            // The factory is disposed on application shutdown (via IRegisteredObject.Stop), but in-flight
+            // requests can still reach this point. Bail out with the current models rather than touching
+            // the disposed lock. The catch below covers the small window where disposal happens after this
+            // check but before (or while) the lock is acquired.
+            if (_disposedValue)
            {
-                _locker.EnterReadLock();
-                if (_hasModels)
-                {
-                    return _infos;
-                }
-            }
-            finally
-            {
-                if (_locker.IsReadLockHeld)
-                {
-                    _locker.ExitReadLock();
-                }
+                return _infos;
            }

            try
            {
+                // don't use an upgradeable lock here because only 1 thread at a time could enter it
+                try
+                {
+                    _locker.EnterReadLock();
+                    if (_hasModels)
+                    {
+                        return _infos;
+                    }
+                }
+                finally
+                {
+                    if (_locker.IsReadLockHeld)
+                    {
+                        _locker.ExitReadLock();
+                    }
+                }
+
                _locker.EnterUpgradeableReadLock();

                if (_hasModels)
@@ -359,6 +368,12 @@ namespace Umbraco.Cms.DevelopmentMode.Backoffice.InMemoryAuto

                return _infos;
            }
+            catch (ObjectDisposedException ex)
+            {
+                // Expected when the factory is disposed during shutdown mid-request; log so an unexpected disposal stays traceable.
+                _logger.LogDebug(ex, "EnsureModels interrupted by object disposal (assumed application shutdown); returning current models.");
+                return _infos;
+            }
            finally
            {
                if (_locker.IsWriteLockHeld)
@@ -15,8 +15,9 @@ SQLite-specific EF Core provider for Umbraco CMS. Contains SQLite migrations and
 This is a thin provider project that implements SQLite-specific functionality for the EF Core persistence layer:

 1. **Migration Provider** - Executes SQLite-specific migrations
-2. **Migration Provider Setup** - Configures DbContext to use SQLite
+2. **Migration Provider Setup** - Configures DbContext to use SQLite (incl. transient-error retry)
 3. **Migrations** - SQLite-specific migration files for OpenIddict tables
+4. **Retrying Execution Strategy** - Retries transient SQLite lock errors on EF Core operations

 ### Folder Structure

@@ -30,7 +31,8 @@ Umbraco.Cms.Persistence.EFCore.Sqlite/
 │   └── UmbracoDbContextModelSnapshot.cs         # Current model state
 ├── EFCoreSqliteComposer.cs                       # DI registration
 ├── SqliteMigrationProvider.cs                    # IMigrationProvider impl
-└── SqliteMigrationProviderSetup.cs               # IMigrationProviderSetup impl
+├── SqliteMigrationProviderSetup.cs               # IMigrationProviderSetup impl
+└── SqliteRetryingExecutionStrategy.cs            # IExecutionStrategy for transient lock errors
 ```

 ### Relationship with Parent Project
@@ -65,7 +67,19 @@ Registers `IMigrationProvider` and `IMigrationProviderSetup` for SQLite.

 ### SqliteMigrationProviderSetup (line 11-14)

-Configures `DbContextOptionsBuilder` with `UseSqlite` and migrations assembly.
+Configures `DbContextOptionsBuilder` with `UseSqlite`, the migrations assembly, and the
+`SqliteRetryingExecutionStrategy` (see below). Invoked from
+`UmbracoDbContext.ConfigureOptions` for every `UmbracoDbContext` instance, so all EF Core
+access to the Umbraco database (including OpenIddict's token store) inherits the retry.
+
+### SqliteRetryingExecutionStrategy
+
+Custom `Microsoft.EntityFrameworkCore.Storage.ExecutionStrategy` that retries on transient
+SQLite errors (`SQLITE_BUSY`, `SQLITE_LOCKED`) using `SqliteExceptionExtensions.IsBusyOrLocked`
+from the parent project. Defaults inherit `ExecutionStrategy.DefaultMaxRetryCount` (6) and
+`ExecutionStrategy.DefaultMaxDelay` (30s), giving a ~56-second retry budget — see the class's
+XML doc for the rationale and the unattended-upgrade escape hatch for very long migrations.
+Added to resolve issue #22939 (OpenIddict token reads failing during long migrations).

 ---

@@ -122,7 +136,8 @@ All tables prefixed with `umbraco`:
 | File | Purpose |
 |------|---------|
 | `SqliteMigrationProvider.cs` | Migration execution |
-| `SqliteMigrationProviderSetup.cs` | DbContext configuration |
+| `SqliteMigrationProviderSetup.cs` | DbContext configuration (UseSqlite + retry strategy) |
+| `SqliteRetryingExecutionStrategy.cs` | Retry on transient SQLite BUSY/LOCKED errors |
 | `EFCoreSqliteComposer.cs` | DI registration |
 | `Migrations/*.cs` | Migration files |

@@ -1,5 +1,4 @@
 using Microsoft.EntityFrameworkCore;
-using Umbraco.Cms.Core;
 using Umbraco.Cms.Persistence.EFCore.Migrations;

 namespace Umbraco.Cms.Persistence.EFCore.Sqlite;
@@ -15,6 +14,15 @@ public class SqliteMigrationProviderSetup : IMigrationProviderSetup
    /// <inheritdoc />
    public void Setup(DbContextOptionsBuilder builder, string? connectionString)
    {
-        builder.UseSqlite(connectionString, x => x.MigrationsAssembly(GetType().Assembly.FullName));
+        builder.UseSqlite(connectionString, x =>
+        {
+            x.MigrationsAssembly(GetType().Assembly.FullName);
+
+            // Retry transient SQLite errors (BUSY / LOCKED). See SqliteRetryingExecutionStrategy
+            // for the rationale — long-running migrations or schema-modifying operations can
+            // briefly lock the database in a way that surfaces as a hard error to concurrent
+            // EF Core readers (notably OpenIddict token validation). See issue #22939.
+            x.ExecutionStrategy(deps => new SqliteRetryingExecutionStrategy(deps));
+        });
    }
 }
@@ -0,0 +1,71 @@
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore.Storage;
+
+namespace Umbraco.Cms.Persistence.EFCore.Sqlite;
+
+/// <summary>
+/// EF Core execution strategy that retries on transient SQLite errors (BUSY / LOCKED).
+/// </summary>
+/// <remarks>
+/// <para>
+/// SQLite serialises writers at the database level, and schema-modifying statements briefly
+/// block readers — even in WAL mode. Without retries, concurrent EF Core reads (for example
+/// OpenIddict's token validation against <c>umbracoOpenIddictTokens</c>) surface those
+/// transient locks as <see cref="SqliteException"/> and fail the caller's request.
+/// </para>
+/// <para>
+/// Microsoft does not ship a built-in execution strategy for SQLite (only the SQL Server
+/// equivalent), so we provide this one. It piggy-backs on <see cref="ExecutionStrategy"/>'s
+/// default exponential backoff and re-uses its inherited
+/// <see cref="ExecutionStrategy.DefaultMaxRetryCount"/> (6) and
+/// <see cref="ExecutionStrategy.DefaultMaxDelay"/> (30 seconds), which produce a delay
+/// schedule of roughly 0s, 1s, 3s, 7s, 15s, 30s — a ~56-second retry window.
+/// </para>
+/// <para>
+/// On top of those EF Core delays, <c>SQLITE_BUSY</c> (error 5) is also retried internally
+/// by Microsoft.Data.Sqlite for up to the connection's <c>Default Timeout</c> (30 seconds
+/// by default) per attempt. <c>SQLITE_LOCKED</c> (error 6) is not — it returns immediately,
+/// so EF Core's retry budget is the only buffer.
+/// </para>
+/// </remarks>
+public class SqliteRetryingExecutionStrategy : ExecutionStrategy
+{
+    /// <summary>
+    /// Initializes a new instance of the <see cref="SqliteRetryingExecutionStrategy"/> class
+    /// with default retry settings inherited from <see cref="ExecutionStrategy"/>.
+    /// </summary>
+    /// <param name="dependencies">Parameter object containing service dependencies.</param>
+    public SqliteRetryingExecutionStrategy(ExecutionStrategyDependencies dependencies)
+        : this(dependencies, DefaultMaxRetryCount, DefaultMaxDelay)
+    {
+    }
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="SqliteRetryingExecutionStrategy"/> class.
+    /// </summary>
+    /// <param name="dependencies">Parameter object containing service dependencies.</param>
+    /// <param name="maxRetryCount">The maximum number of retry attempts.</param>
+    /// <param name="maxRetryDelay">The maximum delay between retries.</param>
+    public SqliteRetryingExecutionStrategy(
+        ExecutionStrategyDependencies dependencies,
+        int maxRetryCount,
+        TimeSpan maxRetryDelay)
+        : base(dependencies, maxRetryCount, maxRetryDelay)
+    {
+    }
+
+    /// <inheritdoc />
+    protected override bool ShouldRetryOn(Exception exception)
+    {
+        // EF Core wraps provider exceptions, so walk the inner-exception chain.
+        for (Exception? current = exception; current is not null; current = current.InnerException)
+        {
+            if (current is SqliteException sqlite && sqlite.IsBusyOrLocked())
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
+}
@@ -184,17 +184,11 @@ internal sealed class SqliteEFCoreDistributedLockingMechanism<T> : IDistributedL
                        throw new ArgumentException($"LockObject with id={LockId} does not exist.");
                    }
                }
-                catch (SqliteException ex) when (IsBusyOrLocked(ex))
+                catch (SqliteException ex) when (ex.IsBusyOrLocked())
                {
                    throw new DistributedWriteLockTimeoutException(LockId);
                }
            });
        }
-
-        private static bool IsBusyOrLocked(SqliteException ex) =>
-            ex.SqliteErrorCode
-                is raw.SQLITE_BUSY
-                or raw.SQLITE_LOCKED
-                or raw.SQLITE_LOCKED_SHAREDCACHE;
    }
 }
@@ -0,0 +1,26 @@
+using Microsoft.Data.Sqlite;
+using SQLitePCL;
+
+namespace Umbraco.Cms.Persistence.EFCore;
+
+/// <summary>
+/// SQLite-specific exception helpers for code running on the EF Core persistence stack.
+/// </summary>
+/// <remarks>
+/// A parallel helper exists at <c>Umbraco.Cms.Persistence.Sqlite.Services.SqliteExceptionExtensions</c>
+/// for the NPoco stack. Both stacks are independent (neither references the other) so the small
+/// duplication is intentional — keeps the layering clean.
+/// </remarks>
+public static class SqliteExceptionExtensions
+{
+    /// <summary>
+    /// Determines if the SQLite exception is a BUSY or LOCKED error.
+    /// </summary>
+    /// <param name="ex">The SQLite exception to check.</param>
+    /// <returns><c>true</c> if the error is BUSY, LOCKED, or LOCKED_SHAREDCACHE; otherwise <c>false</c>.</returns>
+    public static bool IsBusyOrLocked(this SqliteException ex) =>
+        ex.SqliteErrorCode
+            is raw.SQLITE_BUSY
+            or raw.SQLITE_LOCKED
+            or raw.SQLITE_LOCKED_SHAREDCACHE;
+}
@@ -21,7 +21,7 @@
    var backOfficeAssetsPath = BackOfficePathGenerator.BackOfficeAssetsPath;
    var loginLogoImageAlternative = Url.RouteUrl(BackOfficeGraphicsController.LoginLogoAlternativeRouteName, new {Version= "1"});
 }<!doctype html>
-<html lang="@GlobalSettings.Value.DefaultUILanguage">
+<html lang="en">

 <head>
    <meta charset="UTF-8" />
@@ -61,7 +61,7 @@
        <p>Here are the <a href="https://www.enable-javascript.com/" target="_blank" rel="noopener" style="text-decoration: underline;">instructions how to enable JavaScript in your web browser</a>.</p>
    </div>
 </noscript>
-<umb-app @(SecuritySettings.Value.KeepUserLoggedIn ? "keep-user-logged-in" : "")></umb-app>
+<umb-app lang="@GlobalSettings.Value.DefaultUILanguage" @(SecuritySettings.Value.KeepUserLoggedIn ? "keep-user-logged-in" : "")></umb-app>

@if (isDebug)
 {
@@ -35,7 +35,7 @@
 }

 <!DOCTYPE html>
-<html lang="@GlobalSettings.Value.DefaultUILanguage">
+<html lang="en">
 <head>
    <meta charset="UTF-8"/>
    <base href="@backOfficePath.EnsureEndsWith('/')" />
@@ -83,6 +83,7 @@
 </noscript>

 <umb-auth
+    lang="@GlobalSettings.Value.DefaultUILanguage"
    return-url="@backOfficePath"
    logo-image="@loginLogoImage"
    logo-image-alternative="@loginLogoImageAlternative"
@@ -16,21 +16,16 @@
  </ItemGroup>

  <!--
-    The Razor editor in VS2026 and the C# extension for VS Code uses the Razor source generator
+    The Razor editor in modern Visual Studio and the C# extension for VS Code use the Razor source generator
    for IDE functionality. We need to add some things to make sure it works correctly, but we
    only do them for design time builds, so that we don't impact regular builds or CI.
