Docs: update for tag rules, Sidekiq health, SimpleFIN, and NDJSON import

guides/app-features/csv-imports.mdx

@@ -148,6 +148,19 @@ Sure will import all rows from your CSV. Review your data before importing to av
 If a CSV import fails during upload or publish, check both the row count and the file size. An import can be under the row limit and still fail if the CSV file is larger than 10 MB.
 </Note>
 
+## Sure NDJSON (full data export/import)
+
+Sure can export and import your complete family data as an NDJSON file (`all.ndjson`) from **Settings → Data**. This format preserves all accounts, transactions, rules, tags, merchants, and categories in a single file.
+
+### Known import behaviors
+
+- **Rules without names**: Rules are allowed to have no name. The importer uses the rule's ID, not its name, so rules with `"name": null` import correctly.
+- **Orphaned rejected transfers**: If a rejected transfer references a transaction that was deleted before the export, the importer skips that row and counts it as a warning rather than blocking the entire import. The warning appears in the preflight response so you can review it before committing.
+
+### Preflight validation
+
+Before importing a large NDJSON file, use the preflight endpoint or the in-app preview to check for warnings. Preflight warnings are returned as plain strings describing the affected line, record type, and field so you can identify and resolve issues before the import runs.
+
 ## Getting help
 
 If you encounter issues with CSV imports:

guides/app-features/transactions.mdx

@@ -94,6 +94,19 @@ Sure prevents merges that would make the category hierarchy confusing or invalid
 
 If a source category has subcategories and the target is a parent category, Sure reparents those subcategories under the target.
 
+## Transaction rules and tags
+
+Rules can now match transactions by their existing tags in addition to setting tags. Use the **Transaction tag** condition in the rule builder to filter transactions that already have a specific tag applied.
+
+The tag condition supports two operators:
+
+- **Equal to**: Matches transactions that have the selected tag
+- **Is empty**: Matches transactions that have no tags assigned
+
+You can combine multiple tag conditions in a single rule. AND conditions each check independently, so a rule requiring two tags will correctly match only transactions that have both tags. OR conditions do not inflate results when a transaction has multiple matching tags.
+
+Tag-based rules are also preserved through export and import round-trips, so rules that use tag conditions survive a full data export and re-import.
+
 ## Related pages
 
 - [Budgets](/guides/app-features/budgets)

providers/simplefin.mdx

@@ -102,6 +102,14 @@ Generate a new setup token from your SimpleFIN dashboard.
 
 Some institutions don't return pending transactions even when the `pending=1` parameter is set. This is a limitation of the institution's data feed, not a bug in SimpleFIN or Sure.
 
+### Duplicate accounts with the same name
+
+If you have two accounts at the same institution with identical display names (for example, two accounts both named "CHECKING (0001)"), Sure now correctly tracks each account by its upstream account ID rather than its name alone. Previously, a stale linkage repair could cause one account to silently take over the other's connection, merging transactions and overwriting balances.
+
+If you notice transactions from one account appearing in another after a sync, disconnect and reconnect your SimpleFIN accounts to re-establish clean linkages.
+
+Skipped linkage repairs are recorded in **Settings → Debug** so you can see when Sure detected an ambiguous name match and chose not to act.
+
 ### Network errors
 
 If you experience intermittent sync failures:

self-hosting.mdx

@@ -481,6 +481,65 @@ For production deployments:
 - Use `SMTP_OPENSSL_VERIFY_MODE=peer`
 - If you must use self-signed certificates, provide a CA bundle via `SSL_CA_FILE`
 
+## System health monitoring
+
+Super admins can check the health of background job processing from **Settings → Advanced → System health**.
+
+The system health page shows:
+
+- **Sidekiq process count**: Number of active worker processes
+- **Last heartbeat**: When the worker last reported in
+- **Queue latency**: Maximum time a job has been waiting to run
+- **Job counters**: Processed and failed job totals
+- **Per-queue depth**: Number of jobs waiting in each queue
+
+### Sidekiq health banner
+
+When the Sidekiq worker container is not running, a warning banner appears at the top of every page for super admins. The banner explains that background jobs are stalled and links directly to the system health page so you can diagnose the issue.
+
+Common reasons the banner appears:
+
+| Reason | Description |
+|--------|-------------|
+| No worker processes | The `worker` container is not running |
+| Stale heartbeat | The worker has not reported in for more than 2 minutes |
+| Queue backed up | A queue has been waiting more than 5 minutes |
+| Redis unreachable | The worker cannot connect to Redis |
+
+If you see the banner, check that the `worker` service is running:
+
+```bash
+docker compose ps worker
+docker compose logs worker --tail 50
+```
+
+If the worker is stopped, restart it:
+
+```bash
+docker compose up -d worker
+```
+
+The system health page bypasses the cache and always shows live state, so you can confirm the worker is healthy immediately after restarting it.
+
+### Tuning health check thresholds
+
+The default thresholds are conservative to avoid false positives during normal deploys and brief Redis blips. You can adjust them with environment variables:
+
+```txt
+# Seconds before a worker heartbeat is considered stale (default: 120)
+SIDEKIQ_HEALTH_HEARTBEAT_TIMEOUT=120
+
+# Seconds of queue latency before the instance is considered unhealthy (default: 300)
+SIDEKIQ_HEALTH_LATENCY_THRESHOLD=300
+
+# Seconds to cache the health snapshot across requests (default: 60)
+SIDEKIQ_HEALTH_CACHE_TTL=60
+```
+
+<Note>
+The system health page and Sidekiq banner are only available in self-hosted mode. Managed deployments do not show these controls.
+</Note>
+
 ## Troubleshooting
 
 ### Database connection errors