-    We also have an escape hatch in case it does cause issues, users can set the appropriate property
+    We also have an escape hatch in case it does cause issues, users can set EnableCohostEditorCompatibility=false
    in their project file to disable this.
+
+    CompilerVisibleProperty is surfaced to generators via AnalyzerConfigOptionsProvider, not as a source-generator input file,
+    so it doesn't enter the hintName-collision codepath that AdditionalFiles does. Keeping it at evaluation time is safe.
  -->
  <ItemGroup Condition="'$(DesignTimeBuild)' == 'true' and '$(EnableCohostEditorCompatibility)' != 'false'">
-    <!-- 
-      We have to make sure the source generator can see the .cshtml files, so make them AdditionalFiles.
-    -->
-    <AdditionalFiles Include="**\*.cshtml" />
-
-    <!--
-      Make sure the source generator knows where the project is, so it can compute target paths.
-    -->
    <CompilerVisibleProperty Include="MSBuildProjectDirectory" />
  </ItemGroup>
 </Project>
@@ -49,4 +49,39 @@
      <ContentWithTargetPath Include="@(_UmbracoFolderFiles)" Exclude="@(ContentWithTargetPath)" TargetPath="%(Identity)" CopyToOutputDirectory="PreserveNewest" CopyToPublishDirectory="PreserveNewest" />
    </ItemGroup>
  </Target>
+
+  <!--
+    The Razor source generator needs .cshtml files in @(AdditionalFiles). The Razor SDK adds them
+    via @(RazorGenerate), but only inside a target that runs during the build — so during cohost
+    design-time builds they may not be present yet, which is what PR #21861 worked around.
+
+    Doing the include at evaluation time (as PR #21861 did) causes duplicates with the SDK during
+    dotnet watch / hot reload design-time builds: the SDK adds the same .cshtml under a different
+    item Identity (slash form / relative vs absolute) and the generator then sees two inputs that
+    derive the same hintName, which crashes it with CS8785 (see issue #22773).
+
+    Run as a target before CoreCompile (hot-reload path) and CompileDesignTime (IDE design-time path)
+    so the SDK's contribution is visible in both cases. Then add only the .cshtml files that are not already
+    present. Both sides are normalized to %(FullPath) so items with different Identity forms still compare equal.
+
+    Set EnableCohostEditorCompatibility=false in a project to opt out entirely.
+  -->
+  <Target Name="_UmbracoEnsureRazorAdditionalFilesForCohostEditor"
+          BeforeTargets="CoreCompile;CompileDesignTime"
+          Condition="'$(DesignTimeBuild)' == 'true' and '$(EnableCohostEditorCompatibility)' != 'false'">
+    <ItemGroup>
+      <_UmbracoCshtmlCandidate Include="**\*.cshtml" />
+      <_UmbracoCshtmlCandidateFull Include="@(_UmbracoCshtmlCandidate->'%(FullPath)')" />
+
+      <_UmbracoExistingAdditionalCshtmlFull
+        Include="@(AdditionalFiles->'%(FullPath)')"
+        Condition="'%(Extension)' == '.cshtml'" />
+
+      <_UmbracoCshtmlMissingFromAdditional
+        Include="@(_UmbracoCshtmlCandidateFull)"
+        Exclude="@(_UmbracoExistingAdditionalCshtmlFull)" />
+
+      <AdditionalFiles Include="@(_UmbracoCshtmlMissingFromAdditional)" />
+    </ItemGroup>
+  </Target>
 </Project>
@@ -305,6 +305,8 @@ public class MyEntityCacheRefresher : CacheRefresherBase<MyEntityCacheRefresher>
   - `Attempt.Succeed(value)` / `Attempt.Fail<T>()`
   - `Attempt<Content, ContentEditingOperationStatus>` - typed result with status

+> Writing or reviewing a query with a `WHERE IN` on a runtime-sized collection? See "Avoiding the SQL Server 2100-parameter limit" in `/src/Umbraco.Infrastructure/CLAUDE.md` — that's where the full helper list (`Constants.Sql.MaxParameterCount`, `InGroupsOf`, NPoco's `FetchByGroups`) and the decision rules live.
+
 ### Configuration

 Configuration models in `/Configuration/Models`:
@@ -0,0 +1,12 @@
+using Umbraco.Cms.Core.Events;
+using Umbraco.Cms.Core.Notifications;
+
+namespace Umbraco.Cms.Core.Cache;
+
+/// <summary>
+/// Defines an asynchronous handler for a <typeparamref name="TNotification" /> that should be invoked when notifications are dispatched in a distributed cache scope (e.g. to trigger a distributed cache refresher).
+/// </summary>
+/// <typeparam name="TNotification">The type of the notification.</typeparam>
+public interface IDistributedCacheAsyncNotificationHandler<in TNotification> : INotificationAsyncHandler<TNotification>, IDistributedCacheNotificationHandler
+    where TNotification : INotification
+{ }
@@ -23,5 +23,14 @@ public sealed class LanguageDeletedDistributedCacheNotificationHandler : Deleted

    /// <inheritdoc />
    protected override void Handle(IEnumerable<ILanguage> entities, IDictionary<string, object?> state)
-        => _distributedCache.RemoveLanguageCache(entities);
+    {
+        _distributedCache.RemoveLanguageCache(entities);
+
+        // User groups cache their allowed language ids, so a deleted language must be evicted from
+        // them too - otherwise a stale, now-missing id lingers on the cached user group and breaks
+        // reads that resolve those ids. This is a deliberately coarse refresh of the entire user group
+        // and user caches (RefreshAll also clears IUser): we can't know which groups reference the
+        // language without a query, and language deletion is rare enough that a full refresh is fine.
+        _distributedCache.RefreshAllUserGroupCache();
+    }
 }
@@ -368,8 +368,17 @@ public class ObjectCacheAppCache : IAppPolicyCache, IDisposable
        }

        // Ensure key is removed from set when evicted from cache
-        return options.RegisterPostEvictionCallback((key, _, _, _) =>
+        return options.RegisterPostEvictionCallback((key, _, reason, _) =>
        {
+            // Removed and Replaced evictions don't need pruning here: the Remove/Clear call sites already
+            // prune the tracking set synchronously under the write lock, and a Replaced key still has a
+            // live entry (the synchronous Set re-added it). Pruning here instead runs on a background
+            // thread and races with that re-add, dropping a key whose entry is still cached. (#23064)
+            if (reason is EvictionReason.Removed or EvictionReason.Replaced)
+            {
+                return;
+            }
+
            try
            {
                if (_locker.TryEnterWriteLock(_writeLockTimeout) is false)
@@ -36,6 +36,7 @@ public interface IConfigManipulator
    /// </summary>
    /// <param name="disable">The value to save.</param>
    /// <returns></returns>
+    [Obsolete("This method is no longer used by Umbraco. Set the Umbraco:CMS:WebRouting:DisableRedirectUrlTracking configuration key instead. Scheduled for removal in Umbraco 19.")]
    Task SaveDisableRedirectUrlTrackingAsync(bool disable);

    /// <summary>
@@ -16,6 +16,11 @@ public class ContentSettings
    /// </summary>
    internal const bool StaticResolveUrlsFromTextString = false;

+    /// <summary>
+    ///     The default value for whether sorting children by a field fires per-item notifications.
+    /// </summary>
+    internal const bool StaticSortChildrenByFieldFiresNotifications = false;
+
    /// <summary>
    ///     The default preview badge markup template.
    /// </summary>
@@ -110,6 +115,18 @@ public class ContentSettings
    [DefaultValue(StaticResolveUrlsFromTextString)]
    public bool ResolveUrlsFromTextString { get; set; } = StaticResolveUrlsFromTextString;

+    /// <summary>
+    ///     Gets or sets a value indicating whether sorting the children of a node by a field fires
+    ///     per-item save/sort notifications (and therefore webhooks).
+    /// </summary>
+    /// <remarks>
+    ///     Defaults to <c>false</c>: the children are reordered with a single set-based update and a branch
+    ///     cache refresh, without per-item notifications. Set to <c>true</c> to restore per-item notifications
+    ///     (and webhooks), accepting the additional performance cost on nodes with many children.
+    /// </remarks>
+    [DefaultValue(StaticSortChildrenByFieldFiresNotifications)]
+    public bool SortChildrenByFieldFiresNotifications { get; set; } = StaticSortChildrenByFieldFiresNotifications;
+
    /// <summary>
    ///     Gets or sets a value for the collection of error pages.
    /// </summary>
@@ -30,6 +30,17 @@ public class DatabaseServerMessengerSettings
    /// </summary>
    internal const string StaticTimeBetweenPruneOperations = "00:01:00"; // TimeSpan.FromMinutes(1);

+    /// <summary>
+    ///     The default timeout for a single synchronization operation.
+    /// </summary>
+    internal const string StaticSyncTimeout = "00:01:00"; // TimeSpan.FromMinutes(1);
+
+    /// <summary>
+    ///     Gets the default timeout for a single synchronization operation, for use as a fallback when an invalid
+    ///     <see cref="SyncTimeout" /> is configured.
+    /// </summary>
+    public static readonly TimeSpan DefaultSyncTimeout = TimeSpan.Parse(StaticSyncTimeout);
+
    /// <summary>
    ///     Gets or sets a value for the maximum number of instructions that can be processed at startup; otherwise the server
    ///     cold-boots (rebuilds its caches).
@@ -55,4 +66,13 @@ public class DatabaseServerMessengerSettings
    /// </summary>
    [DefaultValue(StaticTimeBetweenPruneOperations)]
    public TimeSpan TimeBetweenPruneOperations { get; set; } = TimeSpan.Parse(StaticTimeBetweenPruneOperations);
+
+    /// <summary>
+    ///     Gets or sets the maximum time to wait for a single synchronization operation to complete before it is
+    ///     considered stalled (for example, blocked on a hung database connection) and abandoned, so the recurring
+    ///     job keeps running rather than stopping permanently. This bounds how long the job waits on a single sync,
+    ///     not how long a stalled connection itself takes to recover (which is governed by the database timeouts).
+    /// </summary>
+    [DefaultValue(StaticSyncTimeout)]
+    public TimeSpan SyncTimeout { get; set; } = DefaultSyncTimeout;
 }
@@ -20,6 +20,17 @@ public class DatabaseServerRegistrarSettings
    /// </summary>
    internal const string StaticStaleServerTimeout = "00:02:00";

+    /// <summary>
+    ///     The default timeout for a single server touch operation.
+    /// </summary>
+    internal const string StaticTouchTimeout = "00:01:00"; // TimeSpan.FromMinutes(1);
+
+    /// <summary>
+    ///     Gets the default timeout for a single server touch operation, for use as a fallback when an invalid
+    ///     <see cref="TouchTimeout" /> is configured.
+    /// </summary>
+    public static readonly TimeSpan DefaultTouchTimeout = TimeSpan.Parse(StaticTouchTimeout);
+
    /// <summary>
    ///     Gets or sets a value for the amount of time to wait between calls to the database on the background thread.
    /// </summary>
@@ -31,4 +42,13 @@ public class DatabaseServerRegistrarSettings
    /// </summary>
    [DefaultValue(StaticStaleServerTimeout)]
    public TimeSpan StaleServerTimeout { get; set; } = TimeSpan.Parse(StaticStaleServerTimeout);
+
+    /// <summary>
+    ///     Gets or sets the maximum time to wait for a single server touch operation to complete before it is
+    ///     considered stalled (for example, blocked on a hung database connection) and abandoned, so the recurring
+    ///     job keeps running rather than stopping permanently. This bounds how long the job waits on a single touch,
+    ///     not how long a stalled connection itself takes to recover (which is governed by the database timeouts).
+    /// </summary>
+    [DefaultValue(StaticTouchTimeout)]
+    public TimeSpan TouchTimeout { get; set; } = DefaultTouchTimeout;
 }
@@ -20,5 +20,12 @@ public class IndexingSettings
    /// <summary>
    /// Gets or sets a value for how many items to index at a time.
    /// </summary>
+    /// <remarks>
+    /// This is the primary lever for the peak memory used while (re)building an index: a full page of
+    /// content and its property data is held in memory at once, so lowering this value reduces rebuild
+    /// memory at the cost of more, smaller batches. Lower it on very large sites that hit memory pressure
+    /// during a rebuild.
+    /// </remarks>
+    [DefaultValue(StaticBatchSize)]
    public int BatchSize { get; set; } = StaticBatchSize;
 }
@@ -32,6 +32,11 @@ public class LoggingSettings
    /// </summary>
    internal const string StaticFileNameFormatArguments = "MachineName";

+    /// <summary>
+    ///     The default mode for enriching log events with a session identifier.
+    /// </summary>
+    internal const SessionIdLoggingMode StaticSessionIdLogging = SessionIdLoggingMode.SessionId;
+
    /// <summary>
    /// Gets or sets a value for the maximum age of a log file.
    /// </summary>
@@ -70,4 +75,16 @@ public class LoggingSettings
    /// </remarks>
    [DefaultValue(StaticFileNameFormatArguments)]
    public string FileNameFormatArguments { get; set; } = StaticFileNameFormatArguments;
+
+    /// <summary>
+    /// Gets or sets a value determining how log events are enriched with a session identifier.
+    /// </summary>
+    /// <remarks>
+    /// Defaults to <see cref="SessionIdLoggingMode.SessionId" /> for backward compatibility. Set to
+    /// <see cref="SessionIdLoggingMode.CookieHash" /> or <see cref="SessionIdLoggingMode.None" /> to avoid the
+    /// blocking session-store load that resolving the actual session id incurs per request when the session is
+    /// backed by an <c>IDistributedCache</c>.
+    /// </remarks>
+    [DefaultValue(StaticSessionIdLogging)]
+    public SessionIdLoggingMode SessionIdLogging { get; set; } = StaticSessionIdLogging;
 }
@@ -0,0 +1,33 @@
+using System.ComponentModel;
+
+namespace Umbraco.Cms.Core.Configuration.Models;
+
+/// <summary>
+/// Settings for scheduled publishing.
+/// </summary>
+[UmbracoOptions(Constants.Configuration.ConfigScheduledPublishing)]
+public class ScheduledPublishingSettings
+{
+    private const string StaticPeriod = "00:01:00";
+    private const bool StaticAlignToClock = false; // TODO (V19): Switch this to true.
+
+    /// <summary>
+    /// Gets or sets a value for how often scheduled publishing runs.
+    /// </summary>
+    [DefaultValue(StaticPeriod)]
+    public TimeSpan Period { get; set; } = TimeSpan.Parse(StaticPeriod);
+
+    /// <summary>
+    /// Gets or sets a value indicating whether scheduled publishing runs are aligned to clock boundaries
+    /// derived from <see cref="Period" /> (for example, on the minute, or every N seconds), rather than drifting
+    /// based on when the previous run completed.
+    /// </summary>
+    /// <remarks>
+    /// When enabled, <see cref="Period" /> must be a whole number of seconds that divides evenly into one hour
+    /// (for example 10, 12, 15, 20, 30 or 60 seconds) so that boundaries land on consistent clock times.
+    /// Boundaries are anchored to <strong>UTC</strong>, not the server's local time zone; for sub-minute and
+    /// whole-minute periods this is indistinguishable from local time at the second level.
+    /// </remarks>
+    [DefaultValue(StaticAlignToClock)]
+    public bool AlignToClock { get; set; } = StaticAlignToClock;
+}
@@ -0,0 +1,29 @@
+// Copyright (c) Umbraco.
+// See LICENSE for more details.
+
+namespace Umbraco.Cms.Core.Configuration.Models;
+
+/// <summary>
+/// Determines how request logging enriches log events with a session identifier.
+/// </summary>
+public enum SessionIdLoggingMode
+{
+    /// <summary>
+    /// Do not enrich log events with a session identifier.
+    /// </summary>
+    None = 0,
+
+    /// <summary>
+    /// Enrich log events with the actual ASP.NET Core session id. This is the default and matches the
+    /// historical behaviour, but reading the session id forces the session to be loaded from its store, which
+    /// is a blocking round-trip per request when the session is backed by an <c>IDistributedCache</c>.
+    /// </summary>
+    SessionId,
+
+    /// <summary>
+    /// Enrich log events with a one-way hash of the session cookie value. This provides the same per-session
+    /// correlation as <see cref="SessionId" /> without loading the session from its store, so it never incurs
+    /// a distributed-cache round-trip.
+    /// </summary>
+    CookieHash,
+}
@@ -0,0 +1,38 @@
+using System.ComponentModel;
+
+namespace Umbraco.Cms.Core.Configuration.Models;
+
+/// <summary>
+/// Typed configuration options for SignalR settings.
+/// </summary>
+/// <remarks>
+/// <para>
+/// When <see cref="ClientShouldSkipNegotiation"/> is enabled, all hub endpoints are restricted
+/// to WebSocket transport and the client skips the negotiate round-trip. The setting is forwarded
+/// to the client via the <c>/umbraco/management/api/v1/server/configuration</c> endpoint.
+/// </para>
+/// <para>
+/// Downstream packages (e.g. Umbraco Cloud) can configure these settings via
+/// <c>IConfigureOptions&lt;SignalRSettings&gt;</c> or <c>appsettings.json</c>
+/// under <c>Umbraco:CMS:SignalR</c>.
+/// </para>
+/// </remarks>
+[UmbracoOptions(Constants.Configuration.ConfigSignalR)]
+public class SignalRSettings
+{
+    internal const bool StaticClientShouldSkipNegotiation = false;
+
+    /// <summary>
+    /// Gets or sets a value indicating whether the client should skip the SignalR negotiate
+    /// round-trip and connect directly via WebSockets.
+    /// </summary>
+    /// <remarks>
+    /// When <c>true</c>, the server restricts all hub endpoints to the WebSocket transport only
+    /// (via <c>HttpConnectionDispatcherOptions.Transports</c>) and the client is instructed to
+    /// set <c>skipNegotiation = true</c> with <c>transport = WebSockets</c>. This eliminates the
+    /// negotiate HTTP request that causes failures in load-balanced deployments without sticky sessions.
+    /// This is safe for self-hosted SignalR but must <b>not</b> be used with Azure SignalR Service.
+    /// </remarks>
+    [DefaultValue(StaticClientShouldSkipNegotiation)]
+    public bool ClientShouldSkipNegotiation { get; set; } = StaticClientShouldSkipNegotiation;
+}
@@ -0,0 +1,43 @@
+// Copyright (c) Umbraco.
+// See LICENSE for more details.
+
+using Microsoft.Extensions.Options;
+
+namespace Umbraco.Cms.Core.Configuration.Models.Validation;
+
+/// <summary>
+///     Validator for configuration represented as <see cref="ScheduledPublishingSettings" />.
+/// </summary>
+public class ScheduledPublishingSettingsValidator : ConfigurationValidatorBase, IValidateOptions<ScheduledPublishingSettings>
+{
+    /// <inheritdoc />
+    public ValidateOptionsResult Validate(string? name, ScheduledPublishingSettings options)
+    {
+        if (options.Period <= TimeSpan.Zero)
+        {
+            return ValidateOptionsResult.Fail(
+                $"Configuration entry {Constants.Configuration.ConfigScheduledPublishing}:Period must be greater than zero.");
+        }
+
+        if (options.AlignToClock && IsCleanDivisorOfAnHour(options.Period) == false)
+        {
+            return ValidateOptionsResult.Fail(
+                $"Configuration entry {Constants.Configuration.ConfigScheduledPublishing}:Period must be a whole number of seconds that divides evenly into one hour (3600 seconds) when {Constants.Configuration.ConfigScheduledPublishing}:AlignToClock is enabled, e.g. 10, 12, 15, 20, 30 or 60 seconds.");
+        }
+
+        return ValidateOptionsResult.Success;
+    }
+
+    private static bool IsCleanDivisorOfAnHour(TimeSpan period)
+    {
+        var totalSeconds = period.TotalSeconds;
+
+        // Must be a positive, whole number of seconds (no sub-second component).
+        if (totalSeconds <= 0 || totalSeconds != Math.Floor(totalSeconds))
+        {
+            return false;
+        }
+
+        return 3600 % (long)totalSeconds == 0;
+    }
+}
@@ -291,6 +291,11 @@ public static partial class Constants
        /// </summary>
        public const string ConfigDistributedJobs = ConfigPrefix + "DistributedJobs";

+        /// <summary>
+        ///     The configuration key for scheduled publishing settings.
+        /// </summary>
+        public const string ConfigScheduledPublishing = ConfigPrefix + "ScheduledPublishing";
+
        /// <summary>
        ///     The configuration key for backoffice token cookie settings.
        /// </summary>
@@ -302,6 +307,11 @@ public static partial class Constants
        /// </summary>
        public const string ConfigWebsite = ConfigPrefix + "Website";

+        /// <summary>
+        ///     The configuration key for SignalR settings.
+        /// </summary>
+        public const string ConfigSignalR = ConfigPrefix + "SignalR";
+
        /// <summary>
        ///     Contains constants for named options used in configuration.
        /// </summary>
@@ -47,6 +47,17 @@ public static partial class Constants
                public const string RuntimeModeCheck = "https://docs.umbraco.com/umbraco-cms/fundamentals/setup/server-setup/runtime-modes";
            }

+            /// <summary>
+            ///     Contains documentation links for data health checks.
+            /// </summary>
+            public static class Data
+            {
+                /// <summary>
+                ///     The documentation link for untrusted database constraints check.
+                /// </summary>
+                public const string UntrustedConstraintsCheck = "https://umbra.co/healthchecks-untrusted-constraints";
+            }
+
            /// <summary>
            ///     Contains documentation links for configuration health checks.
            /// </summary>
@@ -13,6 +13,7 @@ public static partial class Constants
        /// <summary>
        ///     Name for http client which ignores certificate errors.
        /// </summary>
+        [Obsolete("Register a project specific named HttpClient with DangerousAcceptAnyServerCertificateValidator if this behavior is required. Scheduled for removal in Umbraco 19.")]
        public const string IgnoreCertificateErrors = "Umbraco:HttpClients:IgnoreCertificateErrors";

        /// <summary>
@@ -108,7 +108,7 @@ public sealed class ApiContentRouteBuilder : IApiContentRouteBuilder
        var contentPath = _apiContentPathProvider.GetContentPath(content, culture);

        // in some scenarios the published content is actually routable, but due to the built-in handling of i.e. lacking culture setup
-        // the URL provider resolves the content URL as empty string or "#". since the Delivery API handles routing explicitly,
+        // the URL provider resolves the content URL as empty or unrouetable. since the Delivery API handles routing explicitly,
        // we can perform fallback to the content route.
        if (IsInvalidContentPath(contentPath))
        {
@@ -131,7 +131,7 @@ public sealed class ApiContentRouteBuilder : IApiContentRouteBuilder

    private string ContentPreviewPath(IPublishedContent content) => $"{Constants.DeliveryApi.Routing.PreviewContentPathPrefix}{content.Key:D}{(_requestSettings.AddTrailingSlash ? "/" : string.Empty)}";

-    private static bool IsInvalidContentPath(string? path) => path.IsNullOrWhiteSpace() || "#".Equals(path);
+    private static bool IsInvalidContentPath(string? path) => path.IsNullOrWhiteSpace() || Constants.Routing.Unroutable.Equals(path);

    private IPublishedContent? GetRoot(IPublishedContent content, bool isPreview)
    {
@@ -57,6 +57,7 @@ public static partial class UmbracoBuilderExtensions
        builder.Services.AddSingleton<IValidateOptions<RequestHandlerSettings>, RequestHandlerSettingsValidator>();
        builder.Services.AddSingleton<IValidateOptions<UnattendedSettings>, UnattendedSettingsValidator>();
        builder.Services.AddSingleton<IValidateOptions<SecuritySettings>, SecuritySettingsValidator>();
+        builder.Services.AddSingleton<IValidateOptions<ScheduledPublishingSettings>, ScheduledPublishingSettingsValidator>();

        // Register configuration sections.
        // TODO (V18): Remove the registrations of UserPasswordConfigurationSettings and MemberPasswordConfigurationSettings.
@@ -102,8 +103,10 @@ public static partial class UmbracoBuilderExtensions
            .AddUmbracoOptions<CacheSettings>()
            .AddUmbracoOptions<SystemDateMigrationSettings>()
            .AddUmbracoOptions<DistributedJobSettings>()
+            .AddUmbracoOptions<ScheduledPublishingSettings>(options => options.ValidateOnStart())
            .AddUmbracoOptions<BackOfficeTokenCookieSettings>()
-            .AddUmbracoOptions<WebsiteSettings>();
+            .AddUmbracoOptions<WebsiteSettings>()
+            .AddUmbracoOptions<SignalRSettings>();

        // Configure connection string and ensure it's updated when the configuration changes
        builder.Services.AddSingleton<IConfigureOptions<ConnectionStrings>, ConfigureConnectionStrings>();
@@ -405,7 +405,8 @@
 	    0: Comma delimitted list of failed folder paths
  	-->
    <key alias="umbracoApplicationUrlCheckResultTrue"><![CDATA[AppSetting 'Umbraco:CMS:WebRouting:UmbracoApplicationUrl' je postavljen na <strong>%0%</strong>.]]></key>
-    <key alias="umbracoApplicationUrlCheckResultFalse">AppSetting 'Umbraco:CMS:WebRouting:UmbracoApplicationUrl' nije postavljen.</key>
+    <key alias="umbracoApplicationUrlCheckResultFalse"><![CDATA[AppSetting 'Umbraco:CMS:WebRouting:UmbracoApplicationUrl' nije postavljen, pa će se URL aplikacije automatski otkriti iz dolaznih zahtjeva. Preporučuje se da ga postavite izričito.]]></key>
+    <key alias="umbracoApplicationUrlCheckResultError"><![CDATA[AppSetting 'Umbraco:CMS:WebRouting:UmbracoApplicationUrl' nije postavljen, a automatsko otkrivanje URL-a aplikacije je onemogućeno ('Umbraco:CMS:WebRouting:ApplicationUrlDetection' je 'None'). Značajke koje zahtijevaju apsolutni URL, poput e-pošte za poništavanje lozinke i pozivnica, neće raditi. Postavite URL aplikacije izričito ili omogućite automatsko otkrivanje.]]></key>
    <!-- The following key get these tokens passed in:
 	    0: Comma delimitted list of headers found
  	-->
@@ -454,7 +454,8 @@
    <key alias="httpsCheckConfigurationRectifyNotPossible">Mae gosodiad ap 'Umbraco:CMS:Global:UseHttps' wedi'i osod i 'false' yn eich ffeil appSettings.json. Unwaith y byddwch yn cyrchu'r wefan hon gan ddefnyddio'r cynllun HTTPS, dylid gosod hwnnw i 'true'.</key>
    <key alias="httpsCheckConfigurationCheckResult">Mae'r gosodiad ap 'Umbraco:CMS:Global:UseHttps' wedi'i osod i '%0%' yn eich ffeil appSettings.json, mae eich cwcis %1% wedi'u marcio'n ddiogel.</key>
    <key alias="umbracoApplicationUrlCheckResultTrue">Mae gosodiad yr ap 'Umbraco:CMS:WebRouting:UmbracoApplicationUrl' wedi'i osod i <strong>%0%</strong>.</key>
-    <key alias="umbracoApplicationUrlCheckResultFalse">Nid yw gosodiad ap 'Umbraco:CMS:WebRouting:UmbracoApplicationUrl' wedi'i osod.</key>
+    <key alias="umbracoApplicationUrlCheckResultFalse"><![CDATA[Nid yw gosodiad ap 'Umbraco:CMS:WebRouting:UmbracoApplicationUrl' wedi'i osod, felly bydd URL y rhaglen yn cael ei ganfod yn awtomatig o geisiadau sy'n dod i mewn. Argymhellir ei osod yn benodol.]]></key>
+    <key alias="umbracoApplicationUrlCheckResultError"><![CDATA[Nid yw gosodiad ap 'Umbraco:CMS:WebRouting:UmbracoApplicationUrl' wedi'i osod ac mae canfod URL y rhaglen yn awtomatig wedi'i analluogi (mae 'Umbraco:CMS:WebRouting:ApplicationUrlDetection' yn 'None'). Ni fydd nodweddion sydd angen URL absoliwt, fel e-byst ailosod cyfrinair a gwahoddiadau, yn gweithio. Gosodwch URL y rhaglen yn benodol, neu galluogwch ganfod yn awtomatig.]]></key>
    <key alias="smtpMailSettingsNotFound">Nid oedd modd dod o hyd i'r ffurfweddiad 'Umbraco:CMS:Global:Smtp'.</key>
    <key alias="smtpMailSettingsHostNotConfigured">Nid oedd modd dod o hyd i'r ffurfweddiad 'Umbraco:CMS:Global:Smtp:Host'.</key>
    <key alias="smtpMailSettingsConnectionFail">Methwyd cyrraedd y gweinydd SMTP a ffurfweddwyd gyda gwesteiwr '%0%' a phorth '%1%'. Gwiriwch i sicrhau bod y gosodiadau SMTP yn y ffurfweddiad 'Umbraco:CMS:Global:Smtp' yn gywir.</key>
@@ -463,7 +463,8 @@
 	    0: Comma delimitted list of failed folder paths
  	-->
    <key alias="umbracoApplicationUrlCheckResultTrue"><![CDATA[The appSetting 'Umbraco:CMS:WebRouting:UmbracoApplicationUrl' is set to <strong>%0%</strong>.]]></key>
-    <key alias="umbracoApplicationUrlCheckResultFalse">The appSetting 'Umbraco:CMS:WebRouting:UmbracoApplicationUrl' is not set.</key>
+    <key alias="umbracoApplicationUrlCheckResultFalse"><![CDATA[The appSetting 'Umbraco:CMS:WebRouting:UmbracoApplicationUrl' is not set, so the application URL will be auto-detected from incoming requests. Setting it explicitly is recommended.]]></key>
+    <key alias="umbracoApplicationUrlCheckResultError"><![CDATA[The appSetting 'Umbraco:CMS:WebRouting:UmbracoApplicationUrl' is not set and application URL auto-detection is disabled ('Umbraco:CMS:WebRouting:ApplicationUrlDetection' is 'None'). Features that require an absolute URL, such as password reset and invitation emails, will not work. Set the application URL explicitly, or enable auto-detection.]]></key>
    <!-- The following key get these tokens passed in:
 	    0: Comma delimitted list of headers found
  	-->
@@ -452,7 +452,8 @@
 	    0: Comma delimitted list of failed folder paths
  	-->
    <key alias="umbracoApplicationUrlCheckResultTrue"><![CDATA[The appSetting 'Umbraco:CMS:WebRouting:UmbracoApplicationUrl' is set to <strong>%0%</strong>.]]></key>
-    <key alias="umbracoApplicationUrlCheckResultFalse">The appSetting 'Umbraco:CMS:WebRouting:UmbracoApplicationUrl' is not set.</key>
+    <key alias="umbracoApplicationUrlCheckResultFalse"><![CDATA[The appSetting 'Umbraco:CMS:WebRouting:UmbracoApplicationUrl' is not set, so the application URL will be auto-detected from incoming requests. Setting it explicitly is recommended.]]></key>
+    <key alias="umbracoApplicationUrlCheckResultError"><![CDATA[The appSetting 'Umbraco:CMS:WebRouting:UmbracoApplicationUrl' is not set and application URL auto-detection is disabled ('Umbraco:CMS:WebRouting:ApplicationUrlDetection' is 'None'). Features that require an absolute URL, such as password reset and invitation emails, will not work. Set the application URL explicitly, or enable auto-detection.]]></key>
    <key alias="clickJackingCheckHeaderFound">
      <![CDATA[The header or meta-tag <strong>X-Frame-Options</strong> used to control whether a site can be IFRAMEd by another was found.]]></key>
    <key alias="clickJackingCheckHeaderNotFound">
@@ -403,7 +403,8 @@
 	    0: Comma delimitted list of failed folder paths
  	-->
    <key alias="umbracoApplicationUrlCheckResultTrue"><![CDATA[AppSetting 'Umbraco:CMS:WebRouting:UmbracoApplicationUrl' je postavljen na <strong>%0%</strong>.]]></key>
-    <key alias="umbracoApplicationUrlCheckResultFalse">AppSetting 'Umbraco:CMS:WebRouting:UmbracoApplicationUrl' nije postavljen.</key>
+    <key alias="umbracoApplicationUrlCheckResultFalse"><![CDATA[AppSetting 'Umbraco:CMS:WebRouting:UmbracoApplicationUrl' nije postavljen, pa će se URL aplikacije automatski otkriti iz dolaznih zahtjeva. Preporučuje se da ga postavite izričito.]]></key>
+    <key alias="umbracoApplicationUrlCheckResultError"><![CDATA[AppSetting 'Umbraco:CMS:WebRouting:UmbracoApplicationUrl' nije postavljen, a automatsko otkrivanje URL-a aplikacije je onemogućeno ('Umbraco:CMS:WebRouting:ApplicationUrlDetection' je 'None'). Značajke koje zahtijevaju apsolutni URL, poput e-pošte za poništavanje lozinke i pozivnica, neće raditi. Postavite URL aplikacije izričito ili omogućite automatsko otkrivanje.]]></key>
    <!-- The following key get these tokens passed in:
 	    0: Comma delimitted list of headers found
  	-->
@@ -75,29 +75,40 @@ public static class PublishedContentExtensions
    [Obsolete("Please use GetUrlSegment() on IDocumentUrlService instead. Scheduled for removal in Umbraco 18.")]
    public static string? UrlSegment(this IPublishedContent content, IVariationContextAccessor? variationContextAccessor, string? culture = null)
    {
-        if (content == null)
+        ArgumentNullException.ThrowIfNull(content);
+
+        // The obsolete accessor only meaningfully applies to documents — the documented replacement is
+        // IDocumentUrlService, and media/members never had user-facing URL segments.
+        if (content.ItemType != PublishedItemType.Content)
        {
-            throw new ArgumentNullException(nameof(content));
+            return null;
        }

-        // invariant has invariant value (whatever the requested culture)
-        if (!content.ContentType.VariesByCulture())
+        string effectiveCulture = content.ContentType.VariesByCulture() is false
+            ? string.Empty
+            : culture ?? variationContextAccessor?.VariationContext?.Culture ?? string.Empty;
+
+        // Variant content with no resolved culture has no associated segment; avoid an unnecessary
+        // ILanguageService.GetAsync("") lookup inside the service.
+        if (content.ContentType.VariesByCulture() && effectiveCulture.Length == 0)
        {
-            return content.Cultures.TryGetValue(string.Empty, out PublishedCultureInfo? invariantInfos)
-                ? invariantInfos.UrlSegment
+            return null;
+        }
+
+        // Use IDocumentUrlService to get the URL segment, aligning with the non-obsolete recommended approach.
+        // Fall back to in-memory lookup when the service isn't usable — either DI hasn't been bootstrapped
+        // (unit tests) or the service hasn't been initialised (integration tests not running full Umbraco
+        // startup). In production both hold.
+        IDocumentUrlService? documentUrlService = StaticServiceProvider.Instance?.GetService<IDocumentUrlService>();
+        if (documentUrlService is null || documentUrlService.IsInitialized is false)
+        {
+            return content.Cultures.TryGetValue(effectiveCulture, out PublishedCultureInfo? infos)
+                ? infos.UrlSegment
                : null;
        }

-        // handle context culture for variant
-        if (culture == null)
-        {
-            culture = variationContextAccessor?.VariationContext?.Culture ?? string.Empty;
-        }
-
-        // get
-        return culture != string.Empty && content.Cultures.TryGetValue(culture, out PublishedCultureInfo? infos)
-            ? infos.UrlSegment
-            : null;
+        var isDraft = content.IsDraft(effectiveCulture.Length == 0 ? null : effectiveCulture);
+        return documentUrlService.GetUrlSegment(content.Key, effectiveCulture, isDraft);
    }

    #endregion
@@ -153,7 +164,9 @@ public static class PublishedContentExtensions

        // parent key is null if content is at root
        return parentKey.HasValue
-            ? publishedStatusFilteringService.FilterAvailable([parentKey.Value], null).FirstOrDefault()
+#pragma warning disable CS0618 // Type or member is obsolete (justification: temporary means to avoid breaking changes in the PublishedContentExtensions)
+            ? publishedStatusFilteringService.Unfiltered([parentKey.Value]).FirstOrDefault()
+#pragma warning restore CS0618 // Type or member is obsolete
            : null;
    }

@@ -2217,9 +2230,9 @@ public static class PublishedContentExtensions
        // with a non-existing published node, will get cache misses and call the DB
        // making it a very slow operation.

-        return publishedStatusFilteringService
-            .FilterAvailable(childrenKeys, culture)
-            .OrderBy(x => x.SortOrder);
+        // INavigationQueryService.TryGetChildrenKeys returns keys already ordered by SortOrder
+        // and FilterAvailable preserves enumeration order, so no further OrderBy is needed.
+        return publishedStatusFilteringService.FilterAvailable(childrenKeys, culture);
    }

    private static IEnumerable<IPublishedContent> EnumerateDescendantsOrSelfInternal(
@@ -2261,8 +2274,7 @@ public static class PublishedContentExtensions
        INavigationQueryService navigationQueryService,
        IPublishedStatusFilteringService publishedStatusFilteringService,
        bool orSelf,
-        string? contentTypeAlias = null,
-        string? culture = null)
+        string? contentTypeAlias = null)
    {
        if (orSelf)
        {
@@ -2281,7 +2293,9 @@ public static class PublishedContentExtensions
            yield break;
        }

-        IEnumerable<IPublishedContent> ancestors = publishedStatusFilteringService.FilterAvailable(ancestorsKeys, culture);
+#pragma warning disable CS0618 // Type or member is obsolete (justification: temporary means to avoid breaking changes in the PublishedContentExtensions)
+        IEnumerable<IPublishedContent> ancestors = publishedStatusFilteringService.Unfiltered(ancestorsKeys);
+#pragma warning restore CS0618 // Type or member is obsolete
        foreach (IPublishedContent ancestor in ancestors)
        {
            yield return ancestor;
@@ -730,6 +730,10 @@ public static partial class StringExtensions
    /// </summary>
    /// <param name="fileName">The file name to convert.</param>
    /// <returns>A friendly name with the extension stripped, underscores and dashes converted to spaces, and title case applied.</returns>
+    /// <remarks>
+    /// Mirrored client-side in <c>src/Umbraco.Web.UI.Client/src/packages/media/media/utils/to-friendly-name.function.ts</c>;
+    /// keep the two implementations in sync.
+    /// </remarks>
    public static string ToFriendlyName(this string fileName)
    {
        // strip the file extension
@@ -21,11 +21,16 @@ public static partial class StringExtensions
 #pragma warning restore IDE1006 // Naming Styles

    /// <summary>
-    /// Converts a path string to an array of node IDs in reverse order (deepest to shallowest).
+    /// Converts a path string to an array of node IDs, in path order (shallowest to deepest).
    /// </summary>
    /// <param name="path">The path string, expected as a comma-delimited collection of integers.</param>
-    /// <returns>An array of integers matching the provided path, in reverse order.</returns>
-    public static int[] GetIdsFromPathReversed(this string path)
+    /// <returns>An array of integers matching the provided path.</returns>
+    /// <remarks>
+    /// Parsing uses <see cref="CultureInfo.InvariantCulture"/> because paths persist the root
+    /// marker as ASCII "-1", which fails to parse under cultures whose
+    /// <see cref="NumberFormatInfo.NegativeSign"/> is not the ASCII hyphen-minus.
+    /// </remarks>
+    public static int[] GetIdsFromPath(this string path)
    {
        ReadOnlySpan<char> pathSpan = path.AsSpan();

@@ -44,14 +49,22 @@ public static partial class StringExtensions
            }
        }

-        var result = new int[nodeIds.Count];
-        var resultIndex = 0;
-        for (int i = nodeIds.Count - 1; i >= 0; i--)
-        {
-            result[resultIndex++] = nodeIds[i];
-        }
+        return [.. nodeIds];
+    }

-        return result;
+    /// <summary>
+    /// Converts a path string to an array of node IDs in reverse order (deepest to shallowest).
+    /// </summary>
+    /// <param name="path">The path string, expected as a comma-delimited collection of integers.</param>
+    /// <returns>An array of integers matching the provided path, in reverse order.</returns>
+    /// <remarks>
+    /// See <see cref="GetIdsFromPath"/> for parsing semantics.
+    /// </remarks>
+    public static int[] GetIdsFromPathReversed(this string path)
+    {
+        int[] ids = path.GetIdsFromPath();
+        Array.Reverse(ids);
+        return ids;
    }

    /// <summary>
@@ -44,28 +44,34 @@ public class UmbracoApplicationUrlCheck : HealthCheck

    private HealthCheckStatus CheckUmbracoApplicationUrl()
    {
-        var url = _webRoutingSettings.CurrentValue.UmbracoApplicationUrl;
+        WebRoutingSettings settings = _webRoutingSettings.CurrentValue;
+        var url = settings.UmbracoApplicationUrl;

        string resultMessage;
        StatusResultType resultType;
-        var success = false;

-        if (url.IsNullOrWhiteSpace())
+        if (url.IsNullOrWhiteSpace() is false)
        {
-            resultMessage = _textService.Localize("healthcheck", "umbracoApplicationUrlCheckResultFalse");
-            resultType = StatusResultType.Warning;
+            resultMessage = _textService.Localize("healthcheck", "umbracoApplicationUrlCheckResultTrue", [url]);
+            resultType = StatusResultType.Success;
+        }
+        else if (settings.ApplicationUrlDetection == ApplicationUrlDetection.None)
+        {
+            // No explicit URL and auto-detection is disabled, so the application URL can never be established.
+            // Features that require an absolute URL (e.g. password reset and invitation emails) will not work.
+            resultMessage = _textService.Localize("healthcheck", "umbracoApplicationUrlCheckResultError");
+            resultType = StatusResultType.Error;
        }
        else
        {
-            resultMessage = _textService.Localize("healthcheck", "umbracoApplicationUrlCheckResultTrue", new[] { url });
-            resultType = StatusResultType.Success;
-            success = true;
+            resultMessage = _textService.Localize("healthcheck", "umbracoApplicationUrlCheckResultFalse");
+            resultType = StatusResultType.Warning;
        }

        return new HealthCheckStatus(resultMessage)
        {
            ResultType = resultType,
-            ReadMoreLink = success
+            ReadMoreLink = resultType == StatusResultType.Success
                ? null
                : Constants.HealthChecks.DocumentationLinks.Security.UmbracoApplicationUrlCheck,
        };
@@ -36,7 +36,14 @@ internal sealed partial class ShadowFileSystem : IFileSystem
    /// <summary>
    /// Gets the dictionary of shadow nodes tracking file and directory changes.
    /// </summary>
-    private Dictionary<string, ShadowNode> Nodes => _nodes ??= new Dictionary<string, ShadowNode>();
+    /// <remarks>
+    /// Uses <see cref="StringComparer.OrdinalIgnoreCase"/> so the shadow exposes case-insensitive
+    /// path semantics (matching Windows file system behavior) while preserving the original case
+    /// of paths. Preserving case is required for <see cref="Complete"/>: the stored key is also
+    /// used to locate the shadow file via <c>_sfs.GetFullPath</c>, which on case-sensitive
+    /// file systems (e.g. Linux) must match the case the file was actually written with.
+    /// </remarks>
+    private Dictionary<string, ShadowNode> Nodes => _nodes ??= new Dictionary<string, ShadowNode>(StringComparer.OrdinalIgnoreCase);

    /// <inheritdoc />
    public IEnumerable<string> GetDirectories(string path)
@@ -66,7 +73,7 @@ internal sealed partial class ShadowFileSystem : IFileSystem
        var normPath = NormPath(path);
        if (recursive)
        {
-            Nodes[normPath] = new ShadowNode(true, true);
+            Nodes[normPath] = new ShadowNode(true, true, normPath);
            var remove = Nodes.Where(x => IsDescendant(normPath, x.Key)).ToList();
            foreach (KeyValuePair<string, ShadowNode> kvp in remove)
            {
@@ -84,7 +91,7 @@ internal sealed partial class ShadowFileSystem : IFileSystem
                throw new InvalidOperationException("Directory is not empty.");
            }

-            Nodes[path] = new ShadowNode(true, true);
+            Nodes[normPath] = new ShadowNode(true, true, normPath);
            var remove = Nodes.Where(x => IsChild(normPath, x.Key)).ToList();
            foreach (KeyValuePair<string, ShadowNode> kvp in remove)
            {
@@ -131,7 +138,7 @@ internal sealed partial class ShadowFileSystem : IFileSystem

                if (sd.IsDelete)
                {
-                    Nodes[dirPath] = new ShadowNode(false, true);
+                    Nodes[dirPath] = new ShadowNode(false, true, dirPath);
                }
            }
            else
@@ -146,12 +153,13 @@ internal sealed partial class ShadowFileSystem : IFileSystem
                    throw new InvalidOperationException("Invalid path.");
                }

-                Nodes[dirPath] = new ShadowNode(false, true);
+                Nodes[dirPath] = new ShadowNode(false, true, dirPath);
            }
        }

-        _sfs.AddFile(path, stream, overrideIfExists);
-        Nodes[normPath] = new ShadowNode(false, false);
+        var canonicalPath = sf?.CanonicalPath ?? path;
+        _sfs.AddFile(canonicalPath, stream, overrideIfExists);
+        Nodes[normPath] = new ShadowNode(false, false, canonicalPath);
    }

    /// <inheritdoc />
@@ -178,7 +186,7 @@ internal sealed partial class ShadowFileSystem : IFileSystem
    {
        if (Nodes.TryGetValue(NormPath(path), out ShadowNode? sf))
        {
-            return sf.IsDir || sf.IsDelete ? Stream.Null : _sfs.OpenFile(path);
+            return sf.IsDir || sf.IsDelete ? Stream.Null : _sfs.OpenFile(sf.CanonicalPath);
        }

        return Inner.OpenFile(path);
@@ -192,7 +200,8 @@ internal sealed partial class ShadowFileSystem : IFileSystem
            return;
        }

-        Nodes[NormPath(path)] = new ShadowNode(true, false);
+        var normPath = NormPath(path);
+        Nodes[normPath] = new ShadowNode(true, false, normPath);
    }

    /// <inheritdoc />
@@ -226,7 +235,7 @@ internal sealed partial class ShadowFileSystem : IFileSystem

                if (sd.IsDelete)
                {
-                    Nodes[dirPath] = new ShadowNode(false, true);
+                    Nodes[dirPath] = new ShadowNode(false, true, dirPath);
                }
            }
            else
@@ -241,13 +250,15 @@ internal sealed partial class ShadowFileSystem : IFileSystem
                    throw new InvalidOperationException("Invalid path.");
                }

-                Nodes[dirPath] = new ShadowNode(false, true);
+                Nodes[dirPath] = new ShadowNode(false, true, dirPath);
            }
        }

-        _sfs.MoveFile(normSource, normTarget, overrideIfExists);
-        Nodes[normSource] = new ShadowNode(true, false);
-        Nodes[normTarget] = new ShadowNode(false, false);
+        var sourceCanonical = sf?.CanonicalPath ?? normSource;
+        var targetCanonical = tf?.CanonicalPath ?? normTarget;
+        _sfs.MoveFile(sourceCanonical, targetCanonical, overrideIfExists);
+        Nodes[normSource] = new ShadowNode(true, false, sourceCanonical);
+        Nodes[normTarget] = new ShadowNode(false, false, targetCanonical);
    }

    /// <inheritdoc />
@@ -269,7 +280,7 @@ internal sealed partial class ShadowFileSystem : IFileSystem
    {
        if (Nodes.TryGetValue(NormPath(path), out ShadowNode? sf))
        {
-            return sf.IsDir || sf.IsDelete ? string.Empty : _sfs.GetFullPath(path);
+            return sf.IsDir || sf.IsDelete ? string.Empty : _sfs.GetFullPath(sf.CanonicalPath);
        }

        return Inner.GetFullPath(path);
@@ -291,7 +302,7 @@ internal sealed partial class ShadowFileSystem : IFileSystem
            throw new InvalidOperationException("Invalid path.");
        }

-        return _sfs.GetLastModified(path);
+        return _sfs.GetLastModified(sf.CanonicalPath);
    }

    /// <inheritdoc />
@@ -307,7 +318,7 @@ internal sealed partial class ShadowFileSystem : IFileSystem
            throw new InvalidOperationException("Invalid path.");
        }

-        return _sfs.GetCreated(path);
+        return _sfs.GetCreated(sf.CanonicalPath);
    }

    /// <inheritdoc />
@@ -323,7 +334,7 @@ internal sealed partial class ShadowFileSystem : IFileSystem
            throw new InvalidOperationException("Invalid path.");
        }

-        return _sfs.GetSize(path);
+        return _sfs.GetSize(sf.CanonicalPath);
    }

    /// <inheritdoc />
@@ -348,7 +359,7 @@ internal sealed partial class ShadowFileSystem : IFileSystem

                if (sd.IsDelete)
                {
-                    Nodes[dirPath] = new ShadowNode(false, true);
+                    Nodes[dirPath] = new ShadowNode(false, true, dirPath);
                }
            }
            else
@@ -363,12 +374,13 @@ internal sealed partial class ShadowFileSystem : IFileSystem
                    throw new InvalidOperationException("Invalid path.");
                }

-                Nodes[dirPath] = new ShadowNode(false, true);
+                Nodes[dirPath] = new ShadowNode(false, true, dirPath);
            }
        }

-        _sfs.AddFile(path, physicalPath, overrideIfExists, copy);
-        Nodes[normPath] = new ShadowNode(false, false);
+        var canonicalPath = sf?.CanonicalPath ?? path;
+        _sfs.AddFile(canonicalPath, physicalPath, overrideIfExists, copy);
+        Nodes[normPath] = new ShadowNode(false, false, canonicalPath);
    }

    /// <summary>
@@ -393,11 +405,11 @@ internal sealed partial class ShadowFileSystem : IFileSystem
                    {
                        if (Inner.CanAddPhysical)
                        {
-                            Inner.AddFile(kvp.Key, _sfs.GetFullPath(kvp.Key)); // overwrite, move
+                            Inner.AddFile(kvp.Key, _sfs.GetFullPath(kvp.Value.CanonicalPath)); // overwrite, move
                        }
                        else
                        {
-                            using (Stream stream = _sfs.OpenFile(kvp.Key))
+                            using (Stream stream = _sfs.OpenFile(kvp.Value.CanonicalPath))
                            {
                                Inner.AddFile(kvp.Key, stream, true);
                            }
@@ -441,11 +453,15 @@ internal sealed partial class ShadowFileSystem : IFileSystem
    }

    /// <summary>
-    /// Normalizes a path to lowercase with forward slashes.
+    /// Normalizes a path's directory separators to forward slashes.
    /// </summary>
    /// <param name="path">The path to normalize.</param>
    /// <returns>The normalized path.</returns>
-    private static string NormPath(string path) => path.ToLowerInvariant().Replace("\\", "/");
+    /// <remarks>
+    /// Case is preserved. Case-insensitive matching is handled by <see cref="Nodes"/>'s
+    /// <see cref="StringComparer.OrdinalIgnoreCase"/> comparer.
+    /// </remarks>
+    private static string NormPath(string path) => path.Replace("\\", "/");

    /// <summary>
    /// Determines whether the input path is a direct child of the specified path.
@@ -456,7 +472,7 @@ internal sealed partial class ShadowFileSystem : IFileSystem
    /// <remarks>Values can be "" (root), "foo", "foo/bar"...</remarks>
    private static bool IsChild(string path, string input)
    {
-        if (input.StartsWith(path) == false || input.Length < path.Length + 2)
+        if (input.StartsWith(path, StringComparison.OrdinalIgnoreCase) == false || input.Length < path.Length + 2)
        {
            return false;
        }
@@ -466,7 +482,7 @@ internal sealed partial class ShadowFileSystem : IFileSystem
            return false;
        }

-        var pos = input.IndexOf("/", path.Length + 1, StringComparison.OrdinalIgnoreCase);
+        var pos = input.IndexOf('/', path.Length + 1);
        return pos < 0;
    }

@@ -478,7 +494,7 @@ internal sealed partial class ShadowFileSystem : IFileSystem
    /// <returns><c>true</c> if input is a descendant of path; otherwise, <c>false</c>.</returns>
    private static bool IsDescendant(string path, string input)
    {
-        if (input.StartsWith(path) == false || input.Length < path.Length + 2)
+        if (input.StartsWith(path, StringComparison.OrdinalIgnoreCase) == false || input.Length < path.Length + 2)
        {
            return false;
        }
@@ -495,12 +511,14 @@ internal sealed partial class ShadowFileSystem : IFileSystem
    {
        foreach (var file in Inner.GetFiles(path))
        {
-            Nodes[NormPath(file)] = new ShadowNode(true, false);
+            var normFile = NormPath(file);
+            Nodes[normFile] = new ShadowNode(true, false, normFile);
        }

        foreach (var dir in Inner.GetDirectories(path))
        {
-            Nodes[NormPath(dir)] = new ShadowNode(true, true);
+            var normDir = NormPath(dir);
+            Nodes[normDir] = new ShadowNode(true, true, normDir);
            if (recurse)
            {
                Delete(dir, true);
@@ -612,10 +630,12 @@ internal sealed partial class ShadowFileSystem : IFileSystem
        /// </summary>
        /// <param name="isDelete">Whether this node represents a deletion.</param>
        /// <param name="isdir">Whether this node represents a directory.</param>
-        public ShadowNode(bool isDelete, bool isdir)
+        /// <param name="canonicalPath">The original-case path tracked by this node.</param>
+        public ShadowNode(bool isDelete, bool isdir, string canonicalPath)
        {
            IsDelete = isDelete;
            IsDir = isdir;
+            CanonicalPath = canonicalPath;
        }

        /// <summary>
@@ -628,6 +648,17 @@ internal sealed partial class ShadowFileSystem : IFileSystem
        /// </summary>
        public bool IsDir { get; }

+        /// <summary>
+        /// Gets the original-case path tracked by this node. For existing-file nodes this is
+        /// the path used the first time the file was staged in the current shadow scope.
+        /// </summary>
+        /// <remarks>
+        /// All operations against the inner shadow file system (<c>_sfs</c>) must use this
+        /// path so that re-staging the same logical path with a different case still reaches
+        /// the same on-disk file on case-sensitive file systems (e.g. Linux).
+        /// </remarks>
+        public string CanonicalPath { get; }
+
        /// <summary>
        /// Gets a value indicating whether this node represents an existing item (not deleted).
        /// </summary>
@@ -0,0 +1,22 @@
+namespace Umbraco.Cms.Core.Models.ContentEditing;
+
+/// <summary>
+///     Represents a system field that a node's children can be sorted by.
+/// </summary>
+public enum ContentSortField
+{
+    /// <summary>
+    ///     Sort by the node's name.
+    /// </summary>
+    Name,
+
+    /// <summary>
+    ///     Sort by the date the node was created.
+    /// </summary>
+    CreateDate,
+
+    /// <summary>
+    ///     Sort by the date the node was last updated.
+    /// </summary>
+    UpdateDate,
+}
@@ -454,7 +454,24 @@ public static class ContentRepositoryExtensions
    ///     Clears all publish culture information from the content item.
    /// </summary>
    /// <param name="content">The content item to clear publish information from.</param>
-    public static void ClearPublishInfos(this IContent content) => content.PublishCultureInfos = null;
+    public static void ClearPublishInfos(this IContent content)
+    {
+        if (content.PublishCultureInfos is null)
+        {
+            return;
+        }
+
+        // Pass each published culture through ClearPublishInfo([culture]) to ensure correct change tracking.
+        var cultures = content.PublishCultureInfos.Values.Select(c => c.Culture).ToArray();
+        foreach (var culture in cultures)
+        {
+            content.ClearPublishInfo(culture);
+        }
+
+        // Following #22799 the explicit calls to `ClearPublishInfo` for each culture cause the unpublish in all cultures.
+        // `PublishCultureInfos` is set to null purely to retain previous behaviour at a property level.
+        content.PublishCultureInfos = null;
+    }

    /// <summary>
    ///     Returns false if the culture is already unpublished
@@ -8,7 +8,25 @@ namespace Umbraco.Cms.Core.Models.Navigation;
 /// </summary>
 public sealed class NavigationNode
 {
-    private ConcurrentHashSet<Guid> _children;
+    private static readonly Comparison<(Guid Key, int SortOrder)> _sortBySortOrder =
+        static (a, b) => a.SortOrder.CompareTo(b.SortOrder);
+
+    private readonly ConcurrentHashSet<Guid> _children;
+
+    /// <summary>
+    /// Cached snapshot of <see cref="Children"/> ordered by each child's <c>SortOrder</c>.
+    /// </summary>
+    /// <remarks>
+    /// Built lazily by <see cref="GetOrderedChildren"/> on first access and invalidated
+    /// (set to <c>null</c>) by <see cref="AddChild"/> / <see cref="RemoveChild"/> /
+    /// <see cref="InvalidateOrderedChildren"/>. Reads are lock-free on the fast path; the
+    /// build and invalidation paths take <see cref="_orderedChildrenLock"/> so concurrent
+    /// first-access threads agree on a single canonical array and an in-flight build
+    /// cannot finish after a concurrent invalidation has cleared it.
+    /// </remarks>
+    private Guid[]? _orderedChildren;
+
+    private readonly Lock _orderedChildrenLock = new();

    /// <summary>
    ///     Gets the unique key of this navigation node.
@@ -53,6 +71,17 @@ public sealed class NavigationNode
    ///     Updates the sort order of this node.
    /// </summary>
    /// <param name="newSortOrder">The new sort order value.</param>
+    /// <remarks>
+    ///     The parent node's cached ordered-children list (if any) is now stale because it sorts
+    ///     by child <c>SortOrder</c>. Callers that hold a reference to the parent should call
+    ///     <see cref="InvalidateOrderedChildren"/> on it; <see cref="NavigationNode"/> does not
+    ///     hold a reference to its parent <see cref="NavigationNode"/> so cannot invalidate it
+    ///     itself.
+    /// </remarks>
+    // TODO (V19): Make internal. The contract requires the caller to invalidate the parent's
+    // ordered-children cache (InvalidateOrderedChildren is internal, so external callers cannot
+    // satisfy that contract and would silently observe stale ordering on subsequent reads).
+    // Internal callers in ContentNavigationServiceBase already do the invalidation correctly.
    public void UpdateSortOrder(int newSortOrder) => SortOrder = newSortOrder;

    /// <summary>
@@ -74,6 +103,8 @@ public sealed class NavigationNode
        child.SortOrder = _children.Count;

        _children.Add(childKey);
+
+        InvalidateOrderedChildren();
    }

    /// <summary>
@@ -91,5 +122,91 @@ public sealed class NavigationNode

        _children.Remove(childKey);
        child.Parent = null;
+
+        InvalidateOrderedChildren();
+    }
+
+    /// <summary>
+    ///     Returns this node's children ordered by <c>SortOrder</c>.
+    /// </summary>
+    /// <param name="navigationStructure">The navigation structure dictionary containing all nodes; needed to look up each child's current <c>SortOrder</c>.</param>
+    /// <returns>An immutable, sort-order-presorted snapshot of the children. The result is cached and reused across calls until the children set or a child's <c>SortOrder</c> is mutated.</returns>
+    /// <remarks>
+    ///     Lock-free fast path: a non-null cached array is returned without acquiring the lock.
+    ///     If the cache is empty, <see cref="BuildOrderedChildren"/> is called under the lock to
+    ///     build (with double-checked re-read) and store the canonical array.
+    /// </remarks>
+    internal IReadOnlyList<Guid> GetOrderedChildren(ConcurrentDictionary<Guid, NavigationNode> navigationStructure)
+    {
+        // Volatile.Read provides the acquire fence that pairs with the release fence on the
+        // lock-protected stores in BuildOrderedChildren / InvalidateOrderedChildren. On weak
+        // memory architectures (e.g. ARM64) a plain read can observe writes out of order with
+        // the lock release, so without this barrier a reader could in principle see a torn or
+        // unpublished reference; on x86/x64 the TSO model already gives acquire semantics so
+        // this compiles to a normal load. Matches the lock-free read idiom in System.Lazy<T>
+        // and LazyInitializer.EnsureInitialized.
+        Guid[]? cached = Volatile.Read(ref _orderedChildren);
+        if (cached is not null)
+        {
+            return cached;
+        }
+
+        return BuildOrderedChildren(navigationStructure);
+    }
+
+    /// <summary>
+    ///     Invalidates the cached ordered-children snapshot.
+    /// </summary>
+    /// <remarks>
+    ///     Called by <see cref="AddChild"/> and <see cref="RemoveChild"/> automatically. Must be
+    ///     called externally when a child's <c>SortOrder</c> changes (the parent's cache sorts by
+    ///     child <c>SortOrder</c> and so is stale after such an update).
+    /// </remarks>
+    internal void InvalidateOrderedChildren()
+    {
+        lock (_orderedChildrenLock)
+        {
+            _orderedChildren = null;
+        }
+    }
+
+    private Guid[] BuildOrderedChildren(ConcurrentDictionary<Guid, NavigationNode> navigationStructure)
+    {
+        lock (_orderedChildrenLock)
+        {
+            // Double-check under the lock — another thread may have built the cache while we
+            // were waiting to acquire it.
+            Guid[]? cached = _orderedChildren;
+            if (cached is not null)
+            {
+                return cached;
+            }
+
+            if (_children.Count == 0)
+            {
+                _orderedChildren = [];
+                return _orderedChildren;
+            }
+
+            var sorted = new List<(Guid Key, int SortOrder)>(_children.Count);
+            foreach (Guid childKey in _children)
+            {
+                if (navigationStructure.TryGetValue(childKey, out NavigationNode? childNode))
+                {
+                    sorted.Add((childKey, childNode.SortOrder));
+                }
+            }
+
+            sorted.Sort(_sortBySortOrder);
+
+            var result = new Guid[sorted.Count];
+            for (var i = 0; i < sorted.Count; i++)
+            {
+                result[i] = sorted[i].Key;
+            }
+
+            _orderedChildren = result;
+            return result;
+        }
    }
 }
@@ -0,0 +1,12 @@
+namespace Umbraco.Cms.Core.Models;
+
+/// <summary>
+///  Represents the model used for updating a current user.
+/// </summary>
+public class UserUpdateProfileModel
+{
+    /// <summary>
+    ///     Gets or sets the ISO code of the user's preferred language.
+    /// </summary>
+    public required string LanguageIsoCode { get; set; }
+}
@@ -16,6 +16,19 @@ public interface IContentRepository<in TId, TEntity> : IReadWriteQueryRepository
    /// </summary>
    int RecycleBinId { get; }

+    /// <summary>
+    ///     Updates the sort order of the specified nodes so that each node's sort order matches its
+    ///     position in the supplied (already ordered) collection, in a single set-based update.
+    /// </summary>
+    /// <param name="orderedNodeIds">The node identifiers in their desired order.</param>
+    /// <remarks>
+    ///     This persists the sort order directly and does not load the entities or fire any notifications;
+    ///     callers are responsible for any required cache refresh and auditing.
+    /// </remarks>
+    // TODO (V19): Remove the default implementation.
+    void UpdateSortOrder(IReadOnlyList<int> orderedNodeIds)
+        => throw new NotImplementedException();
+
    /// <summary>
    ///     Gets versions.
    /// </summary>
@@ -28,6 +28,27 @@ public interface IDocumentCacheService
    /// <returns>The published content, or <c>null</c> if not found.</returns>
    Task<IPublishedContent?> GetByIdAsync(int id, bool? preview = null);

+    /// <summary>
+    /// Attempts to retrieve a content item from the in-memory converted-content cache without
+    /// touching the distributed cache or the database.
+    /// </summary>
+    /// <param name="key">The unique key of the content.</param>
+    /// <param name="preview">Whether to consider unpublished content.</param>
+    /// <param name="content">When this method returns, contains the cached published content if a hit was made; otherwise <c>null</c>.</param>
+    /// <returns><c>true</c> if the content was served from the in-memory cache; <c>false</c> if a slower retrieval (HybridCache or database) is required.</returns>
+    /// <remarks>
+    /// Synchronous fast-path used by sync consumers (e.g. <c>IPublishedContentCache.GetById(bool, Guid)</c>)
+    /// to avoid setting up the async state machine on the dominant warm-cache case. On a miss
+    /// the caller falls back to the existing async path. The default implementation always
+    /// returns <c>false</c> so the caller takes the async path.
+    /// </remarks>
+    // TODO (V19): Remove the default implementation.
+    bool TryGetCached(Guid key, bool preview, out IPublishedContent? content)
+    {
+        content = null;
+        return false;
+    }
+
    /// <summary>
    /// Seeds the cache with initial content data.
    /// </summary>
@@ -26,6 +26,26 @@ public interface IMediaCacheService
    /// <returns>The published media content, or <c>null</c> if not found.</returns>
    Task<IPublishedContent?> GetByIdAsync(int id);

+    /// <summary>
+    /// Attempts to retrieve a media item from the in-memory converted-content cache without
+    /// touching the distributed cache or the database.
+    /// </summary>
+    /// <param name="key">The unique key of the media.</param>
+    /// <param name="content">When this method returns, contains the cached published media if a hit was made; otherwise <c>null</c>.</param>
+    /// <returns><c>true</c> if the media was served from the in-memory cache; <c>false</c> if a slower retrieval (HybridCache or database) is required.</returns>
+    /// <remarks>
+    /// Synchronous fast-path used by sync consumers (e.g. <c>IPublishedMediaCache.GetById(bool, Guid)</c>)
+    /// to avoid setting up the async state machine on the dominant warm-cache case. On a miss
+    /// the caller falls back to the existing async path. The default implementation always
+    /// returns <c>false</c> so the caller takes the async path.
+    /// </remarks>
+    // TODO (V19): Remove the default implementation.
+    bool TryGetCached(Guid key, out IPublishedContent? content)
+    {
+        content = null;
+        return false;
+    }
+
    /// <summary>
    /// Determines whether media with the specified identifier exists in the cache.
    /// </summary>
@@ -88,8 +88,8 @@ public class ContentFinderByRedirectUrl : IContentFinder
        }

        IPublishedContent? content = umbracoContext.Content?.GetById(redirectUrl.ContentId);
-        var url = content == null ? "#" : content.Url(_publishedUrlProvider, redirectUrl.Culture);
-        if (url.StartsWith("#"))
+        var url = content == null ? Constants.Routing.Unroutable : content.Url(_publishedUrlProvider, redirectUrl.Culture);
+        if (url.StartsWith(Constants.Routing.Unroutable))
        {
            if (_logger.IsEnabled(LogLevel.Debug))
            {
@@ -47,7 +47,7 @@ public interface IPublishedUrlProvider
    ///         If the published content is multi-lingual, gets the url for the specified culture or,
    ///         when no culture is specified, the current culture.
    ///     </para>
-    ///     <para>If the provider is unable to provide a url, it returns "#".</para>
+    ///     <para>If the provider is unable to provide a url, it returns <see cref="Constants.Routing.Unroutable"/>.</para>
    /// </remarks>
    string GetUrl(IPublishedContent content, UrlMode mode = UrlMode.Default, string? culture = null, Uri? current = null);

@@ -123,7 +123,7 @@ public class NewDefaultUrlProvider : IUrlProvider

            // although we are passing in culture here, if any node in this path is invariant, it ignores the culture anyways so this is ok
            var route = GetLegacyRouteFormatById(key, culture);
-            if (route == null || route == "#")
+            if (route == null || route == Constants.Routing.Unroutable)
            {
                continue;
            }
@@ -184,7 +184,7 @@ public class NewDefaultUrlProvider : IUrlProvider
        var isDraft = _umbracoContextAccessor.GetRequiredUmbracoContext().InPreviewMode;
        if (isDraft is false && string.IsNullOrWhiteSpace(culture) is false && content.Cultures.Any() && content.IsInvariantOrHasCulture(culture) is false)
        {
-            route = "#";
+            route = Constants.Routing.Unroutable;
        }
        else
        {
@@ -206,7 +206,7 @@ public class NewDefaultUrlProvider : IUrlProvider
        UrlMode mode,
        string? culture)
    {
-        if (string.IsNullOrWhiteSpace(route) || route.Equals("#"))
+        if (string.IsNullOrWhiteSpace(route) || route.Equals(Constants.Routing.Unroutable))
        {
            if (_logger.IsEnabled(LogLevel.Debug))
            {
@@ -913,7 +913,7 @@ public class PublishedRouter : IPublishedRouter
        }

        var redirectId = request.PublishedContent.Value(_publishedValueFallback, Constants.Conventions.Content.Redirect, defaultValue: -1);
-        var redirectUrl = "#";
+        var redirectUrl = Constants.Routing.Unroutable;
        if (redirectId > 0)
        {
            redirectUrl = _publishedUrlProvider.GetUrl(redirectId);
@@ -931,7 +931,7 @@ public class PublishedRouter : IPublishedRouter
            }
        }

-        if (redirectUrl != "#")
+        if (redirectUrl != Constants.Routing.Unroutable)
        {
            request.SetRedirect(redirectUrl);
        }
@@ -68,7 +68,7 @@ public class PublishedUrlInfoProvider : IPublishedUrlInfoProvider
            var url = _publishedUrlProvider.GetUrl(content.Key, culture: culture);

            // Handle "could not get URL"
-            if (url is "#" or "#ex")
+            if (url is Constants.Routing.Unroutable or Constants.Routing.UrlProviderException)
            {
                // For invariant content, a missing URL just means there's no domain
                // for this culture — not a problem worth reporting.
@@ -112,13 +112,13 @@ namespace Umbraco.Cms.Core.Routing
        /// <para>The URL is absolute or relative depending on <c>mode</c> and on <c>current</c>.</para>
        /// <para>If the published content is multi-lingual, gets the URL for the specified culture or,
        /// when no culture is specified, the current culture.</para>
-        /// <para>If the provider is unable to provide a URL, it returns "#".</para>
+        /// <para>If the provider is unable to provide a URL, it returns <see cref="Constants.Routing.Unroutable"/>.</para>
        /// </remarks>
        public string GetUrl(IPublishedContent? content, UrlMode mode = UrlMode.Default, string? culture = null, Uri? current = null)
        {
            if (content == null || content.ContentType.ItemType == PublishedItemType.Element)
            {
-                return "#";
+                return Constants.Routing.Unroutable;
            }

            if (mode == UrlMode.Default)
@@ -144,7 +144,7 @@ namespace Umbraco.Cms.Core.Routing

            UrlInfo? url = _urlProviders.Select(provider => provider.GetUrl(content, mode, culture, current))
                .FirstOrDefault(u => u is not null);
-            return url?.Url?.ToString() ?? "#"; // legacy wants this
+            return url?.Url?.ToString() ?? Constants.Routing.Unroutable; // legacy wants this
        }

        /// <inheritdoc />
@@ -155,7 +155,7 @@ namespace Umbraco.Cms.Core.Routing
            var url = provider == null
                ? route // what else?
                : provider.GetUrlFromRoute(route, id, umbracoContext.CleanedUmbracoUrl, Mode, culture)?.Url?.ToString();
-            return url ?? "#";
+            return url ?? Constants.Routing.Unroutable;
        }

        #endregion
@@ -146,18 +146,18 @@ public static class UrlProviderExtensions
            catch (Exception ex)
            {
                logger.LogError(ex, "GetUrl exception.");
-                url = "#ex";
+                url = Constants.Routing.UrlProviderException;
            }

            switch (url)
            {
                // deal with 'could not get the URL'
-                case "#":
+                case Constants.Routing.Unroutable:
                    result.Add(HandleCouldNotGetUrl(content, culture, contentService, textService));
                    break;

                // deal with exceptions
-                case "#ex":
+                case Constants.Routing.UrlProviderException:
                    result.Add(UrlInfo.AsMessage(textService.Localize("content", "getUrlException"), UrlProviderAlias, culture));
                    break;

@@ -183,7 +183,7 @@ public static class UrlProviderExtensions

    private static UrlInfo HandleCouldNotGetUrl(IContent content, string culture, IContentService contentService, ILocalizedTextService textService)
    {
-        // document has a published version yet its URL is "#" => a parent must be
+        // document has a published version yet its URL is unrouteable => a parent must be
        // unpublished, walk up the tree until we find it, and report.
        IContent? parent = content;
        do
@@ -105,7 +105,15 @@ internal sealed class ContentEditingService

    /// <inheritdoc />
    public async Task<Attempt<ContentValidationResult, ContentEditingOperationStatus>> ValidateCreateAsync(ContentCreateModel createModel, Guid userKey)
-        => await ValidateCulturesAndPropertiesAsync(createModel, createModel.ContentTypeKey, await GetCulturesToValidate(createModel.Variants.Select(variant => variant.Culture), userKey));
+    {
+        ContentEditingOperationStatus creationAllowedStatus = await ValidateCreationAllowedAsync(createModel);
+        if (creationAllowedStatus != ContentEditingOperationStatus.Success)
+        {
+            return Attempt.FailWithStatus(creationAllowedStatus, new ContentValidationResult());
+        }
+
+        return await ValidateCulturesAndPropertiesAsync(createModel, createModel.ContentTypeKey, await GetCulturesToValidate(createModel.Variants.Select(variant => variant.Culture), userKey));
+    }

    private async Task<IEnumerable<string?>?> GetCulturesToValidate(IEnumerable<string?>? cultures, Guid userKey)
    {
@@ -332,6 +340,15 @@ internal sealed class ContentEditingService
        Guid userKey)
        => await HandleSortAsync(parentKey, sortingModels, userKey);

+    /// <inheritdoc />
+    public async Task<ContentEditingOperationStatus> SortByFieldAsync(
+        Guid? parentKey,
+        ContentSortField field,
+        Direction direction,
+        string? culture,
+        Guid userKey)
+        => await HandleSortByFieldAsync(parentKey, field, direction, culture, userKey);
+
    private async Task<Attempt<ContentValidationResult, ContentEditingOperationStatus>> ValidateCulturesAndPropertiesAsync(
        ContentEditingModelBase contentEditingModelBase,
        Guid contentTypeKey,
@@ -384,8 +401,8 @@ internal sealed class ContentEditingService
    protected override OperationResult? Delete(IContent content, int userId) => ContentService.Delete(content, userId);

    /// <inheritdoc />
-    protected override IEnumerable<IContent> GetPagedChildren(int parentId, int pageIndex, int pageSize, out long total)
-        => ContentService.GetPagedChildren(parentId, pageIndex, pageSize, out total, propertyAliases: null, filter: null, ordering: null);
+    protected override IEnumerable<IContent> GetPagedChildren(int parentId, int pageIndex, int pageSize, Ordering? ordering, out long total)
+        => ContentService.GetPagedChildren(parentId, pageIndex, pageSize, out total, propertyAliases: null, filter: null, ordering: ordering);

    /// <inheritdoc />
    protected override ContentEditingOperationStatus Sort(IEnumerable<IContent> items, int userId)
@@ -394,6 +411,13 @@ internal sealed class ContentEditingService
        return OperationResultToOperationStatus(result);
    }

+    /// <inheritdoc />
+    protected override ContentEditingOperationStatus SortChildrenInBulk(int parentId, IReadOnlyList<int> orderedChildIds, int userId)
+    {
+        OperationResult result = ContentService.SortChildren(parentId, orderedChildIds, userId);
+        return OperationResultToOperationStatus(result);
+    }
+
    private async Task<ContentEditingOperationStatus> Save(IContent content, Guid userKey)
    {
        try
@@ -389,7 +389,7 @@ internal abstract class ContentEditingServiceBase<TContent, TContentType, TConte
            // at this point the parent MUST exist - unless someone starts using this move method
            // e.g. for blueprints (which should be handled elsewhere).
            TContent parentContent = ContentService.GetById(parentKey.Value) ?? throw new InvalidOperationException("The content parent ID was validated, but the parent was not found");
-            if (parentContent.Path.Split(Constants.CharArrays.Comma).Select(int.Parse).Contains(content.Id) is true)
+            if (parentContent.Path.GetIdsFromPath().Contains(content.Id))
            {
                return Attempt.FailWithStatus<TContent?, ContentEditingOperationStatus>(ContentEditingOperationStatus.ParentInvalid, content);
            }
@@ -458,6 +458,10 @@ internal abstract class ContentEditingServiceBase<TContent, TContentType, TConte
        {
            // these are the only result states currently expected from the invoked IContentService operations
            OperationResultType.Success => ContentEditingOperationStatus.Success,
+
+            // a no-op (e.g. sorting children when nothing needs reordering) is a successful outcome, not an error
+            OperationResultType.NoOperation => ContentEditingOperationStatus.Success,
+
            OperationResultType.FailedCancelledByEvent => ContentEditingOperationStatus.CancelledByNotification,
            OperationResultType.FailedCannot => ContentEditingOperationStatus.CannotDeleteWhenReferenced,

@@ -619,6 +623,25 @@ internal abstract class ContentEditingServiceBase<TContent, TContentType, TConte
        return filteredContentTypes.Any();
    }

+    /// <summary>
+    /// Validates that content of the requested type is allowed to be created under the requested parent, applying the
+    /// same "allowed at root", "allowed as child" and content type filter rules that are enforced when the content is
+    /// actually created. This allows the validation endpoints to be consistent with creation.
+    /// </summary>
+    /// <param name="createModel">The content creation model.</param>
+    /// <returns>The operation status; <see cref="ContentEditingOperationStatus.Success"/> when creation is allowed.</returns>
+    protected async Task<ContentEditingOperationStatus> ValidateCreationAllowedAsync(ContentCreationModelBase createModel)
+    {
+        TContentType? contentType = ContentTypeService.Get(createModel.ContentTypeKey);
+        if (contentType is null)
+        {
+            return ContentEditingOperationStatus.ContentTypeNotFound;
+        }
+
+        (int? _, ContentEditingOperationStatus operationStatus) = await TryGetAndValidateParentIdAsync(createModel.ParentKey, contentType);
+        return operationStatus;
+    }
+
    private void UpdateNames(ContentEditingModelBase contentEditingModelBase, TContent content, TContentType contentType)
    {
        if (contentType.VariesByCulture())
@@ -86,9 +86,10 @@ internal abstract class ContentEditingServiceWithSortingBase<TContent, TContentT
    /// <param name="parentId">The parent identifier.</param>
    /// <param name="pageIndex">The zero-based page index.</param>
    /// <param name="pageSize">The page size.</param>
+    /// <param name="ordering">The ordering to apply, or <c>null</c> to use the default (sort order).</param>
    /// <param name="total">The total number of children.</param>
    /// <returns>The paged children.</returns>
-    protected abstract IEnumerable<TContent> GetPagedChildren(int parentId, int pageIndex, int pageSize, out long total);
+    protected abstract IEnumerable<TContent> GetPagedChildren(int parentId, int pageIndex, int pageSize, Ordering? ordering, out long total);

    /// <summary>
    /// Handles the sorting operation asynchronously.
@@ -111,16 +112,7 @@ internal abstract class ContentEditingServiceWithSortingBase<TContent, TContentT
            return ContentEditingOperationStatus.NotFound;
        }

-        const int pageSize = 500;
-        var pageNumber = 0;
-        IEnumerable<TContent> page = GetPagedChildren(contentId.Value, pageNumber++, pageSize, out var total);
-        var children = new List<TContent>((int)total);
-        children.AddRange(page);
-        while (pageNumber * pageSize < total)
-        {
-            page = GetPagedChildren(contentId.Value, pageNumber++, pageSize, out _);
-            children.AddRange(page);
-        }
+        List<TContent> children = LoadAllChildren(contentId.Value, ordering: null);

        try
        {
@@ -138,4 +130,102 @@ internal abstract class ContentEditingServiceWithSortingBase<TContent, TContentT
            return ContentEditingOperationStatus.SortingInvalid;
        }
    }
+
+    /// <summary>
+    /// Handles sorting a parent's children by a system field asynchronously.
+    /// </summary>
+    /// <param name="parentKey">The optional parent key.</param>
+    /// <param name="field">The system field to sort the children by.</param>
+    /// <param name="direction">The direction to sort in.</param>
+    /// <param name="culture">The culture whose variant name to sort by, or <c>null</c> to sort by the invariant name. Only applies when sorting by <see cref="ContentSortField.Name"/>. The culture is not validated: a child that does not vary by the given culture - or an unrecognised culture - falls back to the invariant name.</param>
+    /// <param name="userKey">The user key performing the operation.</param>
+    /// <returns>The operation status.</returns>
+    protected async Task<ContentEditingOperationStatus> HandleSortByFieldAsync(
+        Guid? parentKey,
+        ContentSortField field,
+        Direction direction,
+        string? culture,
+        Guid userKey)
+    {
+        var contentId = parentKey.HasValue
+            ? ContentService.GetById(parentKey.Value)?.Id
+            : Constants.System.Root;
+
+        if (contentId.HasValue is false)
+        {
+            return ContentEditingOperationStatus.NotFound;
+        }
+
+        Ordering ordering = BuildOrdering(field, direction, culture);
+
+        // The database does the ordering (matching the list view and the order shown in the sort UI).
+        if (ContentSettings.SortChildrenByFieldFiresNotifications)
+        {
+            // Opt-in path: load the children and persist via the standard sort, firing per-item
+            // save/sort notifications (and therefore webhooks), at the cost of loading every child.
+            List<TContent> orderedChildren = LoadAllChildren(contentId.Value, ordering);
+            if (orderedChildren.Count == 0)
+            {
+                return ContentEditingOperationStatus.Success;
+            }
+
+            return Sort(orderedChildren, await GetUserIdAsync(userKey));
+        }
+
+        // Default path: persist the resulting order with a single set-based update and a branch cache
+        // refresh, without loading every child or firing per-item notifications.
+        List<int> orderedChildIds = LoadOrderedChildIds(contentId.Value, ordering);
+        if (orderedChildIds.Count == 0)
+        {
+            // Nothing to sort - the order is trivially correct.
+            return ContentEditingOperationStatus.Success;
+        }
+
+        return SortChildrenInBulk(contentId.Value, orderedChildIds, await GetUserIdAsync(userKey));
+    }
+
+    /// <summary>
+    /// Persists the supplied (already ordered) child identifiers as the new sort order, without loading
+    /// the children or firing per-item notifications.
+    /// </summary>
+    /// <param name="parentId">The parent identifier, or the root identifier for root-level sorting.</param>
+    /// <param name="orderedChildIds">The child identifiers in their desired order.</param>
+    /// <param name="userId">The user performing the operation.</param>
+    /// <returns>The operation status.</returns>
+    protected abstract ContentEditingOperationStatus SortChildrenInBulk(int parentId, IReadOnlyList<int> orderedChildIds, int userId);
+
+    private List<int> LoadOrderedChildIds(int contentId, Ordering ordering)
+        => LoadAllChildren(contentId, ordering, child => child.Id);
+
+    private List<TContent> LoadAllChildren(int contentId, Ordering? ordering)
+        => LoadAllChildren(contentId, ordering, child => child);
+
+    // Pages through all children, projecting each page with the selector so callers that only need a
+    // lightweight value (e.g. the id) don't retain every loaded child.
+    private List<TResult> LoadAllChildren<TResult>(int contentId, Ordering? ordering, Func<TContent, TResult> selector)
+    {
+        const int pageSize = 500;
+        var pageNumber = 0;
+        IEnumerable<TContent> page = GetPagedChildren(contentId, pageNumber++, pageSize, ordering, out var total);
+        var results = new List<TResult>((int)total);
+        results.AddRange(page.Select(selector));
+        while (pageNumber * pageSize < total)
+        {
+            page = GetPagedChildren(contentId, pageNumber++, pageSize, ordering, out _);
+            results.AddRange(page.Select(selector));
+        }
+
+        return results;
+    }
+
+    private static Ordering BuildOrdering(ContentSortField field, Direction direction, string? culture)
+        => field switch
+        {
+            // Name is variant - the culture selects the variant name to order by (invariant content and media
+            // ignore it). Create and update dates are node-level, so the culture does not apply.
+            ContentSortField.Name => Ordering.By("name", direction, culture),
+            ContentSortField.CreateDate => Ordering.By("createDate", direction),
+            ContentSortField.UpdateDate => Ordering.By("updateDate", direction),
+            _ => throw new ArgumentOutOfRangeException(nameof(field), field, "Unsupported sort field."),
+        };
 }
--- a/Show More
+++ b/Show More